I wrote a message inspector to look at the messages being sent but the messages I get look different than the messages being captured by network tracing tools. Why is that?

There are four different times that a message inspector might be invoked. For an IClientMessageInspector there is BeforeSendRequest and AfterReceiveReply; for an IDispatchMessageInpsector there is AfterReceiveRequest and BeforeSendReply. However, all four of these message notification events share the common property that the message notification is part of the application behavior rather than message transport. Moreover, even among the different application-level message notifications, your message inspector might not be the last to process the message. For example, there's no coordination requirement that you can use to guarantee the order of execution among multiple message inspectors.

This distinction between application behavior and message transport becomes clearer when you look at the overall order of operations in the system. Let's look at the client-side sending of requests because it's the simplest. The other three message inspector scenarios are symmetrical in the way you'd expect.

1. You call a method on some proxy object that represents a service located somewhere else
2. The proxy object translates the method invocation and parameters into a message to be sent
3. Application-level interception of the service call occurs, such as message inspectors
4. Protocol channels are engaged to help convey the message
5. A message encoder formats the message for transmission
6. A transport channel transmits the message through an underlying communication medium
7. Lower-level operating system and networking components transmit the message

As you can see, quite a lot may have happened to the message after the message inspector last had view of it.