Use XBOX Multiplayer Analysis Tool to inspect and modify network traffic

• Proxy HTTP and HTTPS traffic.
• Decrypt and display request and response data.
• Filter captured traffic by host, status code, and method.
• Run C# scripts that modify or terminate requests and responses.
• Capture and analyze low-level network traffic from an XBOX development console.
• Analyze live or saved captures for problematic XBOX service calling patterns.

​

Requirements

• A development PC running Windows 10, version 1809 (build 17763) or later, or Windows 11.
• Administrator permissions on the development PC.
• The .NET 10 Desktop Runtime and ASP.NET Core Runtime for Windows x64, or the .NET 10 SDK for Windows x64.
• For console capture, an XBOX development console running recovery 2106 or later.
• GDK Extensions for XBOX for XMAT features that connect to an XBOX development console.

​

Install XMAT

1. Download the current ZIP file from XMAT releases.
2. Extract the ZIP file to a local folder.
3. Run XMAT as an administrator.
4. When prompted, install and trust the XMAT root certificate. XMAT uses this certificate to decrypt HTTPS traffic.

​

Capture web traffic

1. In XMAT, select the + tab.
2. Select the device that runs the title:
   • For the default XBOX development console, select Default XBOX Console.
   • For another XBOX development console, select XBOX Console at IP or Hostname.
   • For a title on the development PC, select Local PC.
3. Select Web Proxy, and then select Add Capture.
4. Start the proxy:
   • For an XBOX development console, select Enable XBOX Proxy. The console restarts and begins sending web traffic through XMAT.
   • For a Windows PC, select Start Capture.
5. Launch the title and exercise the scenarios that you want to inspect.
6. Select a connection to inspect its request and response headers and body.

[!IMPORTANT] If an XBOX development console remains configured to use the XMAT proxy when XMAT isn’t capturing, XBOX service checks and other network requests can fail. Select Disable XBOX Proxy when testing is complete. The console restarts to apply the change.

​

Identify partner service hosts

1. Start an XMAT web proxy capture.
2. Launch the title and exercise every feature that uses an online service, including:
   • Menus and leaderboards.
   • Multiplayer session creation and joining.
   • Friends and social features.
   • In-title stores.
   • Limited-time events.
3. Use the Host filter to review every host contacted by the title.
4. Compare the captured hosts with the title’s service inventory and identify the partner-hosted services to test.

​

Block a partner service

1. Open the Script Editor in the active web proxy capture.
2. Select the SSL Connection Request event.
3. Replace the sample host with each partner service host that you want to block. For example:
   string host = Params.Request.Host.ToLowerInvariant();
   
   if (host == "api.publisher.example" ||
       host.EndsWith(".api.publisher.example"))
   {
       Params.Continue = false;
   }
   
4. Select Enable. Verify that the script compiles successfully.
5. Exercise the affected title feature and verify that requests to the selected hosts fail while Microsoft, XBOX, and PlayFab services remain available.

[!CAUTION] XMAT scripts affect live traffic from the selected device. Limit a blocking script to the specific partner hosts required for the test, and disable the script when the test is complete.

​

Stop capturing

1. Disable any active scripts.
2. Select Stop Capture.
3. If an XBOX development console is using the proxy, select Disable XBOX Proxy and wait for the console to restart.