Comparing Sessions

Traffic Jam keeps every imported capture in one workspace, so the same endpoint recorded in two builds or before/after a change can be lined up and diffed field by field. Comparison lives in three Analysis tabs — Compare, TLS, and Timeline — reachable from the workspace navigation (import captures first, see /docs/en/capture/).

Pair a baseline against a candidate

Open the Compare tab. Two pickers sit at the top: Baseline (the reference request) and Candidate (what you measure it against). Pick a Baseline and Traffic Jam auto-selects the best Candidate from a different capture, ranked by a match score.

Pairs are keyed by method, authority, and path — the same compareKey used to group traffic elsewhere. The score rewards, in descending weight:

A score of 72+ (or any same-target match) is a Best match, 60+ is Strong, below that Weak; weak matches are never auto-selected. The Candidate picker’s Match filter narrows to cross-capture, same target, same host, or same capture. When the same request fired multiple times, the ‹ n/m › stepper beside a picker walks its occurrences.

[!TIP] Keyboard: a opens Baseline, m opens Candidate, / focuses whichever is empty, [ ] step Baseline occurrences, { } step Candidate, x swaps sides, s saves the pair as a comparison set, d clears both.

The comparison header summarizes drift at a glance: a change-count per area, plus warning badges when status (200 → 404), protocol (HTTP/2 → HTTP/1), or duration differ.

Diff each part of the exchange

The detail panel opens on the first tab that has differences. Tabs 1–8 jump between:

Header comparison is order-aware: reordering Cookie and Authorization shows up as an order change even when every value is identical — useful when a server is sensitive to header sequence.

For bodies, switch between Semantic and Text with the toggle above the diff. Semantic diff parses both sides and aligns entries by path, so reformatted JSON or reordered form fields surface as per-field changed / added / removed rows instead of a wall of red text:

The word / char control sets the inline highlight granularity for the text view.

Compare TLS ClientHello fingerprints

The TLS tab inside a request pair, and the standalone TLS Analysis tab, diff the actual handshake — not just HTTP. Only PCAP/PCAPNG imports carry ClientHellos; HAR files have no handshake packets, so the tab explains this and offers to check certificates instead.

The fields table rows each fingerprint field and marks it same / diff:

SNI, ALPN, version, supported versions, JA3, JA3 full, JA4, JA4 raw, cipher suites, extensions, supported groups, EC point formats, signature algs.

Beyond the table, three views are available: Fields, Raw hello (a byte-offset hex dump of the ClientHello, plus the reassembled hello when the handshake spanned segments), and Text diff. Copy buttons export the raw hex. The summary strip and badges flag whether fields, raw bytes, JA3, JA4, or ALPN changed.

The TLS picker scores Candidates differently from HTTP: same target +60, same SNI +50, different JA3/JA4 +16, other capture +8, shared ALPN +6. Toggle chips filter to Raw hello only, Has SNI, Has JA4, Same target, Same SNI, or Different JA3/JA4.

[!NOTE] Group repeated (on by default) collapses identical ClientHellos — same capture, target, JA4/JA3, and ALPN — into one row with an ×N occurrence count. Turning it off reveals every raw handshake, which is how you cluster distinct TLS clients that talked to the same host.

Audit certificates

The TLS tab’s Certificates sub-tab (keys 1/2 switch Compare/Certificates) lists every server certificate chain observed, searchable by host, issuer, SAN, fingerprint, or capture. Each entry shows subject, issuer, serial, validity window, server name, and chain index, with a validity badge: Valid, Expiring soon (under 30 days), or Expired. This is where you spot a rotated CA, a self-issued cert, or a pinning-relevant serial change between captures.

Spot sequence differences in the Timeline

Per-request diffs miss ordering — a capture that makes an extra call, skips one, or reorders the flow. Open the Timeline tab and switch to Compare (press v), then choose a baseline and a comparison capture. Traffic Jam aligns the two request sequences and renders three row kinds:

Alignment uses an optimal sequence alignment for captures up to 1200 requests per side and a faster greedy pass above that (labeled fast alignment in the stats line). The stats line reports total rows, matched pairs, and baseline-only / compare-only counts.

From an aligned pair, press p to send both sides straight into the Compare tab as Baseline/Candidate (or a / m to set one side), and open a request’s TLS fingerprint from its inspector. Timeline filters — search, hosts, status (2xx–5xx, errors, open), protocol, method, stream, and body presence — apply to both captures before alignment, so you can diff just the authenticated API calls. See /docs/en/analysis/ for the surrounding analysis workflow.

[!WARNING] Comparison only reads captured traffic; it never sends requests. Any active probing (replay, mutation) is covered elsewhere and must target systems you are authorized to test.