PCAPdroid

A privacy-friendly open-source app that can track, analyse, and block the connections made by the other apps on your device. It can also export a PCAP dump of the traffic, inspect HTTP requests, decrypt TLS traffic, and more.

PCAPdroid simulates a VPN in order to capture network traffic without root. It does not use a remote VPN server; data is processed locally on the device.

Features

- Log and analyse connections made by user and system apps. - Get a summary of how much data each app sent and received. - Low battery usage for continuous, all-day capture. - Extract hosts and IP addresses from DNS, TLS, and HTTP. - Record traffic to PCAP files with additional app metadata. - Send traffic via PCAP-over-IP for real-time analysis, e.g. on Wireshark. - Decrypt HTTPS/TLS traffic, extract URLs, and save the SSLKEYLOGFILE. - Inspect HTTP requests and replies and export them to HAR. - Identify the country and ASN of the remote server via offline database lookups. - On rooted devices, capture traffic while other VPN apps are running.

Paid features

- Firewall: create rules to block individual apps, domains, and IP addresses. - Malware detection: detect malicious connections using third-party blacklists. - PCAPng format: easier export and analysis of decrypted traffic.

Integration into other apps

For rooted devices, the pcapd daemon can be integrated directly into an APK to capture network packets. For all devices, PCAPdroid exposes an API to control packet capture and send captured packets via UDP to your app, requiring PCAPdroid to be installed alongside.

Requirements

- Android 8.0 (API 26) or newer - Root access (optional, for capturing while other VPN apps are running)

License

GNU General Public License v3.0