eCapture Files

Capturing SSL/TLS plaintext without a CA certificate using eBPF

This is an exact mirror of the eCapture project, hosted at https://github.com/gojue/ecapture. SourceForge is not affiliated with eCapture.

The interactive file manager requires Javascript. Please enable it or use sftp or scp.
You may still browse the files here.

Name	Modified	Size	InfoDownloads / Week
Parent folder
checksum-loong64-v2.9.0.txt	2026-10-24	203 Bytes	0
ecapture-v2.9.0-linux-loong64.tar.gz	2026-10-24	21.8 MB	0
ecapture_v2.9.0_linux_loong64.deb	2026-10-24	15.1 MB	0
ecapture_v2.9.0_linux_arm64.deb	2026-10-24	14.7 MB	0
ecapture_v2.9.0_linux_amd64.deb	2026-10-24	14.9 MB	0
checksum-v2.9.0.txt	2026-10-24	604 Bytes	0
ecapture-v2.9.0-android-amd64.tar.gz	2026-10-24	18.5 MB	0
ecapture-v2.9.0-android-arm64.tar.gz	2026-10-24	18.2 MB	0
ecapture-v2.9.0-linux-amd64.tar.gz	2026-10-24	21.5 MB	0
ecapture-v2.9.0-linux-arm64.tar.gz	2026-10-24	21.4 MB	0
eCapture v2.9.0 source code.tar.gz	2026-10-24	6.8 MB	0
eCapture v2.9.0 source code.zip	2026-10-24	7.1 MB	4
README.md	2026-10-24	860 Bytes	0
Totals: 13 Items		160.1 MB	4

🚀 Breaking Changes

Add pcapng as a new data source for text mode across the openssl (aka tls), gotls, and gnutls modules. Set with --text-source pcapng, it streams captured packets and DSB blocks through the decrypt SDK and reconstructs complete HTTP/1.1 and HTTP/2 requests and responses with network metadata.
hook remains the default text source; a raw pcapng copy is saved only when --pcapfile is specified.
Packet timestamps are converted from TC monotonic time to Unix time before pcapng serialization.

What's Changed

tls: stream pcapng DSB into HTTP text output by @cfc4n in https://github.com/gojue/ecapture/pull/1063
cli: hint text mode to use --text-source pcapng by @cfc4n in https://github.com/gojue/ecapture/pull/1066

Full Changelog: https://github.com/gojue/ecapture/compare/v2.8.2...v2.9.0

Source: README.md, updated 2026-10-24

Other Useful Business Software

MongoDB Atlas runs apps anywhere Icon

MongoDB Atlas runs apps anywhere

Deploy in 115+ regions with the modern database for every enterprise.

MongoDB Atlas gives you the freedom to build and run modern applications anywhere—across AWS, Azure, and Google Cloud. With global availability in over 115 regions, Atlas lets you deploy close to your users, meet compliance needs, and scale with confidence across any geography.

Start Free

PRTG Catches Network Issues Before They Cause Downtime Icon

PRTG Catches Network Issues Before They Cause Downtime

Threshold-based alerts flag problems early, so your team can act before users notice, not after.

Reactive troubleshooting usually means hearing about a problem from frustrated users, not your monitoring tool. PRTG sets threshold-based alerts across devices, servers and applications, notifying your team by email, SMS or push the moment a metric crosses a set limit. That means catching a failing disk or overloaded server before it becomes an outage and getting time back from firefighting. Start a free trial and set your first alerts today.

Download 30-Day Trial

Recommended Projects

UDP Warp+ Free Server tls SNI VPS
Value Added Warp over SNI via SNI injection SSL/TLS Tunnel
UDP OpenVPN Server tls SNI VPS
Value Added OpenVPN over SNI via SNI injection SSL/TLS Tunnel
ftp4che
Feature rich FTP Library using Java 1.4 / 5.0 (2 different builds) methods and java.nio. Code is now located at GitHub (https://github.com/arnold-maderthaner/ftp4che). For issues and patches please open this on GitHub too.
PsiMux SNI injector + Psiphon Servers
Value Added VPN 4G ssl/tls sni Psiphon CN/RU/JP/UK..
SSL Kill Switch 2
Blackbox tool to disable SSL certificate validation