PCAPdroid

Project Overview

PCAPdroid is a privacy-friendly open-source Android app that lets you track, analyze, and block connections made by other apps on your device, with support for PCAP export, HTTP inspection, and TLS decryption.

Key Features

• Connection logging: Log and examine connections made by user and system apps
• Protocol decoding: Extract SNI, DNS queries, HTTP URLs, and remote IPs; built-in HTTP request/reply decoders
• HTTPS/TLS decryption: Decrypt HTTPS/TLS traffic and export SSLKEYLOGFILE
• PCAP export: Dump traffic to PCAP files, download via browser, or stream to a remote receiver for real-time analysis
• Rule filtering: Create rules to filter good traffic and easily spot anomalies
• Geolocation: Identify country and ASN of remote servers via offline DB lookups
• Paid features: Firewall (block by app/domain/IP), malware detection, PCAPng format

Target Audience

• Security researchers and developers who need to analyze Android network traffic
• Privacy-conscious users who want to monitor app network behavior

Quick Start

1. Download from GitHub Releases or Google Play
2. Test the latest features via the F-Droid Beta repository
3. Refer to the User Guide to get started

Core Advantages

• No root required for packet capture (uses a local VPN)
• Data is processed locally on the device, not sent to remote servers
• TLS decryption and PCAP export support for in-depth analysis
• Open-source and free with an active community

System Requirements

• OS: Android
• Architectures: Not explicitly listed