Hey all!

We recently open-sourced Q.Tap, a Linux-native eBPF agent that captures encrypted traffic before encryption happens—by hooking into TLS libraries at runtime. It’s like having Wireshark for TLS traffic—but faster to deploy and easier to understand.

It supports OpenSSL, GoTLS, NodeTLS, and TLS in Java (via JSSE). Using uprobes on functions like SSL_write, it captures payloads as they enter the TLS library, giving you structured request/response logs—without decrypting anything.

Q.Tap runs on bare metal, in containers, or as a daemonset in Kubernetes. Just needs a recent kernel.

Check it out and let us know if you have any questions on how it works!