PCAPdroid

PCAPdroid is a privacy-friendly open source app which can track, analyze and block the connections made by the other apps on the device. It can also export a PCAP dump of the traffic, inspect HTTP requests, decrypt TLS traffic and much more.

PCAPdroid simulates a VPN in order to capture the network traffic without root. It does not use a remote VPN server, instead data is processed locally on the device.

Main features:

• Log and analyze the connections made by user and system apps
• Get a summary of how much data each app sent and received
• Low battery usage for continuous, all-day capture
• Extract hosts and IP addresses from DNS, TLS and HTTP
• Record the traffic to PCAP files with additional app metadata
• Send traffic via PCAP-over-IP for real-time analysis (e.g. on Wireshark)
• Decrypt the HTTPS/TLS traffic, extract the URLs and save the SSLKEYLOGFILE
• Inspect the HTTP requests/replies and export them to HAR
• Identify the country and ASN of the remote server via offline DB lookups
• On rooted devices, capture the traffic while other VPN apps are running

Paid features:

• Firewall: create rules to block individual apps, domains and IP addresses
• Malware detection: detect malicious connections by using third-party blacklists
• PCAPng format: makes it easier to export and analyze decrypted traffic

If you plan to use PCAPdroid to perform packet analysis, check out the specific section of the manual.

You can test the latest features before the official release by adding the Beta repository to the F-Droid app.

User Guide

Check out the quick start instructions or the full User Guide.

Sponsors

The PCAPdroid project is sponsored by AVEQ GmbH.

If you want to sponsor this project drop me an email.

Community

You can help the PCAPdroid project in many ways:

• Make a donation
• Translate the app on Weblate

• Discuss new features
• Improve the app theme and layout
• Star the project on Github and on Google Play
• Of course provide code pull requests!

Join the international PCAPdroid community on Telegram or on Matrix.

Integrating into your APP

Some features of PCAPdroid can be integrated into a third-party app to provide packet capture capabilities.

• For rooted devices, the pcapd daemon can be directly integrated into your APK to capture network packets.
• For all the devices, PCAPdroid exposes an API to control the packet capture and send the captured packets via UDP to your app. This requires to install PCAPdroid along with your app.

Open Source

PCAPdroid is powered by open source technologies.

• nDPI: deep packet inspection library, provides the connections metadata
• mitmproxy: a local proxy for the TLS decryption
• zdtun: minimal TCP/IP stack for the non-root capture

For the complete list of third party libraries check out the "About" page in the app.

Building

1. On Windows, install gitforwindows
2. Clone this repo
3. Inside the repo dir, run git submodule update --init. The submodules directory should get populated.
4. Open the project in Android Studio, install the appropriate SDK and the NDK
5. Build the app

Note: If you get "No valid CMake executable was found", be sure to install the CMake version used by PCAPdroid (currently 3.22.1) from the SDK manager