Packet Capture FAQ: Can't Capture or Decrypt?
If you can’t capture anything, the target usually bypasses the system proxy or capture started too late: switch to NIC capture and start before the traffic happens, and it will almost always show up. If you capture traffic but the body is ciphertext, the certificate is usually missing or the app uses SSL pinning — install the certificate or switch to app-layer plaintext capture. The answers below are grouped by capture, decryption, phones, choosing a method, and security; each one stands on its own.
What if I can’t capture any traffic?
Section titled “What if I can’t capture any traffic?”Started capturing, but not a single piece of traffic?
Section titled “Started capturing, but not a single piece of traffic?”First confirm whether the target uses the system proxy. Many apps (for example, some built with cross-platform frameworks) don’t use the proxy at all, so proxy capture receives nothing; for these, switch to NIC capture, which captures everything at the NIC layer. Also, capture must start before the traffic happens; if you start partway through, you may have missed it.
How do I capture WeChat mini-programs, Flutter apps and others that ignore the proxy?
Section titled “How do I capture WeChat mini-programs, Flutter apps and others that ignore the proxy?”WeChat mini-programs, Flutter and similar apps ignore the system proxy entirely, so a proxy can’t capture them. Use NIC capture to grab them at the NIC layer, paired with automatic decryption to see plaintext — see how to capture WeChat mini-programs.
Why is my captured HTTPS traffic all ciphertext?
Section titled “Why is my captured HTTPS traffic all ciphertext?”Traffic is captured, but the body is ciphertext or garbled?
Section titled “Traffic is captured, but the body is ciphertext or garbled?”Most likely no certificate is installed, or the app uses certificate pinning. To decrypt via a proxy, first install the capture certificate; for pinning, switch to App-layer plaintext capture to read plaintext directly from inside the program. For how it works and what’s supported, see how to decrypt HTTPS.
Why do some apps decrypt and others don’t?
Section titled “Why do some apps decrypt and others don’t?”For apps with certificate pinning or in-house encryption, use App-layer plaintext capture; programs that don’t recognize the system certificate, like Java and Python, go through it too. For the very few where keys can’t be obtained, the per-packet view can still show the encrypted traffic itself.
How do I capture an app with SSL pinning (certificate pinning)?
Section titled “How do I capture an app with SSL pinning (certificate pinning)?”Two ways: App-layer plaintext capture reads plaintext directly from inside the program, never touching the certificate at all; or bypass SSL pinning (clear certificate pinning) so the app trusts the capture certificate instead. No matter how strict the pinning, it can’t block either approach.
Can HTTP/3 (QUIC) be decrypted?
Section titled “Can HTTP/3 (QUIC) be decrypted?”Yes. Trace Eagle supports three handling methods: downgrade capture, high-fidelity passthrough, and true H3 decryption. HTTP/3 runs over UDP, which ordinary proxies can’t see, so use NIC capture together with H3 decryption.
Do I have to install a certificate?
Section titled “Do I have to install a certificate?”Not necessarily. Direct NIC capture, targeting a specific program, and app-layer plaintext capture all need no certificate; only decrypting via a proxy requires one, and the certificate wizard covers all kinds of environments.
What should I know about capturing on a phone?
Section titled “What should I know about capturing on a phone?”Does iOS capture need a jailbreak?
Section titled “Does iOS capture need a jailbreak?”No. iOS stays jailbreak-free throughout, capturing through a connected computer — see how to capture iOS traffic.
Installed the certificate on Android but still can’t capture?
Section titled “Installed the certificate on Android but still can’t capture?”Android 7 and above no longer trust user-installed certificates, and Android 14 is stricter still. Use the certificate-free methods in Android capture so you no longer have to wrestle with certificates.
The bug is in the mobile page itself — what if capture doesn’t show it?
Section titled “The bug is in the mobile page itself — what if capture doesn’t show it?”A layout that only breaks on the phone, a blank H5 page, or a request whose calling script you need to find are page problems, not API problems. Use the web inspector: plug the phone in and you get full developer tools on your computer for the page on the device, again with no certificate and no proxy.
How do I choose and use a capture method?
Section titled “How do I choose and use a capture method?”What is packet capture, and which free tools exist?
Section titled “What is packet capture, and which free tools exist?”Packet capture means recording the network traffic a computer or phone sends and receives; see what is packet capture for a primer, and free packet capture tools compared for how Wireshark, Fiddler, Charles, mitmproxy and others differ in price and capability.
So many capture methods — which should I use?
Section titled “So many capture methods — which should I use?”Pick one from the capture method table in Getting started; if you’re unsure, start with proxy capture, the most general option, which produces plaintext and lets you edit and replay packets.
Captured a huge pile — how do I find the one I want?
Section titled “Captured a huge pile — how do I find the one I want?”Use the filter and search at the top to narrow by domain, type, or keyword and quickly locate the request you care about.
Will running a capture tool affect my normal internet use?
Section titled “Will running a capture tool affect my normal internet use?”No. When capture stops, Trace Eagle automatically restores any network settings it changed, and there’s a recovery fallback even after an abnormal exit.
How is Trace Eagle different from Charles, Fiddler or Wireshark?
Section titled “How is Trace Eagle different from Charles, Fiddler or Wireshark?”Trace Eagle is free with full features and cross-platform, and works as a free alternative to Charles or Fiddler. Compared with pure proxy tools it adds NIC capture, app-layer plaintext extraction, SSL-pinning bypass and true HTTP/3 decryption — traffic ordinary proxies can’t capture, or that Wireshark captures but can’t decrypt, it can both capture and decrypt.
Are the capture certificate and my captured data safe?
Section titled “Are the capture certificate and my captured data safe?”Is installing a capture certificate safe?
Section titled “Is installing a capture certificate safe?”Only trust a capture certificate on devices you own or are authorized to test, and remove it when you’re done. See Certificate management and installation.
Does the captured data go to the cloud?
Section titled “Does the captured data go to the cloud?”No. Trace Eagle is local-first with no telemetry; the captured traffic stays only on your machine.
Still not working?
Section titled “Still not working?”Re-read the relevant capture or decryption guide, or contact us through the channels listed in the app.