gopacket VS ecapture

I have seen pcap but not packetz, thanks. Pcap looks unfinished and packetz has not been updated in a long time, but they might be able to make a working capture program. However the popularity and features available in Go regarding packet capture makes it very hard to beat. E.g. the Google gopacket library has 5.6k stars on github and as pretty much every feature you'd want for this sort of stuff built in.

eCapture implements the feature of saving a pcapng file by eBPF TC, and supports TLS Master Secret Key capturing by eBPF Uprobe. Also, gopacket's DSB feature is supported, based on Decryption Secrets Block (DSB)

Well, there is https://github.com/google/gopacket/, you have a package that uses CGo, `pcap`, and then there is `pcapgo`, native Go implementation. Doesn't have all the features but in my case, I was able to use it and remove CGo.

I will capturing TCP packets by gopacket/pcap.

For example, gopacket uses libpcap by default for capturing the traffic. Libpcap doesn't support network namespaces and we can't ask it to listen to traffic on a different namespace. However, we can change the network namespace of the calling thread and then start libpcap to see the traffic on a different namespace.

https://pkg.go.dev/github.com/google/gopacket/routing - Linux only and not working correctly and not actively maintained

The answer is YES. eCapture for Android can help you capture HTTPS packets on Android without the trivial settings. and also support Linux Kernel.

eCapture : Capture SSL/TLS text content without CA certificate Using eBPF

One option is to use ebpf uprobes to dump the key material or plaintext (https://github.com/ehids/ecapture ). Should be easy for c-like TLS libraries probably less useful for JIT languages.

Other standalone project it https://github.com/ehids/ecapture which might be helpful