eBPF · Kernel-Level · Real-Time

See TLS
in plaintext.

Capture TLS plaintext at library boundaries.
No custom CA. No application changes.

OPEN SOURCE / LINUX + ANDROID

PLAINTEXT PREVIEWDEMO

$ sudo ecapture tls

GET / HTTP/1.1
Host: example.com

HTTP/1.1 200 OK

No custom CA

Observe without changing apps

Kernel-level capture

Real-time visibility

Plaintext at TLS library boundaries

01 / CAPABILITIES

Three probes. One clear view.

Explore the probes ↗

TLS

OpenSSL · LibreSSL · BoringSSL

Capture plaintext from OpenSSL, LibreSSL and BoringSSL at library boundaries. Point the probe at a shared library or a statically linked binary.

GoTLS

Go TLS · executable path

Inspect TLS traffic from Go programs. Use --elfpath to select the target executable so eCapture can resolve its Go TLS symbols.

GnuTLS

GnuTLS · text · keylog · pcapng

Capture GnuTLS plaintext and session keys with version-aware probes. The current module supports text, keylog and pcapng capture modes.

All three modules support text, keylog and pcapng modes. --eventaddr routes captured events to stdout, files, TCP or WebSocket; operational logs use --logaddr.

QUICKSTART

Start with a capture.

Read the getting started guide →

$ sudo ecapture tls

$ curl https://example.com

In another terminal

Use a published build for your system, or build from source. Run eCapture with root privileges or the required Linux capabilities, then make a TLS request in another terminal.

Choose the right build and kernelLinux · Android

System	Architecture	Minimum kernel
Linux	x86_64 / amd64	4.18+
Linux	AArch64 / arm64	5.5+
Linux	LoongArch64 / loong64	6.6+
Android	x86_64 / amd64	4.18+
Android	AArch64 / arm64	5.5+

Android/loong64, Windows and macOS are not supported. Check published assets for a LoongArch64 package; its build path has cross-build and user-mode smoke checks, so verify eBPF capture on target hardware.

Minimum privileges ↗LoongArch64 build guide ↗

UPSTREAM v2.8 · OCTOBER 2026LoongArch64 joins the Linux builds

Read the upstream changelog ↗

02 / IN ACTION