Sniffing traffic between a Flex app and ColdFusion backend

Question

What is a good strategy for sniffing/tracing function calls between a Flex application and a ColdFusion-based backend running on ColdFusion server? I understand they use AMF protocol.

I'm used to using Fiddler to sniff transactions between HTTP clients and servers, and it works great as long as you're using plain text or XML HTTP requests and responses (including those over SSL) but it isn't much help for binary protocols like AMF over HTTP.

In my case, I do have access to the source code for the client and server, but I'm looking for an easy way to passively sniff traffic in any Flex + ColdFusion situation, without having to tweak anything on the server.

Answer 1

Wireshark: sniffing the glue that holds the internet together

http://www.wireshark.org/

Answer 2

http://www.charlesproxy.com/

Although not free, will decode AMF binary data and allows to trace SSL connections too.

Answer 3

ServiceCapture is another option. It decodes the binary AMF for you, if I remember correctly.

http://kevinlangdon.com/serviceCapture/

Answer 4

Firebug with the Flashbug plugin will show all decoded AMF messages both to and from a Flash app. Works well over HTTPS too.

https://addons.mozilla.org/en-us/firefox/addon/amf-explorer/.