PCAPdroid

PCAPdroid is an Android app that tracks, analyzes, and can block connections made by other apps. It uses Android VpnService to capture traffic without root, processes captures locally, and does not create an external VPN. Connection logs show activity from user and system apps, including protocol, remote host or IP, status, and traffic volume. Captures can be saved as PCAP files, served through an HTTP server, or sent with PCAP-over-IP for real-time analysis such as Wireshark. For a selected app, PCAPdroid can decrypt HTTPS/TLS traffic, inspect HTTP requests and replies, and export them to HAR. The free app includes network capture, monitoring, PCAP export, TLS decryption, and HTTP inspection. Paid features include a firewall, malware detection, and PCAPng format, with no price stated. Malware detection uses third-party blacklists and runs only during capture. Android 6.0 or newer is required.

PCAPdroid provides broad capture and inspection tools on Android, including PCAP export and app-specific TLS analysis. Readers needing low-level packet analysis should note the documented non-root capture changes.

PCAPdroid suits Android users who need local traffic capture, connection details, or exports for analysis. It can also help inspect app-specific HTTPS and HTTP activity.

PCAPdroid captures, inspects, and can block traffic from apps on Android without requiring root. It is best for people who need to diagnose app connections on a phone; for low-level packet analysis, its non-root capture has important limits.

Overview

PCAPdroid uses Android’s VpnService to capture traffic locally rather than routing it through an external VPN. It records connections from user and system apps, with details including protocol, remote host or IP, status, and traffic volume. That makes it useful for seeing which apps are communicating and where, without moving capture data off the device by default.

Capture can be saved as PCAP, served over HTTP, or streamed over PCAP-over-IP for real-time analysis with tools such as Wireshark. The trade-off is that non-root capture changes L3 and L4 headers and packet sizes. That is a meaningful constraint for packet-level diagnostics; the guide recommends root capture when those details matter.

Key features

App traffic inspection

Connection logs give a practical view of app network activity, while PCAP and PCAPNG support and protocol dissectors suit users who need to take captures into further analysis. PCAPdroid also offers an API for third-party apps to control capture and send packets over UDP. On rooted devices, developers can integrate the pcapd daemon into an APK.

TLS and HTTP inspection

PCAPdroid can decrypt HTTPS/TLS traffic for a specific app, inspect HTTP requests and replies, and export them as HAR. That is useful for troubleshooting an app’s web requests, but the decryption scope is specific to an app rather than a blanket view of all encrypted traffic.

Blocking and malware detection

The firewall can block apps, but it is unavailable when using root capture, and blocking does not stop an app from resolving names through Android netd. Malware detection relies on third-party blacklists, runs only while capture is active, and is not a comprehensive device security solution. These are useful adjuncts to traffic inspection, not substitutes for a dedicated security product.

Privacy and underlying technology

The privacy policy says the app collects no information and processes captured traffic locally. Optional features such as malware detection may contact third-party servers, so users who enable them should account for that. The project identifies nDPI for connection metadata, mitmproxy for TLS decryption, and zdtun for non-root capture among its open-source components.

Pricing

The Free app plan costs nothing and includes network capture, monitoring, PCAP export, TLS decryption, and HTTP inspection on Android. It covers the core workflow without a stated quota or trial term.

Paid features have custom pricing: the pages opened do not state a price. This tier adds firewall, malware detection, and PCAPng format, with purchase through Google Play. Since the free plan already includes capture and inspection, it is the natural starting point; pay only if those additional features are worth their separately stated purchase cost to you.

Platforms

PCAPdroid is an Android app and requires Android 6.0 or newer. Root is not required for capture, though root capture is recommended for low-level packet analysis and removes access to the firewall feature.

Who it's for

Choose PCAPdroid if you want to identify app connections on an Android device, capture traffic for later analysis, or inspect a particular app’s TLS and HTTP activity. It also suits developers who want an API-controlled capture workflow. Look elsewhere if you need unaltered packet headers without root, or if you want malware detection to serve as full-device protection.

Pros and cons

• Pro: Captures locally without root or an external VPN, which makes app-level monitoring practical on Android.
• Pro: PCAP export, live PCAP-over-IP, app-specific TLS decryption, and HAR export support several troubleshooting workflows.
• Pro: The free plan includes the central capture and inspection features.
• Con: Non-root capture alters packet headers and sizes, limiting low-level analysis.
• Con: The firewall is unavailable with root capture and does not prevent Android netd name resolution.
• Con: Malware detection depends on third-party blacklists, runs only during capture, and is not comprehensive security protection.

Alternatives

For a broader comparison, browse our Network Packet Analyzer Software list.

• termshark is a free option for readers who want a MIT-licensed tool across Android, Linux, macOS, and Windows; it requires tshark 1.10.2 or higher.
• A-Packets is worth considering for API, self-hosted, or web workflows; its free public analysis accepts uploads up to 25 MB, and result pages are public.
• PacketSafari is an alternative for readers seeking a tool across API, desktop, self-hosted, and web platforms.
• PacketSnitch is an alternative for Linux, macOS, or Windows users.
• Scapy is a free, GPLv2-licensed option for Python 3.7+ users who need support across API, Linux, macOS, self-hosted, web, and Windows environments.
• BruteShark is a free alternative for Linux or Windows, with a Windows GUI and Windows/Linux CLI; it requires packet capture drivers.
• Colasoft Capsa is a Windows option, though its free plan limits monitoring to 10 IP addresses, times out sessions after four hours, and excludes WiFi monitoring.
• NETCAP is an alternative for Linux, macOS, self-hosted, web, or Windows use, with a free open-source CLI and community support.

Verdict

PCAPdroid is a strong choice for Android users who need local app-traffic capture, useful connection details, and export or app-specific inspection without rooting their device. Its main reason to choose another tool is equally clear: non-root capture alters packet headers and sizes, so users doing low-level packet analysis should use root capture or a different workflow.