#908·ecapture

ecapture获取的IP信息都是 0.0.0.0

Author: 5cratCreated Dec 30, 2025Updated Apr 29, 2026
Labels🐞 bug
**Describe the bug** 你好,在ecapture测试发现无法获取 IP信息,打印的Src 和 Dest 都是 0.0.0.0 下面是运行日志信息 `2025-12-30T14:02:45+08:00 INF AppName="eCapture(旁观者)" 2025-12-30T14:02:45+08:00 INF HomePage=https://ecapture.cc 2025-12-30T14:02:45+08:00 INF Repository=https://github.com/gojue/ecapture 2025-12-30T14:02:45+08:00 INF Author="CFC4N " 2025-12-30T14:02:45+08:00 INF Description="Capturing SSL/TLS plaintext without a CA certificate using eBPF. Supported on Linux/Android kernels for amd64/arm64." 2025-12-30T14:02:45+08:00 INF Version=linux_amd64:v1.5.2-20251227-ca085d0:5.15.0-164-generic 2025-12-30T14:02:45+08:00 INF Listen=localhost:28256 2025-12-30T14:02:45+08:00 INF Listen for eCaptureQ= 2025-12-30T14:02:45+08:00 INF eCapture running logs logger= 2025-12-30T14:02:45+08:00 INF the file handler that receives the captured event eventCollector= 2025-12-30T14:02:45+08:00 INF listen=localhost:28256 2025-12-30T14:02:45+08:00 INF https server starting...You can upgrade the configuration file via the HTTP interface. 2025-12-30T14:02:45+08:00 WRN Kernel version is less than 5.2, Process filtering parameters do not take effect such as pid/uid. kernel=4.19.90 2025-12-30T14:02:45+08:00 INF Kernel Info=4.19.90 Pid=9151 2025-12-30T14:02:45+08:00 INF TruncateSize=0 Unit=bytes 2025-12-30T14:02:45+08:00 WRN Your environment is like a container. We won't be able to detect the BTF configuration. If eCapture fails to run, try specifying the BTF mode. use '-b 2' to specify non-CORE mode. 2025-12-30T14:02:45+08:00 INF BTF bytecode mode: CORE. btfMode=0 2025-12-30T14:02:45+08:00 INF master key keylogger has been set. eBPFProgramType=Text keylogger= 2025-12-30T14:02:45+08:00 INF module initialization. isReload=false moduleName=EBPFProbeOPENSSL 2025-12-30T14:02:45+08:00 INF Module.Run() 2025-12-30T14:02:45+08:00 INF origin versionKey="openssl 1.1.1f" versionKeyLower="openssl 1.1.1f" 2025-12-30T14:02:45+08:00 INF OpenSSL/BoringSSL version found Android=false library version="openssl 1.1.1f" 2025-12-30T14:02:45+08:00 INF Hook masterKey function ElfType=2 Functions=["SSL_get_wbio","SSL_in_before","SSL_do_handshake"] binrayPath=/usr/lib64/libssl.so.1.1 2025-12-30T14:02:45+08:00 WRN Your kernel version is less than 5.2, GlobalVar is disabled, the following parameters will be ignored:[target_pid, target_uid, target_port] 2025-12-30T14:02:45+08:00 INF setupManagers eBPFProgramType=Text 2025-12-30T14:02:45+08:00 INF BPF bytecode file is matched. bpfFileName=user/bytecode/openssl_1_1_1d_kern_core.o 2025-12-30T14:02:46+08:00 INF perfEventReader created mapSize(MB)=4 2025-12-30T14:02:46+08:00 INF perfEventReader created mapSize(MB)=4 2025-12-30T14:02:46+08:00 INF module started successfully. isReload=false moduleName=EBPFProbeOPENSSL 2025-12-30T14:02:58+08:00 ??? PID:7608, Comm:httpd, Src:0.0.0.0:0, Dest:0.0.0.0:0, GET /aaaa HTTP/1.1 Host: 192.168.230.140 Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7 Accept-Encoding: gzip, deflate, br, zstd Accept-Language: zh-CN,zh;q=0.9,en;q=0.8,en-GB;q=0.7,en-US;q=0.6,pl;q=0.5 Connection: keep-alive Sec-Ch-Ua: "Microsoft Edge";v="143", "Chromium";v="143", "Not A(Brand";v="24" Sec-Ch-Ua-Mobile: ?0 Sec-Ch-Ua-Platform: "Windows" Sec-Fetch-Dest: document Sec-Fetch-Mode: navigate Sec-Fetch-Site: none Sec-Fetch-User: ?1 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/143.0.0.0 Safari/537.36 Edg/143.0.0.0 2025-12-30T14:02:58+08:00 ??? PID:7608, Comm:httpd, Src:0.0.0.0:0, Dest:0.0.0.0:0, HTTP/1.1 404 Not Found Content-Length: 196 Connection: Keep-Alive Content-Type: text/html; charset=iso-8859-1 Date: Tue, 30 Dec 2025 06:02:57 GMT Keep-Alive: timeout=5, max=100 Server: Apache 404 Not Found

Not Found

The requested URL was not found on this server.

` 此次测试是在vmware虚拟机中,虚拟机允许linux系统,通过yum安装httpd程序,修改配置文件启用https,然后直接通过宿主机访问该虚拟机的https服务,发现日志中的ip信息都是0.0.0.0 , - Device: `Kylin-V10-Sp3` - Kernel Info: `4.19.90-89.11.v2401.ky10.x86_64` - eCapture Version: `linux_amd64:v1.5.2-20251227-ca085d0:5.15.0-164-generic`