Note

Support Wireshark to open directly. Do not need to setting up Master Secrets files.

Capture raw packet by Traffic Control eBPF filter. Added Master Secrets information into pcapng with Decryption Secrets Block (DSB).

Warning

change loggerFile flag as -l from -w , because -w is reserved for Wireshark, and keep same as -w for tcpdump. use ecapture -h for help. change master secrets filename from ecapture_masterkey_[pid].log to ecapture_masterkey.log.

What's Changed

• new feature: capture TLS 1.3 master secret by @cfc4n in https://github.com/ehids/ecapture/pull/143
• user : echo String() or StringHex() by CLI argument. by @cfc4n in https://github.com/ehids/ecapture/pull/149
• cli/cmd : clean up all probe while process exit. (#150) by @cfc4n in https://github.com/ehids/ecapture/pull/151
• save as Pcapng files #145 by @cfc4n in https://github.com/ehids/ecapture/pull/148
• user : Support writing pcapng files with Decryption Secrets Block (DSB). by @cfc4n in https://github.com/ehids/ecapture/pull/153

🚀 Features

• new feature: capture TLS 1.3 master secret
  • PR: #143
• save as Pcapng files #145
  • PR: #148
• user : Support writing pcapng files with Decryption Secrets Block (DSB).
  • PR: #153

🐛 Fixes

• user : echo String() or StringHex() by CLI argument.
  • PR: #149
• cli/cmd : clean up all probe while process exit. (#150)
  • PR: #151

Full Changelog: https://github.com/ehids/ecapture/compare/v0.3.0...v0.4.0