Targeted Program Packet Capture
This tutorial shows you how to use targeted program packet capture to capture the traffic of one particular program: give it a startup command, and the tool will launch the program for you, capturing only its traffic. You'll see plaintext as soon as it starts. No proxy configuration or certificate installation is required, and there's no cleanup afterward—it's the fastest and cleanest way to capture traffic.
When to Use This Approach
Use this when any of the following applies:
- You want to see what a program that can be launched from the command line (browser, script, CLI tool) is sending.
- You don't want to modify the system-wide proxy, install a certificate, or affect other software on the machine.
- You just want to run a quick script or verify an API, and you want to start capturing right away with one command.
If the program is already running, does certificate pinning, uses proprietary encryption, or doesn't honor proxy settings, targeted program capture may fail to capture or decrypt it. Use Application-Layer Packet Capture instead.
Prerequisites
- TraceEagle is installed and running (grant system permissions on first launch).
- You know the startup command of the target program (for example,
python3 app.py, acurlcommand, or the executable path of a browser). - No certificate installation or system proxy changes are required.
Start Capturing: Three Steps to Get Your First Capture
- Create a new session and choose Local Targeted Program Packet Capture.
- In the Startup Command field, enter the command you want to run. If you prefer not to type it manually, click the built-in one-click examples—they will fill in the command for you and you can still edit it:
- Browser example: launches a separate and clean browser window (without affecting the browser you use daily), and has already made HTTP/3 (QUIC) fall back to ordinary connections so the traffic can be easily captured and decrypted.
- Python example: sends a request with one command, giving you the most reliable way to see plaintext.
- CLI example: captures HTTPS requests issued from the command line.
- Click Start. The tool launches the program and captures only its traffic. Child processes spawned by the program are also captured, so nothing is missed.
Let the program run and generate network requests (open a website in the browser or have the script send a request), and the traffic will appear in the request list in real time.
Verify: Confirm That Traffic Is Captured and Decrypted
Click any request in the list to inspect its details:
- The request is visible: the request line, headers, and body are all present.
- TLS shows Decrypted: the response is readable plaintext (such as JSON), not garbled ciphertext.
For common programs—browsers, Electron desktop apps, Node, Python, desktop Java, and command-line tools that use general-purpose cryptographic libraries—plaintext is available immediately on startup, with no extra steps.
Can't Capture or Can't Decrypt? Troubleshoot Line by Line
| Phenomenon | Most Likely Reason | What to Do |
|---|---|---|
| Packets are captured, but only ciphertext | The program uses a special cryptographic library (most typically the macOS built-in curl, and some pure-Go programs) |
To see plaintext on the command line, the Python example is the most reliable; switch to an OpenSSL build of curl; if that doesn't work, use Application-Layer Packet Capture |
| No traffic at all | The program completely ignores proxy settings | Use Application-Layer Packet Capture (extract plaintext from inside the program) or NIC Packet Capture (the NIC layer captures everything) |
| Captured, but it uses HTTP/3 and is incomplete | The target uses HTTP/3 (QUIC) | Enable session-level Block HTTP/3 to force it back to ordinary connections, so it can be easily captured and decrypted |
| The target program is already running | This method requires the tool to start the program | Close it first and restart it with the startup command; or use Application-Layer Packet Capture to attach to the running process |
How to Choose Among the Four Local Capture Methods
| Your Situation | Which Method to Use |
|---|---|
| A normal command-line-startable program (browser/script/CLI) | Targeted Program Packet Capture (this article, the easiest) |
| You want to see all traffic on the machine, non-HTTP traffic, or all network behavior of a program | NIC Packet Capture |
| The program is already running / does certificate pinning / doesn't honor proxy / uses proprietary encryption / system cryptographic libraries | Application-Layer Packet Capture |
| System built-in apps / stubborn applications on macOS | System-Level Packet Capture |
Next Steps
- To learn how to read the captured data, switch views, and decode it: see Data Viewing and Decoding.
- For private/proprietary protocols, or to teach the tool how to read them: see Custom Protocol Decoding.
- To modify and resend requests, or intercept and edit them mid-flight: see Request Construction and Replay and Rule Rewriting & Breakpoint Interception.
Project address: https://github.com/traceeagle/traceeagle
Top comments (0)