Traffic Monitor

Traffic Monitor — локальный монитор сетевого трафика для Android. Приложение использует VpnService, перехватывает IPv4-пакеты и показывает, какое приложение устанавливает соединение, с каким IP-адресом и сколько данных передаётся.

Traffic Monitor raises a local VPN (VpnService), intercepts the device's IPv4 traffic and shows, in real time: which app → connects where → how many bytes. Traffic is forwarded onward (user-space NAT), so the internet keeps working while monitoring is active. Beyond observation, it can block: an entire app, or individual domains (e.g. telemetry), without breaking the app's main function.

No root required. No external packet-parsing libraries — IPv4/TCP/UDP headers are parsed by hand.

Features Live connection list: app → domain/IP:port, protocol, bytes ↑/↓, session count, last-seen time. Per-packet app attribution via UID (ConnectivityManager.getConnectionOwnerUid, API 29+). Domains instead of raw IPs: resolved from DNS answers and TLS SNI; IP↔domain cache; rows are re-aggregated when a domain becomes known later. App blocking (toggle): traffic is not forwarded; live sessions are torn down (TCP RST injected back into the tun, UDP mappings dropped); an "attempts" counter shows the app keeps knocking on the wall. Domain blocking (tap a row; the rule applies to all apps): DNS queries get NXDOMAIN from a local sinkhole; TLS connections are reset on SNI match. Tracker hints: heuristic list (including OEM firmware telemetry) plus name tokens (analytics, telemetry, …). The ⚠️ badge is a hint only — nothing is blocked automatically. Footgun protection: system apps and apps sharing a UID are flagged ⚠️ and require confirmation before blocking. Persistence: block rules and known domains are stored in Room and survive service restarts. Localization: English UI by default; a toggle in Settings switches the interface to Russian.

Limitations & known issues IPv6 is not parsed or displayed. Private DNS (DoT/DoH): with a private DNS enabled, other apps' DNS queries are encrypted — per-app DNS is not visible (rows show system UIDs 1051/0), the sinkhole cannot act; domain rules work via SNI only. QUIC (UDP:443): SNI is encrypted — such connections show a raw IP without a domain. STARTTLS (XMPP 5222, SMTP 587, etc.): TLS starts mid-stream, SNI is not extracted — raw IP without a domain. A domain may stay unknown if the DNS answer and ClientHello did not pass through the tunnel (app resolver cache). The connection list lives in memory and resets on service restart (rules and known domains do not). The tracker heuristic is not an AdGuard/pi-hole-grade blocklist: misses and false positives are possible. ⚠️ is a hint, not a verdict. Blocking system apps or shared-UID apps (e.g. UID 1000) may affect adjacent system functions — the app warns, but the decision remains the user's.