diff --git a/README.md b/README.md index 2c5cda62a..a54c191c6 100644 --- a/README.md +++ b/README.md @@ -63,7 +63,7 @@ directly. ### plaintext result `./ecapture tls` will capture all plaintext context ,output to console, and capture `Master Secret` of `openssl TLS` -save to `ecapture_master.log`. You can also use `tcpdump` to capture raw packet,and use `Wireshark` to read them +save to `ecapture_masterkey.log`. You can also use `tcpdump` to capture raw packet,and use `Wireshark` to read them with `Master Secret` settings. > @@ -233,4 +233,4 @@ See [CONTRIBUTING](./CONTRIBUTING.md) for details on submitting patches and the - \ No newline at end of file + diff --git a/README_CN.md b/README_CN.md index c3abcf44e..97e8af936 100644 --- a/README_CN.md +++ b/README_CN.md @@ -72,12 +72,11 @@ eCapture默认查找`/etc/ld.so.conf`文件,查找SO文件的加载目录, ### Pcapng输出格式 -`./ecapture tls -i eth0 -w pcapng -p 443` 直接讲捕获的明文数据包保存为pcapng格式,直接使用`Wireshark`打开查看。 +`./ecapture tls -i eth0 -w pcapng -p 443` 将捕获的明文数据包保存为pcapng文件,可以使用`Wireshark`打开查看。 ### 文本输出格式 -`./ecapture tls` 将会输出所有的明文数据包,并捕获openssl TLS的密钥`Master Secret` -文件到当前目录的ecapture_master.log中。你也可以同时开启`tcpdump`抓包,再使用`Wireshark`打开,设置`Master Secret`路径,查看明文数据包。 +`./ecapture tls` 将会输出所有的明文数据包,并捕获openssl TLS的密钥`Master Secret`文件到当前目录的`ecapture_masterkey.log`中。你也可以同时开启`tcpdump`抓包,再使用`Wireshark`打开,设置`Master Secret`路径,查看明文数据包。 ### 验证方法: @@ -218,4 +217,4 @@ bin/ecapture # 参考资料 [BPF Portability and CO-RE](https://facebookmicrosites.github.io/bpf/blog/2020/02/19/bpf-portability-and-co-re.html) -[ebpfmanager v0.2.2](https://github.com/gojue/ebpfmanager) \ No newline at end of file +[ebpfmanager v0.2.2](https://github.com/gojue/ebpfmanager)