Chromium Net-Export: Diagnosing Packet and Socket Issues

This article provides an overview of the net-export tool in the Chromium web browser and explains how it is used to diagnose complex network problems. It covers the core functionality of the tool, how it tracks low-level socket management and packet-level protocol events, and the standard workflow for capturing and analyzing these diagnostic logs to resolve connectivity issues.

What is the Net-Export Tool?

The net-export tool, accessed by navigating to chrome://net-export, is a built-in diagnostic utility in Chromium-based browsers. Its primary function is to record the browser's internal network activity and export it as a JSON file, known as a NetLog.

While the standard Chrome Developer Tools Network panel only displays high-level HTTP request and response data, net-export captures the deep, underlying mechanics of Chromium's network stack. This makes it the definitive tool for troubleshooting invisible network failures that occur before or during an HTTP request.

Diagnosing Socket Issues

Sockets are the software endpoints that establish bidirectional communication between the browser and a server. Chromium uses complex logic to manage, pool, and reuse sockets. The net-export tool provides visibility into this entire lifecycle to diagnose the following issues:

  • Socket Pool Exhaustion: Chromium limits the number of concurrent open sockets allowed per host and across the entire browser. The NetLog reveals if network requests are stalling simply because they are queued, waiting for an active socket to become free.
  • TCP Handshake Failures: The tool logs the exact timestamps of socket creation and TCP connection attempts. If a server fails to respond to a connection request, the log will show the socket timing out at the transport layer.
  • TLS/SSL Negotiation Stalls: Secure sockets require a cryptographic handshake. net-export tracks the state machine of the TLS handshake, identifying whether a connection failed due to certificate errors, cipher mismatches, or a stalled negotiation.
  • Premature Socket Closure: Servers or intermediate firewalls often drop idle connections. The tool tracks "keep-alive" sockets and logs exact error codes (such as ERR_CONNECTION_RESET or ERR_SOCKET_NOT_CONNECTED) when the browser attempts to reuse a socket that the remote server has silently closed.
  • IPv4 and IPv6 Fallback (Happy Eyeballs): Chromium often attempts to open IPv6 and IPv4 sockets simultaneously to minimize delays. The tool shows if a malfunctioning IPv6 routing configuration is causing socket creation delays before falling back to IPv4.

Diagnosing Packet and Frame Issues

While net-export is not a network interface packet sniffer like Wireshark, it operates at the boundary between the application layer and the transport layer. It diagnoses packet-related issues in the following ways:

  • QUIC and HTTP/3 Packet Tracking: Because the QUIC protocol runs over UDP, the Chromium browser manages packetization, congestion control, and retransmission directly within the application rather than relying on the operating system's TCP stack. net-export logs individual QUIC packets, packet numbers, missing packet acknowledgments (ACKs), and packet loss recovery events.
  • HTTP/2 Framing: Instead of plain text, HTTP/2 breaks data into binary frames multiplexed over a single socket. The tool logs the transmission and receipt of these specific frames (such as HEADERS, DATA, and RST_STREAM), allowing developers to see if a stream was unexpectedly terminated or throttled by flow control limits.
  • Raw Byte Inspection: By default, net-export strips sensitive payload data. However, users can enable the "Include raw bytes" option. This captures the exact, unencrypted byte streams sent to and received from the network sockets, allowing you to verify if application packets are malformed or corrupted prior to encryption.
  • DNS Packet Resolution: Before any data packets can be routed, DNS resolution must occur. The tool logs the browser's built-in DNS client activity, including Secure DNS (DoH) queries, showing whether packet transmission is failing due to slow, dropped, or malformed DNS responses.

How to Use Net-Export

Because net-export only generates the raw data file, it must be paired with an external viewer to diagnose the issues effectively.

  1. Open a new tab in a Chromium browser and go to chrome://net-export.
  2. Select the desired data capture level: Strip private information (default), Include cookies and credentials, or Include raw bytes (required for payload inspection).
  3. Click Start Logging to Disk and choose a location to save the JSON file.
  4. Open a new tab and reproduce the socket or packet issue.
  5. Return to the net-export tab and click Stop Logging.
  6. Open the NetLog Viewer utility (an open-source tool provided by the Chromium project) and import the saved JSON file.
  7. Use the Events tab to inspect chronological socket states and packet frames, or the Sockets tab to view the real-time status of the browser's socket pools during the capture.