When TCP Spy's Start button is pressed, it will capture and display all socket calls of the next application that starts and makes a socket call. It will also capture and display the data that is sent and received on the application's sockets. The application can be of any type.

TCP Spy displays its output in a scrollable text box. This data may additionally be sent to a file as text or HTML. By default, only 32KB of data is kept in the scrollable text box. Higher data limits may be selected, including unlimited.

Based upon each socket's first transferred message, TCP Spy will determine if the protocol being communicated over the socket is text based. If so, TCP Spy will test each following message for text. If a message contains only text, TCP Spy will display it as such. Else, TCP Spy will show the message in hexadecimal and ASCII. If the protocol is HTTP, the HTTP headers will be displayed as text.