How to Capture and Analyse Network Diagnostic Logs in Google Chrome Using Net-Export

While the standard Network panel inside Google Chrome DevTools is ideal for tracking HTTP requests, inspecting request payloads, and evaluating resource loading waterfalls, it operates at the application layer. When diagnosing subtle networking failures—such as DNS resolution delays, TCP handshake timeouts, TLS 1.3 session renegotiation errors, socket pool saturation, or HTTP/2 and QUIC stream stalls—DevTools often fails to capture the raw socket-level events occurring within the browser’s underlying Chromium network service.

To provide deep visibility into Chromium’s networking stack, Google Chrome includes a dedicated internal diagnostic interface: chrome://net-export. This tool captures comprehensive, low-level network event logs (known as NetLog dumps) directly to a JSON file. These logs can be loaded into the official NetLog Viewer tool to inspect raw socket transactions, analyze cryptographic negotiations, and pinpoint network bottlenecks with surgical precision.

Understanding Chromium NetLog Architecture

The Chromium network service manages all socket connections, caching layers, and proxy configurations across all browser tabs and extensions. When NetLog capturing is initiated:

• Socket Pools: Tracks every raw TCP socket creation, keep-alive pool allocation, connect job, and idle socket timeout.
• DNS Host Resolver: Records every system resolver lookup, internal DNS cache hit/miss, and DNS-over-HTTPS (DoH) exchange with exact millisecond timings.
• SSL/TLS Handshakes: Captures cipher suite negotiation, Application-Layer Protocol Negotiation (ALPN) tokens (such as h2 or http/1.1), and certificate verification chains.
• Multiplexed Protocols: Details HTTP/2 frame exchanges (HEADERS, DATA, SETTINGS, WINDOW_UPDATE) and QUIC/HTTP/3 packet acknowledgements and congestion control states.

Configuring and Starting a NetLog Capture

Capturing diagnostic logs requires minimal setup and does not require launching Chrome with special command-line flags:

1. Open a new tab in Google Chrome.
2. Navigate to the internal URL:

   chrome://net-export/

3. Under the Capture Mode heading, select the appropriate logging granularity:
   • Strip private information (Default): Captures socket states, timings, and protocol frames while stripping cookies, credentials, and query parameters. This mode is safe for sharing with third-party support teams.
   • Include cookies and credentials: Includes full HTTP headers, cookies, and authentication tokens. Use this mode only when debugging authentication failures or cookies, and store the resulting file securely.
   • Include raw bytes: Captures entire unencrypted packet payloads transmitted over sockets. This generates large log files and should only be used for low-level protocol debugging.
4. Click the Start Logging to Disk button.
5. A system save dialog appears. Choose a location (such as your Downloads folder) and save the file as chrome-net-export-log.json.

Reproducing the Target Network Issue

Once logging is active, the chrome://net-export page displays an active recording banner indicating the file path being written.

1. Open a separate tab or window.
2. Navigate to the problematic website, trigger the slow API endpoint, or reproduce the connection failure.
3. Wait until the failure reproduces or the slow asset finishes loading.
4. Return immediately to the chrome://net-export tab and click Stop Logging.

Chrome finalises and closes the JSON log file on disk.

Importing and Viewing Logs in the NetLog Viewer

Because raw NetLog files are structured JSON logs that can span tens of megabytes, analysing them in a text editor is impractical. Use the official Chromium NetLog Viewer web application:

1. In Chrome, navigate to the hosted NetLog Viewer:

   https://netlog-viewer.appspot.com/

   (Alternatively, use an enterprise-hosted local instance of the NetLog Viewer repository).
2. Click Choose File and upload your saved chrome-net-export-log.json file.
3. The viewer parses the log and populates the left-hand diagnostic navigation sidebar.

Key Diagnostic Panels in the NetLog Viewer

Navigate through the sidebar panels to isolate specific networking layers:

1. Events Panel

The central hub of NetLog analysis. Type domain names, socket IDs, or error codes into the filter bar. Selecting any individual event displays the raw time-ordered operational sequence (e.g., HOST_RESOLVER_MANAGER_JOB, SOCKET_POOL, SSL_CONNECT) showing exact microsecond durations.

2. DNS Panel

Displays all DNS queries initiated during the capture. It reveals whether queries were served from the internal browser cache, whether DNS queries timed out, and which IP addresses were returned by the system resolver.

3. Sockets Panel

Provides a live snapshot of all socket pools. If a webpage hangs while attempting to load assets, check the Sockets view to see if the browser hit its limit of 6 concurrent connections per host, causing subsequent requests to queue indefinitely.

4. HTTP/2 and QUIC Panels

Examine active HTTP/2 and HTTP/3 multiplexed sessions. You can inspect stream ID assignments, protocol-level flow control credit allocations, and individual frame exchanges without needing external packet capture tools like Wireshark.

Utilising chrome://net-export empowers web performance engineers and systems administrators to uncover deep transport-layer network failures that traditional browser developer tools cannot expose.