NetScope Detector: Browser Network & Fingerprint Analysis Toolkit
Inspect HTTP activity, local-network probes, security signals, and browser fingerprint surfaces directly from your Firefox or Google Chrome browser.
NetScope — is a set of tools designed to analyze security, privacy, network communication, and browser "fingerprints." It helps users understand exactly what browser data a website can access by analyzing network activity, HTTP headers, browser APIs, and the parameters that make up a "fingerprint."
Instead of reducing complex browser behavior to a simple privacy or security rating, NetScope provides observable technical data and related information that can be analyzed in real time during a browsing session.
What Is NetScope?
Modern websites can obtain far more information about the browser than just data regarding the page content visible to the user. A browsing session may involve dozens or even hundreds of HTTP requests, the use of browser APIs, client hints, graphical interfaces, multimedia processing capabilities, cookies, and other data exchange channels.
NetScope allows you to examine these interactions directly within the Firefox or Google Chrome browser. This extension combines tools for inspecting HTTP traffic, a security signal display panel, local network monitoring capabilities, and browser fingerprint analysis functions.
The goal is not to tell users that their browser is "secure" or "vulnerable to fingerprinting." Instead, NetScope helps answer a more important technical question:
What can a website actually observe from this browser?
By analyzing requests, browser data, security signals, and additional information, researchers can gain a clearer understanding of what occurs during an actual browser session.
Measure, Don't Assume
Browser security and privacy analysis can easily become misleading when individual observations are treated as definitive conclusions.
For example, a website’s call to a browser API does not necessarily mean that the information obtained was used for fingerprinting. Similarly, the detection of an API call associated with fingerprinting does not in itself prove that the data obtained was transmitted to a remote server.
Thus, NetScope separates the behavior under study from its interpretation. The system captures observable data and, where possible, provides additional context regarding the information upon which the conclusion is based.
Evidence-Based Analysis
- Observe browser and network activity.
- Examine the context in which an event occurred.
- Correlate browser signals with network activity.
- Distinguish observed evidence from assumptions.
What Can NetScope Investigate?
NetScope aggregates data from various layers regarding browser and network performance. This enables specialists to analyze website behavior from multiple perspectives, rather than relying solely on the results of a single browser fingerprinting test.
Network Activity
Inspect HTTP requests, methods, response status codes, headers, cookies, and request context in real time.
Security Signals
Investigate browser and security-related signals together with additional forensic context.
Local Network
Identify localhost and local-network probing activity that may reveal how websites interact with the browser's network environment.
Fingerprint Surfaces
Research browser APIs and capabilities such as Canvas, WebGL, WebGPU, Client Hints, media devices, and other fingerprint-related surfaces.
Network & HTTP Inspection
Any modern website generates network activity. Loading a page can trigger requests to the site's own servers, APIs, content delivery networks, analytics platforms, authentication services, and other third-party endpoints.
Simply viewing the rendered page does not reveal this activity. NetScope provides a real-time view of browser HTTP traffic, enabling specialists to examine the requests being sent and the associated information.
Instead of treating network communication as a black box, NetScope makes individual requests available for investigation.
| Network information | What it helps you investigate |
|---|---|
| Request URL | Identify the destination contacted by the browser and distinguish first-party from external endpoints. |
| HTTP method | Understand whether the browser is retrieving, submitting, updating, or otherwise interacting with a resource. |
| Response status | Identify successful requests, redirects, failures, and other server responses. |
| HTTP headers | Examine request and response metadata that can influence how browsers and servers communicate. |
| Cookies | Investigate browser state associated with network communication and individual domains. |
| Request context | Add context to individual network events and make complex browsing sessions easier to analyze. |
Monitor Requests in Real Time
NetScope monitors browser network activity in real time. Requests are displayed in the extension's sidebar, allowing you to observe data exchange while browsing a site.
This is useful when you need to understand what happens immediately after a page loads, when using a specific interface element, or when a browser action triggers additional network data exchange.
Real-time monitoring also makes it possible to analyze actions that would otherwise be difficult to reproduce after the browsing session has ended.
Useful during
- Website security testing
- API and application debugging
- Privacy research
- Browser compatibility testing
- Investigation of unexpected requests
Activity Timeline
A network request rarely exists in isolation. To understand an event properly, you may need to know what happened immediately before and after it.
NetScope presents network requests, security signals, and browser errors in a chronological activity timeline. This provides additional context when investigating a browsing session.
From individual events to a complete sequence
Imagine a page that loads a JavaScript application and then makes several API requests. An individual request might show which node the browser connected to, but the timeline allows you to see the sequence of events that led to that interaction.
This view allows you to correlate network activity, browser errors, and security-related data, rather than analyzing each event individually.
Inspect and Modify HTTP Headers
HTTP headers are an important part of the interaction between the browser and the server. They can contain information about the content being received, language preferences, client capabilities, caching rules, and other aspects of the HTTP request.
Some headers can also influence how a website identifies or characterizes the browser. This makes HTTP headers important for both web development and research into browser privacy.
NetScope allows users to add or modify outgoing HTTP request headers and then observe how the resulting request behaves.
Research different request configurations
Change selected headers and investigate how different request metadata affects browser and server-side observations.
Investigate Client Hints
Examine HTTP Client Hints and related request metadata when researching browser identification and privacy configurations.
Inspect POST and Form Requests
Not all useful information is visible in the request URL. Web applications often transmit data via POST requests, including when submitting forms and interacting with APIs.
NetScope allows you to capture form content transmitted in POST requests, providing additional data when debugging web applications or analyzing the interaction between the browser and an endpoint.
Practical examples
- Debugging a web form that does not submit correctly
- Investigating API requests generated by a web application
- Comparing request data between different browser actions
- Understanding how application interfaces translate user actions into HTTP requests
Search Captured Network Activity
A modern browser session can generate a large number of network events. Manual analysis of each request becomes impractical as the volume of collected information grows.
NetScope features a global search function that allows users to quickly locate specific requests and analyze particular URLs, headers, domains, or other available request information.
The search function becomes particularly useful when analyzing complex applications that execute a large number of requests within a short period of time.
Pause and Resume Network Capture
Continuous monitoring is useful, but sometimes you need to temporarily stop collecting new events so you can focus on information already captured.
NetScope allows network capture to be paused and resumed, giving researchers more control over the inspection process during longer or more complex browsing sessions.
Security & ThreatCenter
Network activity is only one part of browser security research. Websites can also interact with browser APIs and capabilities that reveal information about the environment in which a page is running.
NetScope's security and ThreatCenter functionality brings these observations together with additional forensic context, helping users investigate browser behavior without automatically assigning a security verdict.
The focus is on identifying observable signals, understanding their context, and determining what evidence is actually available.
Evidence over labels
NetScope does not treat every unusual browser event as malicious activity or automatically classify every fingerprint-related API call as tracking.
Instead, the extension is designed to help technical users investigate the underlying evidence.
Local Port & Network Security
Websites normally communicate with remote infrastructure, but browser-accessible web applications can also attempt to interact with resources available on a user's local machine or network.
Localhost and local-network probing can therefore be an important part of browser security research. Understanding these interactions helps researchers determine whether a website is attempting to reach resources outside its normal public network communication.
Localhost Probes
Detect and investigate browser activity involving localhost and locally accessible services.
Local-Network Exposure
Examine interactions that can provide insight into the local network surface exposed to websites.
Find the Script Behind a Browser Signal
Identifying that a browser API was accessed is useful, but understanding which script triggered the access can provide much more context.
For JavaScript-hooked signals, NetScope can capture information about the triggering script, including its caller URL and stack information, with an optional source preview where available.
Investigation Reports
Browser security investigations often involve several pieces of evidence. A useful analysis should distinguish between what was directly observed, what evidence supports a conclusion, and what information is still missing.
NetScope provides investigation reports that organize this information into a more structured format.
Observed Facts
Record what the browser actually exposed or what activity was observed.
Supporting Evidence
Identify evidence that supports an interpretation of the observed behavior.
Missing Evidence
Make clear when available information is insufficient to establish a stronger conclusion.
Network Correlation
Compare browser-side observations with related network activity where evidence is available.
NetScope does not collect request bodies as part of these investigation reports.
Browser Fingerprint & Capability Analysis
A browser fingerprint is built from many different characteristics exposed through browser APIs, graphics interfaces, HTTP metadata, device capabilities, and other parts of the browser environment.
There is no single API that represents a complete browser fingerprint. A website can combine information from multiple surfaces to build a more detailed picture of the environment in which its application is running.
NetScope helps researchers inspect these surfaces individually and investigate how browser properties are accessed, what information they expose, and whether there is supporting evidence of subsequent network transmission.
Canvas Fingerprinting Analysis
The HTML Canvas API can expose information about how a browser renders and reads graphical content. Differences in rendering behavior can sometimes contribute to browser identification and fingerprinting.
NetScope monitors relevant Canvas activity, including drawing
and read operations such as fillText,
drawImage, getImageData,
toDataURL, and toBlob.
Observed Canvas activity is grouped and presented with evidence-based classifications such as possible, likely, or ordinary usage, helping researchers distinguish an API call from a stronger fingerprinting conclusion.
Canvas signals
- Drawing operations
- Canvas read operations
- Image extraction
- Data URL generation
- Blob generation
WebGL & GPU Information
WebGL provides websites with access to browser graphics capabilities and information about the underlying rendering environment. Some of the information exposed through WebGL can be relevant to browser fingerprinting and hardware identification.
NetScope can observe WebGL context access, parameters, extensions, and unmasked vendor and renderer information where those values are exposed by the browser.
What can be observed?
- WebGL context access
- Graphics parameters
- Supported extensions
- GPU vendor information
- GPU renderer information
From access to transmission
NetScope can distinguish between capability detection, information collection, and evidence of transmission. When transmission is not observed, the tool does not automatically assume that the information was sent to a remote server.
WebGPU Fingerprint Surface
WebGPU provides a more modern interface for accessing GPU capabilities from web applications. As browser support evolves, GPU-related information exposed through WebGPU can become another observable part of a browser environment.
NetScope can inspect WebGPU adapter information, including fields such as vendor, architecture, device, and description when these values are available.
User-Agent Client Hints & HTTP Client Hints
Traditional User-Agent strings provide only part of the information available to modern web applications. Chromium-based browsers can expose additional information through User-Agent Client Hints (UA-CH).
Client Hints can contain both lower-entropy and higher-entropy values. Depending on the browser and request context, these values may provide additional information about the browser environment.
NetScope can observe User-Agent Client Hints in Chromium environments
and investigate relevant Sec-CH-* HTTP request and
response patterns.
Navigator Plugins & MIME Types
Browser applications can query interfaces such as
navigator.plugins and navigator.mimeTypes.
Historically, plugin and MIME-type information has been used as
one of many browser characteristics that can contribute to
fingerprinting.
NetScope can identify relevant access and harvesting patterns involving navigator plugins, MIME types, and related browser interfaces.
SpeechSynthesis & Voice Information
Browser speech capabilities can expose information about the environment through the list of available voices.
NetScope monitors access to
speechSynthesis.getVoices(), allowing researchers
to identify when a website queries the browser's available
speech synthesis voices as part of its application behavior.
MediaDevices & Hardware Probing
The MediaDevices API allows web applications to enumerate available media input and output devices. Access to this information can be relevant to application functionality, compatibility testing, and browser fingerprint research.
NetScope can observe enumerateDevices() and related
media-device probing activity, giving researchers additional
context when investigating how a website interacts with the
browser environment.
Additional Browser Fingerprint Probes
Browser fingerprinting is not limited to graphics or HTTP metadata. Websites can access information through many different browser capabilities, and the relevant surfaces can change as browser APIs evolve.
Depending on the available detectors, NetScope can also investigate activity involving additional browser surfaces.
Audio-related browser activity and fingerprint probes.
Browser communication and WebRTC-related probing.
Browser font availability and related detection.
Screen, hardware, and environment-related signals.
Browser permission-related observations.
Geolocation-related browser probing.
Browser storage capability and estimate-related probes.
Additional cataloged browser surfaces where enabled.
A Multi-Surface View of Browser Fingerprinting
Looking at one fingerprint surface in isolation can produce an incomplete picture. A browser may expose modified information through one API while continuing to provide native information through another.
For example, a browser could present modified WebGL information while another browser API continues to expose characteristics associated with the underlying hardware or operating environment.
This is why NetScope treats fingerprint analysis as a multi-surface investigation rather than a single-value fingerprint test.
What researchers can compare
| Surface | Example observation | Research question |
|---|---|---|
| Canvas | Drawing and read operations | Is Canvas being accessed and in what context? |
| WebGL | GPU vendor and renderer | What graphics information does the browser expose? |
| WebGPU | Adapter information | Which GPU-related capabilities are observable? |
| Client Hints | UA-CH and Sec-CH-* values | What browser metadata is communicated through HTTP? |
| MediaDevices | Device enumeration | Is the application probing available media devices? |
| Fonts & Hardware | Environment characteristics | Are additional browser properties being queried? |
Observation, Evidence, and Confidence
One of the most important distinctions in browser fingerprint research is the difference between an API being accessed and information actually being collected or transmitted.
NetScope is designed around this distinction. A browser API call can be observed without automatically concluding that the website has successfully fingerprinted the user.
Where network evidence is available, it can be correlated with browser-side activity. When transmission is not observed, NetScope does not present transmission as an established fact.
A useful distinction
An API or browser capability was accessed.
Information was obtained from the browser surface.
Evidence indicates information was sent through a network request.
Transparent Fingerprint Status
Not every browser property is equally controllable. NetScope shows the implementation status of fingerprint-related surfaces so researchers can understand which properties are actively handled and which may still come from the browser's native implementation.
| Status | Meaning |
|---|---|
| Implemented | The surface is actively handled or controlled. |
| Partially supported | Only some aspects of the surface are controlled. |
| Native fallback | The browser's native implementation remains available. |
| Unsupported | The surface is not currently controlled. |
Why Fingerprint Consistency Matters
A browser fingerprint is not a single value. Websites can observe different properties through multiple APIs, request headers, and communication layers. Changing one property does not automatically make the entire browser environment consistent.
NetScope helps researchers compare these surfaces and determine whether different browser signals tell a coherent story.
| Surface | Example inconsistency | What to investigate |
|---|---|---|
| WebGL | Modified renderer information | Whether other hardware-related APIs expose native values |
| UA-CH | Client Hints differ from browser identification | Consistency between JavaScript and HTTP metadata |
| Canvas | Canvas behavior differs from other fingerprint signals | Whether the observed surfaces form a consistent profile |
| MediaDevices | Device information remains available | What hardware-related information the page can observe |
Measure, Don't Assume
NetScope does not treat a single API call as proof of fingerprinting. It separates observed browser behavior from collection and transmission evidence, helping researchers determine what actually happened rather than assuming intent from an isolated signal.
Using NetScope for Fingerprint Research
- Observe the browser surface. Identify which fingerprint-related APIs or capabilities are accessed.
- Inspect the evidence. Review the triggering script, captured activity, and available context.
- Check network correlation. Determine whether related information is actually transmitted.
- Compare multiple surfaces. Look for inconsistencies between APIs, browser properties, and HTTP metadata.
- Evaluate confidence. Distinguish confirmed observations from signals where evidence is incomplete.
Practical Use Cases
NetScope is designed for situations where browser behavior needs to be inspected rather than guessed. Its network, security, and fingerprint analysis capabilities can be useful across several technical workflows.
Browser Security Research
Investigate browser APIs, local-network interactions, security signals, and other surfaces that may be exposed to websites.
Privacy Research
Examine which browser properties are observable and whether related information appears in network traffic.
Anti-Fingerprinting Research
Compare fingerprint surfaces and investigate whether different browser properties remain consistent with each other.
Web Application Testing
Inspect HTTP requests, headers, cookies, scripts, and browser signals while testing how a web application behaves.
QA & Browser Compatibility
Observe browser-level behavior and request metadata when testing websites across different configurations.
Digital Forensics
Use activity timelines, triggering scripts, and available evidence to reconstruct relevant browser events.
What NetScope Is Not
NetScope is a browser research and visibility tool, not a complete security or anonymity solution.
| NetScope is not | What this means |
|---|---|
| Antivirus | It does not provide traditional malware detection or removal. |
| EDR | It is not an endpoint detection and response platform. |
| SIEM | It is not designed to replace centralized security monitoring. |
| Anonymity solution | It does not guarantee anonymity or eliminate browser fingerprinting. |
Visibility Instead of Assumptions
The purpose of NetScope is not to promise that a browser is invisible. Instead, it gives technical users a way to investigate what happens inside the browser and what information may become observable by a website.
By combining network inspection, security signals, fingerprint-surface analysis, and evidence-based reporting, NetScope helps turn otherwise difficult-to-see browser behavior into something that can be examined and understood.
Measure, don't assume.
Inspect the evidence. Compare the surfaces. Understand what your browser actually exposes.
Available for Firefox & Google Chrome
NetScope is available as a:
for technical users who need deeper visibility into browser network activity, security signals, local-network interactions, and fingerprint surfaces.Instead of reducing browser privacy to a simple score, NetScope provides detailed observations and supporting evidence that can be investigated directly during a browsing session.
Built for Technical Users
Whether you are researching browser fingerprinting, debugging HTTP traffic, testing a web application, or investigating local-network exposure, NetScope gives you a closer look at what is happening inside the browser.
Frequently Asked Questions
Conclusion
Modern websites can observe far more than a traditional User-Agent string. Network requests, HTTP headers, browser APIs, hardware capabilities, Client Hints, local-network interactions, and other signals can all contribute to the information available to a web application.
Understanding this environment requires more than checking a single fingerprint value. It requires looking at individual surfaces, comparing their behavior, and determining whether there is supporting evidence that information was collected or transmitted.
NetScope is built around this approach. It combines HTTP inspection, security signals, local-network monitoring, fingerprint-surface analysis, activity timelines, triggering-script information, and investigation reports in one Firefox extension.
Measure, don't assume.
Use evidence to understand what your browser exposes, how different surfaces interact, and what actually happens during a browsing session.