PCAPdroid
A no-root Android app for monitoring, analyzing, and blocking app network traffic with PCAP export and TLS decryption.
What is PCAPdroid?
PCAPdroid is an open-source Android application that allows users to monitor, analyze, and block network traffic from other apps without requiring root access. It captures traffic by simulating a local VPN, enabling features like PCAP export, HTTP inspection, and TLS decryption to help users understand and control their device's network activity.
Android users, developers, and security researchers who need to analyze app network behavior, debug connections, or enhance privacy without rooting their devices.
PCAPdroid offers a comprehensive, privacy-friendly alternative to root-based network monitors by providing advanced traffic analysis, TLS decryption, and firewall capabilities entirely on-device, with no remote data processing.
Overview
No-root network monitor, firewall and PCAP dumper for Android
Use Cases
Best For
- Monitoring app network connections for privacy or security audits
- Debugging HTTP/HTTPS traffic from mobile applications
- Analyzing network behavior of Android apps without root access
- Exporting PCAP files for use with tools like Wireshark
- Blocking unwanted connections from specific apps or domains
- Decrypting TLS traffic to inspect encrypted communications
Not Ideal For
- iOS or cross-platform developers needing network analysis on non-Android devices
- Organizations requiring centralized, cloud-based traffic monitoring with remote reporting
- Users seeking a fully free firewall solution without purchasing paid features like app blocking
- Environments where continuous VPN simulation is problematic due to battery drain or app compatibility issues
Pros & Cons
Pros
Processes all network data locally on the device without sending it to remote servers, aligning with its privacy-focused philosophy as stated in the README.
Uses VPN simulation to capture traffic without requiring root access, making advanced network analysis accessible to more users.
Includes features like HTTP inspection, TLS decryption, and PCAP export, allowing detailed debugging and integration with tools like Wireshark.
Identifies the country and ASN of remote servers using an offline database, ensuring functionality without internet connectivity.
Cons
Core functionalities like the firewall and malware detection are behind a paywall, limiting the free version's utility for advanced blocking needs.
On non-rooted devices, the VPN simulation can conflict with other VPN apps, and capturing traffic while other VPNs run requires root access, as admitted in the features.
Setting up the build environment requires specific tools like CMake 3.22.1 and NDK, which can be challenging for developers, as noted in the building instructions.
Frequently Asked Questions
Related Projects
Deepfence PacketStreamer:star: :star: Distributed tcpdump for cloud native environments :star: :star:
sharppcapOfficial repository - Fully managed, cross platform (Windows, Mac, Linux) .NET library for capturing packets
pmacctpmacct is a small set of multi-purpose passive network monitoring tools [NetFlow IPFIX sFlow libpcap BGP BMP RPKI IGP Streaming Telemetry].
Netis Packet AgentA Software Probe for network packet capturing and forwarding in Cloud/Kubernetes and Virtualized environment.
Found a gem we're missing?
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.