Inspecting Claude Code’s Network Traffic with Linux Namespaces and MITM Proxying (Part 5)

Classifying all of Claude’s network connections So far we’ve examined individual connections. We looked at a single WebFetch and a single decrypted API call. To build a complete picture of Claude’s network behavior, we need to exercise all of its network tools in a single session and categorize every connection it makes. This produces a full traffic matrix: which destinations Claude contacts, what each connection carries, and whether each request originates from your machine or routes through Anthropic. That matrix is the basis for the security analysis that follows. Setting up the full test Run a prompt that exercises multiple network tools: ./mitm-capture.sh "First, use WebFetch to fetch https://example.com and tell me the page title. Then use WebSearch to search for 'linux network namespaces tutorial' and summarize the top result." Analyzing by category WebFetch traffic: We can pull specific get requests by parsing the mitm.txt file generated by the mitm-capture.sh script grep -A 5…