NIC Packet Capture
This guide teaches you to use NIC capture to grab everything that flows through this machine's NIC: DNS, QUIC, games, IoT, various proprietary protocols — anything passing through the NIC is right before your eyes. No proxy configuration, no certificate installation — pick a NIC and start capturing. HTTPS no longer stays as ciphertext either: common apps are decrypted to plaintext as soon as captured, and for the rest, just click Decrypt this app to read them.
1. When to Use This Approach
This suits you if any of the following applies:
- Want to see non-HTTP traffic: DNS, QUIC, ICMP, ARP, or any TCP/UDP — what proxies can't capture is all captured here.
- Want to understand a program's full network behavior: which addresses it connects to, which protocols it uses, and whether it has any "silent" connections.
- Don't want to change the system proxy or install certificates — you want zero-intrusion direct capture.
- You have proprietary / self-developed protocols and want to capture raw streams first, then reverse-engineer them later.
If you just want to debug an HTTP API and rewrite or replay requests, Proxy Capture is more precise. If you only need to capture a program that can be launched from a command line, Process Capture is more convenient.
2. Prerequisites
- TraceEagle is installed and started (simply agree to system permissions on first launch).
- No need to change the system proxy or install certificates.
- Only when you want to read a program's HTTPS plaintext do you need to click Decrypt this app on it during capture (see Section 4). For common programs, even that step is unnecessary.
3. Start Capturing: Capture Your First Packet
Create a new session and choose "Local NIC Capture".
Select a NIC: The tool automatically lists all local NICs and preselects the currently active one. Choose whichever you want to capture.
(Optional) Set a capture filter before starting: If you only care about certain traffic, enter a capture filter rule or simply apply a built-in preset (TLS / HTTP / QUIC / DNS / TCP / UDP / ICMP / ARP / SSH, etc.) with one click.
Capture filters can only be set before capture and cannot be changed afterward — they determine what is captured at the NIC layer. To filter already-captured data, use the Display Filter in the packet view (see Section 4).
- Click Start. Packets flowing through the NIC appear in the list in real time.
Make the target program produce network requests (open a webpage, initiate a connection), and traffic will stream into the list in real time.
4. View Plaintext: Turn Ciphertext into Plaintext
Traffic captured on the NIC is ciphertext by default (captured as-is). To see HTTPS plaintext for a program, use these three levels, each as a fallback:
- Auto-decryption: Common programs such as browsers and Electron apps usually appear as plaintext right after capture, with no extra action needed.
- Manual "Decrypt this app": For programs that cannot be auto-decrypted, click Decrypt this app and select it in the list to reveal its encrypted traffic. Multiple programs can be decrypted simultaneously.
-
Two enhancement switches (use only if decryption is still incomplete):
- Restart the program: Restart the target from scratch so even the encrypted traffic from its early startup phase is decrypted.
- Handle child processes in one click: Some programs send/receive traffic through child processes; enabling this processes child processes as well, avoiding gaps.
During capture, two views help you make sense of the packets:
-
Packet view: Inspect individual packets like in professional capture tools. Selecting a frame shows its frame info, raw bytes, and the protocol hierarchy tree expanded layer by layer. The search box supports Wireshark-style display filters (e.g.,
tcp.port==443,tls.handshake,dns), validating syntax as you type, allowing precise navigation across the full captured data. - Connection view: Reassembles scattered packets into logical connections. Use Follow Stream to see the complete sent/received data of a connection; DNS/TLS/HTTP can also be viewed structurally.
The two views navigate back and forth (jump from a connection to its raw packets, or follow an entire connection from a single packet). Right-clicking any frame lets you show only this connection / filter this connection, flag the frame, copy source/destination address, or directly look up host details / ping / port scan a remote IP. You can also pause anytime during capture, review what's been captured, then continue.
5. Verification: Confirm Capture and Decryption
- Captured successfully: The list refreshes continuously when traffic passes the NIC; in the connection view you can see connections grouped by protocol.
- Readable: Open an HTTPS connection. If it displays as readable plaintext (e.g., JSON), decryption has succeeded. If still ciphertext, return to Section 4 and click Decrypt this app on it.
-
Verify non-HTTP: Type
dns,quic,icmp, etc., into the display filter in the packet view. If corresponding traffic appears, the NIC layer has captured everything.
6. Nothing Captured / Can't Decrypt? Troubleshoot
| Symptom | Likely Cause | Solution |
|---|---|---|
| Captured, but a program is still ciphertext | It isn't one of the common programs that are plaintext immediately | Click Decrypt this app on it and select it. If still incomplete, enable Restart program / Handle child processes. |
| No traffic at all | Wrong NIC selected, or the capture filter filtered out all traffic | Switch to the currently active NIC; relax or clear the capture filter and restart the session. |
| Want to re-filter captured data but find the capture filter can't be changed | Capture filters only take effect before the capture starts | Use the Display Filter in the packet view to filter the captured full data (e.g., tcp.port==443). |
| Target uses HTTP/3 (QUIC), cannot see all traffic | More apps are adopting QUIC; it has always been hard to capture and decrypt at the NIC layer | Induce the target to gracefully fall back from HTTP/3 to a regular connection, making it capturable and decryptable again (stopping the session auto-restores). When session keys are available, you can also decrypt QUIC/HTTP/3 directly. |
| Only want to debug an HTTP API, but NIC traffic is too noisy | NIC captures "everything", focusing on completeness over precision | Use Proxy Capture (more precise) or Process Capture (only one program). |
7. Choosing a Local Capture Method
| Your situation | Use this method |
|---|---|
| See all traffic on the whole machine, non-HTTP traffic, or a program's full network behavior | NIC Capture (this article, most complete) |
| Debug HTTP APIs, rewrite/replay requests | Proxy Capture (more precise) |
| Ordinary programs launchable from command line (browser/script/CLI) | Process Capture (simplest) |
| Program already running / certificate pinned / proxy unsupported / proprietary encryption | Application-Layer Capture |
| System apps on macOS / stubborn applications | System-Level Capture |
Next Steps
- How to read captured data, switch views, and decode: see Data Viewing and Decoding.
- For proprietary/self-developed protocols, to teach the tool how to read them: see Custom Protocol Decoding.
- To quickly look up remote IP ownership/geolocation/certificates: see Host Details.
- To probe a remote further: see Network Diagnostics, Port Scanning, and Subdomain Discovery.
Top comments (0)