Quick Start
This guide gets you through a packet capture in minutes: install, launch, capture your first decrypted request in the simplest way, then pick a capture approach that fits your goal. You'll be up and running after reading.
1. Install and Launch
- Download and install the desktop app for your platform (macOS / Windows / Linux).
- Open the app. On first launch it may ask for system permissions (required for low-level capture) — grant them.
- It works right away, with no extra configuration.
2. Fastest Success: Capture Your Own Browser
To see results immediately, use Targeted App Capture: the tool launches a browser for you, captures only that process, and auto-decrypts all the way — no proxy configuration, no certificate installation.
- Create a new session and choose Local Targeted App Capture.
- Click the built-in Browser Example (it auto-fills the launch command), or enter your own command under Launch Command.
- Click Start. The tool opens an independent, clean browser window.
- In that browser, open any website. Requests appear in the list instantly. Click one to see the decrypted plaintext: request line, request headers, body — and the same for the response.
If you want to get it working the first time, take this route — no system proxy, no certificate, least effort. It's the perfect way to get a taste of "capture and see plaintext." See Targeted App Capture for full steps.
3. Choose a Capture Approach That Fits Your Goal
Use different approaches for different goals; pick one from the table:
| What you want to capture | Which approach to use |
|---|---|
| Local browser / app, or want to tamper and replay | Proxy Capture |
| Entire machine traffic, including non-proxy traffic, UDP / QUIC, DNS | NIC Capture |
| Only one app, auto-decrypt, no certificate | Targeted App Capture |
| Apps with certificate pinning or custom encryption that can't be broken | App-Layer Capture |
| System built-in apps, stubborn apps | System-Level Capture |
| iPhone / iPad traffic | iOS Capture |
| Android phone traffic | Android Capture |
If in doubt, start with Proxy Capture: it's the most general, supports plaintext viewing, request tampering/replay, and can also capture phones and LAN devices.
4. Understand the Interface
- Request List: Each captured traffic item appears here in order; click to expand its details.
- Automatic Decryption: When the session key for an item is available, the tool automatically turns ciphertext into plaintext; the details show TLS as "Decrypted".
- Raw and Plaintext Side by Side: View both the decrypted request/response and the underlying raw bytes.
- Process Attribution: Each item is tagged with which program sent it, so you can tell them apart at a glance even when they're mixed together.
To understand a capture, switch views, or decode payloads, see Data Viewing & Decoding; to compare two requests, see Request Comparison.
5. Can't Capture / Can't Decrypt? Check These First
| Symptom | Likely cause | What to do |
|---|---|---|
| No requests at all | Target doesn't go through the system proxy | Switch to NIC Capture — it sees everything at the NIC layer |
| Captured, but all ciphertext | No certificate installed, or app has certificate pinning | Install a certificate (see Certificate Installation), or switch to App-Layer Capture |
| Phone capture still fails after certificate installed | Newer OS versions don't trust user certificates | See the certificate-free methods in Android Capture / iOS Capture |
| HTTP/3 / QUIC not visible | It runs over UDP, which ordinary proxies can't see | Use NIC Capture with H3 decryption |
For more detailed troubleshooting, run Network Diagnostics first.
6. What's Next
Once you can capture, decrypt, and understand, these are the everyday high-frequency features:
- Rule Rewrite & Breakpoint Interception: Modify requests and responses without changing code, or intercept requests mid-way and edit them manually.
- Request Construction & Replay: Modify any request and resend it; even signed and timestamped APIs can be truly replayed.
- Session Replay & Stress Testing: Replay a whole batch of requests, or load-test a single endpoint in place.
- Code Generation & API Document Export: Turn a request into multi-language code, or reverse the entire session into an OpenAPI document.
Top comments (0)