# gojue/ecapture

Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64.

Repository: https://github.com/gojue/ecapture
Canonical: https://ross.abutalabs.com/products/ecapture
Homepage: https://ecapture.cc
Language: C
License: Apache-2.0
License Family: permissive
Topics: golang, ebpf, tcpdump, ssldump, https, tls, security-audit, network-capture, android-https-capture, ssl, ebpf-go, ebpf-tc, ebpf-uprobe, android, linux
Last push: 2026-08-18T13:29:28+00:00

## Health v2 (maintenance only)
Score: 96/100 (v2, computed 2026-09-02T17:46:02.011165+00:00)
- activity 98, release rhythm 92, longevity 100
- inputs: {"age_days": 1634, "days_push": 15, "days_rel": 52, "gap_med": 14, "n_releases_24m": 40}
- flags: none
- formula: round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)

## Adoption (not part of the score)
Stars 15441, forks 1639 (observed 2026-08-28T04:11:09.824583+00:00)

## What it is
eCapture is an eBPF-based CLI tool that captures SSL/TLS plaintext traffic without needing CA certificates, supporting OpenSSL, LibreSSL, BoringSSL, GnuTLS, NSS, and Go TLS libraries. It also provides bash/zsh command auditing and MySQL query auditing on Linux and Android (x86_64/aarch64).

## Use cases
- capture https traffic plaintext without installing a CA certificate
- debug tls encrypted traffic from curl or wget on linux
- inspect ssl traffic on a rooted android device
- audit bash and zsh commands executed on a host
- capture mysql queries from a running mysqld process
- capture plaintext from golang programs using crypto/tls
- troubleshoot tls 1.3 and quic connections at the kernel level

## When to choose
- you need to see decrypted TLS traffic without CA cert installation or proxy configuration
- you are doing security auditing or incident response on Linux/Android hosts
- you need kernel-level capture of traffic from processes using various TLS libraries
- you want to audit shell commands or database queries on a server

## When to avoid
- you are on Windows or macOS - it is unsupported
- you lack root privileges or the required Linux capabilities
- your kernel is older than 4.18 (x86_64) or 5.5 (aarch64) or lacks BTF/headers
- you need a passive network tap that does not require privileged host access

## Facets
- artifact type: cli-tool
- maturity: active
- function: security, networking, developer-tools, monitoring
- domain: security, networking, developer-tools, android-tools
- platform: cli
- tags: ebpf, tls-decryption, packet-capture, ssl-inspection, rootkit-detection, security-audit, uprobe, kprobes, command-line, linux, android

## Member repositories
- gojue/ecapture (main) score 96

## Provenance
- Observed fields: from GitHub, fetched 2026-08-28T04:11:09.824583+00:00.
- Health v2: computed from the inputs above; adoption is never an input.
- Inferred fields (summary, facets, guidance): AI-extracted, prompt v1, taxonomy v1, on 2026-08-29T17:05:51.567061+00:00, confidence not recorded.
  - readme: https://github.com/gojue/ecapture (fetched 2026-08-28T04:11:09.824583+00:00, sha 4f996f04187a)
  - homepage: https://ecapture.cc (fetched 2026-08-29T08:04:02.372093+00:00, sha 4d68034770e1)
  - site_page: https://ecapture.cc/en/2-getting-started/index.html (fetched 2026-08-29T08:04:02.374604+00:00, sha 0a3b40732462)
  - site_page: https://ecapture.cc/en/9-faq-and-troubleshooting/index.html (fetched 2026-08-29T08:04:02.377050+00:00, sha acdc84ea9c4c)
- Data as of 2026-08-30T08:39:29.467469+00:00.