gojue/ecapture

Health v2 · maintenance only

Adoption not part of the score

15441 stars · 1639 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-29, confidence not recorded

eCapture is an eBPF-based CLI tool that captures SSL/TLS plaintext traffic without needing CA certificates, supporting OpenSSL, LibreSSL, BoringSSL, GnuTLS, NSS, and Go TLS libraries. It also provides bash/zsh command auditing and MySQL query auditing on Linux and Android (x86_64/aarch64).

Use cases

• capture https traffic plaintext without installing a CA certificate
• debug tls encrypted traffic from curl or wget on linux
• inspect ssl traffic on a rooted android device
• audit bash and zsh commands executed on a host
• capture mysql queries from a running mysqld process
• capture plaintext from golang programs using crypto/tls
• troubleshoot tls 1.3 and quic connections at the kernel level

When to choose

• you need to see decrypted TLS traffic without CA cert installation or proxy configuration
• you are doing security auditing or incident response on Linux/Android hosts
• you need kernel-level capture of traffic from processes using various TLS libraries
• you want to audit shell commands or database queries on a server

When to avoid

• you are on Windows or macOS - it is unsupported
• you lack root privileges or the required Linux capabilities
• your kernel is older than 4.18 (x86_64) or 5.5 (aarch64) or lacks BTF/headers
• you need a passive network tap that does not require privileged host access

Facets

cli-tool · maturity active

security networking developer-tools monitoring security networking developer-tools android-tools cli ebpf tls-decryption packet-capture ssl-inspection rootkit-detection security-audit uprobe kprobes command-line linux android

Member repositories

For agents

markdown · JSON · MCP: product_card(name="gojue/ecapture")