# ecapture

> Capture plaintext SSL/TLS traffic with eBPF without a CA proxy

eCapture is an eBPF-based traffic interception and security auditing tool for Linux and Android. It captures plaintext TLS and SSL traffic without requiring MITM proxies or custom CA certificates, and records command history and database queries. It runs via a command-line binary or as a privileged Docker container.

- Source: https://github.com/gojue/ecapture
- Homepage: https://ecapture.cc
- License: Apache-2.0
- Built with: C 86.3%, Go 10.3%, Shell 3.0%, Other 0.4%
- Stars: 15523
- Forks: 1650
- Contributors: 59
- Last commit: 2026-10-31
- Latest release: v2.9.1 (2026-10-31)
- Purpose: Developer tools, Security & identity
- Type: Docker / self-host, Mobile, CLI
- For: Personal, Enterprise

## Worth score: 78/100

How much DigGitHub recommends it, from activity, adoption, docs, license and security signals.

- Popularity: 21/25
- Momentum: 10/20
- Maintenance: 25/25
- Community: 11/15
- Readiness: 11/15

## Downloads

Latest release: [eCapture v2.9.1](https://github.com/gojue/ecapture/releases/tag/v2.9.1). Files from the project's GitHub release, not checked by DigGitHub.

Linux:

- [ecapture-v2.9.1-linux-arm64.tar.gz](https://github.com/gojue/ecapture/releases/download/v2.9.1/ecapture-v2.9.1-linux-arm64.tar.gz) (7.8 MB, 17 downloads)
- [ecapture-v2.9.1-linux-amd64.tar.gz](https://github.com/gojue/ecapture/releases/download/v2.9.1/ecapture-v2.9.1-linux-amd64.tar.gz) (8.7 MB, 28 downloads)
- [ecapture_v2.9.1_linux_amd64.deb](https://github.com/gojue/ecapture/releases/download/v2.9.1/ecapture_v2.9.1_linux_amd64.deb) (7.2 MB, 8 downloads)
- [ecapture_v2.9.1_linux_arm64.deb](https://github.com/gojue/ecapture/releases/download/v2.9.1/ecapture_v2.9.1_linux_arm64.deb) (6.4 MB, 6 downloads)
- [ecapture_v2.9.1_linux_loong64.deb](https://github.com/gojue/ecapture/releases/download/v2.9.1/ecapture_v2.9.1_linux_loong64.deb) (6.7 MB, 4 downloads)
- [ecapture-v2.9.1-linux-loong64.tar.gz](https://github.com/gojue/ecapture/releases/download/v2.9.1/ecapture-v2.9.1-linux-loong64.tar.gz) (8.3 MB, 4 downloads)

Android:

- [ecapture-v2.9.1-android-arm64.tar.gz](https://github.com/gojue/ecapture/releases/download/v2.9.1/ecapture-v2.9.1-android-arm64.tar.gz) (7.6 MB, 24 downloads)
- [ecapture-v2.9.1-android-amd64.tar.gz](https://github.com/gojue/ecapture/releases/download/v2.9.1/ecapture-v2.9.1-android-amd64.tar.gz) (8.5 MB, 10 downloads)

To check the files: [checksum-v2.9.1.txt](https://github.com/gojue/ecapture/releases/download/v2.9.1/checksum-v2.9.1.txt), [checksum-loong64-v2.9.1.txt](https://github.com/gojue/ecapture/releases/download/v2.9.1/checksum-loong64-v2.9.1.txt)

## Alternatives

- [mitmproxy](https://diggithub.com/mitmproxy/mitmproxy.md): Interactive TLS-capable intercepting proxy
- [acme.sh](https://diggithub.com/acmesh-official/acme.sh.md): Pure shell ACME client for TLS certificates
- [Cilium](https://diggithub.com/cilium/cilium.md): eBPF-based networking and security
- [AFLplusplus](https://diggithub.com/AFLplusplus/AFLplusplus.md): State-of-the-art coverage-guided fuzzer based on AFL
- [gosec](https://diggithub.com/securego/gosec.md): Security scanner and static analyzer for Go source code
- [automic-vault](https://diggithub.com/automic-vault/automic-vault.md): Command-line credential security and authorization gates for macOS

---

Source page: https://diggithub.com/gojue/ecapture
Updated: 2026-11-01