PCAPdroid

What PCAPdroid is

PCAPdroid is an open-source Android app for capturing and inspecting network traffic on the device where it runs. It works without root privileges: Android’s VpnService delivers app traffic to PCAPdroid, which processes it locally without using an external VPN server. Its connection view shows protocols, ports, addresses, connection status and traffic volume for user and system apps. You can capture traffic live, apply display filters, inspect offline traces and save captures as PCAP files. PCAPdroid can also decrypt HTTPS/TLS traffic for a selected app, subject to Android certificate trust limitations.

For further analysis, captures can be sent remotely or streamed in real time over PCAP-over-IP to tools such as Wireshark, ntopng and tcpdump. The free plan includes core network monitoring and capture. A one-time purchase adds firewall rules for blocking apps, domains and IP addresses, malware detection using third-party blacklists, and PCAPng format. On rooted devices, third-party Android apps can integrate the pcapd daemon; on any device, they can control PCAPdroid through its API. In non-root mode, capture is limited to outgoing connections initiated by the Android device, and the app does not capture traffic from other devices on the network.

Who it suits

PCAPdroid suits Android users who want to inspect or export traffic from apps on their device, including people who need live capture, filters or offline trace analysis. Its paid firewall and malware detection may suit users who also want rules to block selected traffic.

Limits

The free plan excludes the paid features: firewall, malware detection and PCAPng format. In non-root mode, capture covers only outgoing connections started by the Android device, and PCAPdroid does not capture other devices' traffic.

Getting started

1. Open the PCAPdroid website for the app.
2. Use an Android device; Android is the supported platform.
3. Start with the free plan for core network monitoring and capture.
4. Use PCAPdroid's live capture and connection details to inspect traffic.
5. Save a capture as a PCAP file or use PCAP-over-IP with a supported analysis tool.
6. Purchase the paid features for the firewall, malware detection and PCAPng format.

Verdict

Choose PCAPdroid to inspect and export network traffic from an Android device, with local processing and core capture available on the free plan. Look elsewhere if you need to capture traffic from other devices on the network; non-root capture is limited to outgoing connections started by the device.