mitmproxy: a local proxy used to perform TLS decryptionįor the complete list of third party libraries and the corresponding licenses check out the 'About' page in the app.nDPI: deep packet inspection library, used to extract the connections metadata.This requires to install PCAPdroid along with your app. For all the devices, PCAPdroid exposes an API to control the packet capture and send the captured packets via UDP to your app.For rooted devices, the pcapd daemon can be directly integrated into your APK to capture network packets.Some features of PCAPdroid can be integrated into a third-party app to provide packet capture capabilities. Join the international PCAPdroid community on Telegram or on Matrix. Star the project on Github and on Google Play.You can help the PCAPdroid project in many ways: If you want to sponsor this project drop me an email. The PCAPdroid project is sponsored by AVEQ GmbH. User GuideĬheck out the quick start instructions or the full User Guide. You can test the latest features before the official release by adding the Beta repository to the F-Droid app. If you plan to use PCAPdroid to perform packet analysis, please check out the specific section of the manual. Malware detection: detect malicious connections by using third-party blacklists.Firewall: create rules to block individual apps, domains and IP addresses.On rooted devices, capture the traffic while other VPN apps are running.Identify the country and ASN of remote server via offline DB lookups.Create rules to filter out the good traffic and easily spot anomalies.Dump the traffic to a PCAP file, download it from a browser, or stream it to a remote receiver for real-time analysis (e.g.Decrypt the HTTPS/TLS traffic and export the SSLKEYLOGFILE.Inspect the full connections payload as hexdump/text.Inspect HTTP requests and replies thanks to the built-in decoders.

Extract the SNI, DNS query, HTTP URL and the remote IP address.Log and examine the connections made by user and system apps.It does not use a remote VPN server, instead data is processed locally on the device. PCAPdroid simulates a VPN in order to capture the network traffic without root. It also allows you to export a PCAP dump of the traffic, inspect HTTP, decrypt TLS traffic and much more! PCAPdroid is a privacy-friendly open source app which lets you track, analyze and block the connections made by the other apps in your device.

Android packet capture tool