Skip to content

Capture all network traffic from all ports in pcapng mode #408

Closed
@Xeonacid

Description

@Xeonacid

Describe the feature
If I understand correctly, ecapture can only capture (and decrypt) network traffic for one port (default 443).
May it capture all network traffic (TCP and UDP) and decrypt TLS traffic from all ports in pcapng mode? Thanks!

The reason why I don't use tools like tcpdump is that tcpdump cannot only capture traffic for a specific PID, while ecapture can.

Expected behavior
sudo ./ecapture tls -i eth0 -w test.pcapng -p <pid>
Capture all network traffic for <pid> on eth0 (with TLS decrypted) regardless of port.

Metadata

Metadata

Assignees

Labels

enhancementNew feature or request

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions