#1003·ecapture

[Bug] KeyFile和Pcap模式下无法正确获取Client Secret解密TLS数据

Author: ConstasJCreated May 15, 2026Updated Jun 4, 2026

Describe the bug ecapture使用TLS探针时,text模式下可以正常解密数据,但pcap模式和keyfile模式下无法获取正确的client secret,因而WireShark无法正确解密TLS包。

To Reproduce

  1. 使用ecapture tls -m pcap抓取,或者使用ecapture tls -m keyfile抓取keyfile
  2. 尝试把抓取的keyfile和tcpdump得到的数据包一起导入WireShark尝试分析
  3. 导入Master Key File后依然全部为TLS v1.2/v1.3,没有解密后的http(s)数据包

Screenshots Image

Linux Server/Android (please complete the following information):

  • Device: Linux Server
  • Kernel Info: 6.8.0-111-generic 111-Ubuntu SMP PREEMPT_DYNAMIC Sat Apr 11 23:16:02 UTC 2026 x86_64 x86_64 x86_64 GNU/Linux
  • eCapture Version: 2.4.0