A network trace utility is provided. The network trace utility receives and copies packets in a secure session of (at least) two-way network communication between a client and a server. The network trace utility receives an administrator password, and uses a hash of the administrator password to decrypt the first session key. The network trace utility then decrypts one or more additional session keys, each one using the preceding session key. Then, the network trace utility decrypts the machine key using one of the session keys. A hash of the machine key is used to decrypt additional packets in the secure session. The network trace utility enables the contents of one or more additional packets in the secure session to be displayed to the user.