ksp capture
ksp capture
Command ReferenceCapture live KSP network traffic on an interface and record it to a pcapng file with decryption keys attached.
Networking & Diagnostics
Purpose
Capture live KSP network traffic on an interface and record it to a pcapng file with decryption keys attached.
Syntax
Command-line specificationbash / powershell
ksp capture --interface <IFACE> [OPTIONS]
Options & Flags
| Option Flag | Description |
|---|---|
| --interface, -i <IFACE> | Network interface name (e.g., `eth0`, `lo`, `Wi-Fi`) or `any`. |
| --port <PORT> | Filter captured frames by UDP/TCP port number (default: `9876`). |
| --write, -w <FILE> | Save captured traffic directly to a `.pcapng` trace file. |
| --dump-keys <FILE> | Write ephemeral session secret keys to a keylog file (`SSLKEYLOGFILE` format). |
Example Usage
Example command
ksp capture -i lo --port 9876 -w ksp-session.pcapng --dump-keys ksp.keys
Expected Output
[+] Capturing on interface 'lo' (Filter: port 9876) [+] Writing pcapng trace to: ksp-session.pcapng [+] Dumping ephemeral keys to: ksp.keys [!] Press Ctrl+C to stop recording... [CAPTURED] #0001 | 12:04:11.20 | ClientHello → Server (128 bytes) [CAPTURED] #0002 | 12:04:11.21 | ServerHello → Client (196 bytes) [CAPTURED] #0003 | 12:04:11.22 | StreamData | Stream #1 (1,024 bytes) ✔ Saved 142 frames (38.4 KB) to ksp-session.pcapng.
Implementation Notes
The generated `.pcapng` file combined with the `--dump-keys` file allows 100% transparent offline inspection inside Wireshark.