Freedom251 › Network Packet Analyzer Software

PCAPdroid

Free plan Android

What PCAPdroid is

PCAPdroid is an Android app for tracking, analyzing, and blocking connections made by other apps. It uses Android’s VpnService to capture traffic without root, then processes it locally rather than creating an external VPN. Its connection log covers user and system apps, showing protocol, remote host or IP, status, and traffic volume. Captures can be saved as PCAP files, served over HTTP, or sent through PCAP-over-IP for real-time analysis. For a selected app, PCAPdroid can decrypt HTTPS/TLS traffic, inspect HTTP requests and replies, and export them to HAR. The free app includes capture, monitoring, PCAP export, TLS decryption, and HTTP inspection. Firewall, malware detection, and PCAPng format are listed as paid features, but no price is stated. Malware checks rely on third-party blacklists and run only during capture. Non-root capture changes packet headers and sizes, so the guide recommends root capture for low-level packet analysis; the firewall is unavailable during root capture.

Who it suits

It suits Android users who want to inspect app connections locally, export captures, or examine selected apps’ HTTPS and HTTP traffic. Low-level packet analysts should note the packet changes in non-root mode.

What it does well

Captures traffic without requiring root.
Processes captured traffic locally.
Exports PCAP files and HAR.
Supports live PCAP-over-IP analysis.
Free plan includes TLS decryption.

What to know first

Requires Android 6.0 or newer.
Firewall is unavailable with root capture.
Non-root capture alters packet headers and sizes.
Malware detection is not comprehensive device security.

Limits

The free app includes capture, monitoring, PCAP export, TLS decryption, and HTTP inspection. Firewall, malware detection, and PCAPng are available through Google Play; the malware feature uses third-party blacklists, is active only during capture, and is not comprehensive device security. The firewall is unavailable with root capture, and non-root capture alters L3/L4 headers and packet sizes.

Plans

Plan	Billed and limits	Price
Free app	Network capture, monitoring, PCAP export, TLS decryption, HTTP inspection · Android app	Free
Paid features	Firewall · malware detection · PCAPng format · Purchase through Google Play; price not stated on the pages opened	On request

As pcapdroid.org lists them, read 3 Oct 2026. The maker's own page has the final word.

Getting started

Open the PCAPdroid website or install the Android app.
Use a device running Android 6.0 or newer.
Start capture to monitor app connections.
Save a capture as PCAP or serve it for analysis.
Choose a feature through Google Play if you need the firewall, malware detection, or PCAPng.

Verdict

PCAPdroid combines local Android traffic capture with connection details, export options, and selected-app TLS inspection. Check the capture-mode limitations and the unlisted prices for paid features before relying on its firewall or malware detection.

Questions

Is PCAPdroid free?

Yes. The free app includes network capture, monitoring, PCAP export, TLS decryption, and HTTP inspection.

What platforms does it support?

It is an Android app, and the F-Droid listing requires Android 6.0 or newer.

Does PCAPdroid require root?

No. It uses Android VpnService for non-root capture. Its guide recommends root capture for low-level packet analysis because non-root capture changes packet headers and sizes.

Where is captured traffic processed?

Captured traffic is processed locally, without creating an external VPN. Optional features such as malware detection may contact third-party servers.

Who makes PCAPdroid?

The app is authored and maintained by Emanuele Faranda.

Facts from PCAPdroid's own pages

Capture method: It uses Android VpnService to capture traffic without root and processes the traffic locally without creating an external VPN. · emanuele-f.github.io, 3 Oct 2026
Connection analysis: It logs connections from user and system apps and reports details such as protocol, remote host or IP, status, and traffic volume. · emanuele-f.github.io, 3 Oct 2026
Firewall limit: The firewall feature is unavailable with root capture, and blocking an app does not prevent it from performing name resolution through Android netd. · emanuele-f.github.io, 3 Oct 2026
Headquarters: Anzio, Italy · pcapdroid.org, 28 Sept 2026
Integrations: For third-party apps, PCAPdroid exposes an API to control capture and send captured packets over UDP; rooted devices can integrate the pcapd daemon into an APK. · github.com, 3 Oct 2026
Maker: The app is authored and maintained by Emanuele Faranda; the opened pages did not state a founding date or headquarters. · f-droid.org, 3 Oct 2026
Malware detection limit: Malware detection uses third-party blacklists, is active only while capture is running, and is explicitly not described as a comprehensive device security solution. · emanuele-f.github.io, 3 Oct 2026
Open source components: The project lists nDPI for connection metadata, mitmproxy for TLS decryption, and zdtun for non-root capture among its open source technologies. · github.com, 3 Oct 2026
Packet analysis caveat: The guide says non-root capture alters L3 and L4 packet headers and packet sizes, and recommends root capture for low-level packet analysis. · emanuele-f.github.io, 3 Oct 2026
Platform requirement: The F-Droid listing says the app requires Android 6.0 or newer. · f-droid.org, 3 Oct 2026
Privacy: The privacy policy says PCAPdroid collects no information and processes captured traffic locally; optional features such as malware detection may contact third-party servers. · emanuele-f.github.io, 3 Oct 2026
Purpose: PCAPdroid tracks, analyzes, and can block connections made by other apps on an Android device. · github.com, 3 Oct 2026
Support and community: The project lists a support email and invites users to join its Telegram or Matrix community. · play.google.com, 3 Oct 2026
TLS and HTTP: It can decrypt HTTPS/TLS traffic for a specific app, inspect HTTP requests and replies, and export them to HAR. · github.com, 3 Oct 2026
Traffic export: It can save traffic to PCAP files or serve captures through an HTTP server, and supports PCAP-over-IP for real-time analysis such as with Wireshark. · emanuele-f.github.io, 3 Oct 2026

Where PCAPdroid stands on Freedom251

Network Packet Analyzer Software#22 of 32