TraceEagle Proxy Capture Tutorial: HTTPS Capture Methods for Local Machine and Mobile Phones

Proxy Packet Capture

This guide teaches you how to use proxy packet capture to route network requests from your local machine, mobile phone, or other devices on the LAN into TraceEagle for inspection. Once you select an access mode and install the certificate, you can see every request in real time, and HTTPS traffic can be decrypted into readable plaintext (JSON, form data, and more). This is the most universal capture method—configure it once, and you can capture traffic from browsers, command-line tools, apps, and mobile phones.

1. When to Use This Method

This method is suitable if you meet any of the following criteria:

• You want to capture HTTPS traffic from multiple programs on your local machine or from the entire machine, view plaintext, and decrypt it.
• You want to capture requests from mobile phones / tablets / other computers on the LAN (just point their proxy to this machine).
• You need to rewrite requests, intercept at breakpoints, replay, and compare while capturing—proxy capture works hand-in-hand with these capabilities.

If you only want to capture a single program that can be launched from the command line and do not want to install a certificate, use Designated Program Capture—it is simpler. If the program is already running, uses certificate pinning, or does not honor proxy settings, see Application-Layer Capture.

2. Prerequisites

• TraceEagle is installed and running. (On first launch, accept the system permission when prompted.)
• To capture HTTPS plaintext, you must first install a certificate: without a certificate, you can only see encrypted ciphertext. Follow Certificate Installation to install and trust the capture certificate. To capture phones/tablets, install the certificate on that device.
• Decide which access mode to use (two modes are listed in the next section; you can switch at any time if you cannot capture).

3. Choose an Access Mode: Two Local Access Options

How traffic enters the capture depends on your scenario. In the session toolbar, choose Proxy Local Machine → gear icon Access Settings to select one of two access modes:

• Traditional Proxy (uses system proxy, classic capture): One-click access. Browsers, command-line tools, and most applications automatically route through the proxy. When stopped, it restores automatically to ensure normal Internet access. This is the fastest way to get started, so use it first. Limitation: apps that do not respect the system proxy will not be captured.
• Transparent Proxy (full traffic): No application configuration required. It can capture all traffic on the local machine (including direct connections and traffic forwarded by this machine acting as a hotspot/gateway). Apps that ignore the system proxy are still captured. You can also precisely scope by application/process to capture only specific programs. Choose this mode if you want to capture non-proxy-aware programs or only specific apps.

If you are unsure, start with Traditional Proxy; if you encounter no traffic at all, switch to Transparent Proxy.

---

4. Start Capturing: Step by Step

1. Create a new session and select Proxy Local Machine.

2. Click the gear icon Access Settings in the session toolbar, then choose Traditional Proxy or Transparent Proxy in Access Mode (see the previous section).

3. HTTP/3 (QUIC) handling: In the same Access Settings area, choose the level you need:

• Disable (downgrade for capture): Downgrades HTTP/3 to ordinary connections for capture (a few apps do not support this). Selecting this is the most stable option.
• Ignore (faithful pass-through): Forwards as-is without decryption, without interfering with the program's data requests.
• Decrypt (true H3 MITM): Actually captures and decrypts HTTP/3, enabling plaintext viewing just like ordinary HTTPS. This option must be used in Transparent Proxy mode (Traditional Proxy only supports Disable / Ignore).

1. (Optional) Define the decryption scope: In the decryption scope settings, you can switch between blacklist / whitelist, and configure allowlist / blocklist:

• Whitelist: Decrypts only the domains you specify; everything else is passed through directly, keeping the capture list cleaner.
• Allowlist: Causes certain sites with strict verification to be passed through unchanged without decryption, avoiding connection errors.
• Blocklist: Directly blocks the domains you do not want to pass through.

1. Click Start, and let the program generate requests (open a website in your browser, or send a request from the command line). Traffic appears in the request list in real time; each entry shows the method, status, host/path, size, and source process.

Capturing LAN Devices (Phone / Tablet / Other Computers)

1. First set up a proxy capture session on this machine following steps 1–4 above (it is recommended to use Transparent Proxy).
2. Follow Certificate Installation to install and trust the capture certificate on that device.
3. Point that device's Wi-Fi proxy to this machine's IP address plus the session listening port (the phone and computer must be on the same LAN).
4. Open an app / webpage on the device to generate requests; the traffic will show up in this machine's request list.

---

5. Verification: Confirm Capture and Decryption

Click any request in the list and inspect its details:

• The request is visible: the request line, headers, and body are all present.
• TLS shows Decrypted: the response is readable plaintext (e.g., JSON), not garbled ciphertext.
• Source process / application is labeled: in a mixed environment, you can tell at a glance which entry belongs to which sender.

---

6. Can't Capture / Can't Decrypt? Troubleshoot Item by Item

Symptom	Likely cause	What to do
No traffic at all	The program does not use the system proxy	Switch the access mode from Traditional Proxy to Transparent Proxy (full traffic) so non-proxy-aware programs are captured too
Captured, but everything is ciphertext / garbled	Certificate not installed, or not trusted by this device	Install and trust it via Certificate Installation; to capture a phone/tablet, install the certificate on that device
Certificate installed but a certain program still cannot be decrypted	The target uses certificate pinning (Pinning)	See Bypass Certificate Pinning to remove its certificate validation with one click and continue decrypting
A site fails to connect / reports errors when the proxy is on	The site has strict validation and does not accept man-in-the-middle decryption	Add it to the allowlist for unmodified pass-through, or use the whitelist to decrypt only the domains you need
HTTP/3 traffic is incomplete	The target uses HTTP/3 (QUIC)	In Access Settings, set HTTP/3 to Disable (downgrade for capture); to decrypt H3 directly, switch to Transparent Proxy and choose Decrypt
Phone is set to proxy but still no traffic	Proxy address / port is wrong, or not on the same LAN	Check this machine's IP and session listening port; confirm the phone and computer are on the same network; the certificate must also be installed on the phone
Phone / computer already running, don't want to change its proxy	Both traditional and transparent proxy require the target to go through this machine	Use iOS Packet Capture / Android Packet Capture for direct connection, or Application-Layer Capture

---

7. How to Choose Among the Four Local Capture Methods

Your situation	Use this method
Capture multiple programs / the whole machine, capture phones and LAN devices, and need companion rewrite/replay	Proxy Packet Capture (this article, the most universal)
Only capture a single program that can be launched via command line, and skip certificate installation	Designated Program Capture
Watch all machine traffic, including non-HTTP traffic	Network Interface (NIC) Capture
Program already running / certificate pinning / doesn't honor proxy / custom encryption	Application-Layer Capture
macOS system built-in apps / stubborn applications	System-Level Capture

---

• If you haven't installed the certificate or want to capture a phone: see Certificate Installation first; for certificate pinning, see Bypass Certificate Pinning.
• For a more convenient, direct-connection way to capture mobile apps without setting a proxy: see iOS Packet Capture and Android Packet Capture.
• To learn how to interpret captured data, switch views, and decode payloads: see Data Viewing and Decoding; for private / custom protocols, see Custom Protocol Decoding.
• To modify a request and resend it, or intercept and edit it manually mid-flight: see Request Construction and Replay, and Rule Rewriting & Breakpoint Interception.
• To identify the remote host, its attribution, and certificate: see Host Details.

Project URL: https://github.com/traceeagle/traceeagle