gojue
Can eCapture support packet filter ?
maybe will. but not now .
you can use ecapture for master secrets , and use tcpdump for pcapng .
use wireshark to union them.
For example, I only want to decrypt the traffic between 1.1.1.1 to 2.2.2.2. But we have to capture all master secrets for all TLS traffic. The key size may be much larger than the traffic between 1.1.1.1 to 2.2.2.2. In our production env, the key size can be up to GB while the traffic I want to decrypt is only several MB.
In openssl_tc.h, you can get iph as an iphdr struct pointer, which contains src and dest IP info you need to filter.
You can add your IP filter logical after line 106 in openssl_tc.h
Recompile the code, then you should be able to do want you want to achieve.
