PCAPdroid

PCAPdroid is an open-source Android app for capturing and monitoring network traffic without root privileges. It uses Android VpnService to receive traffic from apps, then processes it locally without an external VPN server. Its connection view shows protocol, ports, addresses, status, and traffic volume. Captures can be saved as PCAP files or sent for remote analysis, and the app supports real-time PCAP-over-IP work with Wireshark, ntopng, and tcpdump. It can decrypt HTTPS/TLS traffic for a selected app, subject to Android certificate trust limitations. The free plan at no cost covers core monitoring and capture. A one-time purchase adds firewall features for blocking apps, domains, and IP addresses, malware detection using third-party blacklists, and PCAPng format. In non-root mode, it captures only outgoing connections started by the Android device running the app, not traffic from other devices on the network. Offline trace analysis, display filters, and command-line capture are also listed.

PCAPdroid provides local traffic monitoring and capture on Android, with export and analysis options. Its capture scope is limited to the device running it, and some features require a one-time purchase.

PCAPdroid suits Android users who want to inspect traffic from the device itself, or analyze captures with network tools.

Overview

PCAPdroid is an Android app for monitoring and capturing network traffic without root access. It best suits Android users who need to inspect connections from one device or export traces for further analysis. Its local capture is useful for mobile troubleshooting, while its device-only reach makes it unsuitable for monitoring a wider network.

Key features

PCAPdroid uses Android’s VpnService to receive traffic and process it on the device, without sending it through an external VPN. It shows connection protocols, ports, addresses, status and traffic volume for user and system apps. That makes it a practical way to see what apps are connecting and how much traffic they use, without first rooting the phone.

Live capture, offline trace analysis, display filters and command-line capture support different stages of packet inspection. Captures can be saved in PCAP format or sent remotely for analysis. Real-time PCAP-over-IP integrations include Wireshark, ntopng and tcpdump, so the app can feed traces into established tools instead of keeping analysis on the phone.

PCAPdroid can decrypt HTTPS/TLS traffic for a selected app, but Android’s certificate trust limitations restrict what that reveals. Treat it as a targeted inspection option, not a way to read all encrypted traffic.

Paid features add configurable firewall rules to block apps, domains and IP addresses, with allowlists, and malware detection based on third-party blacklists. In default VPN mode, malware detection can also block malicious traffic. These additions make the paid option more useful for users who want active controls as well as visibility.

The project says it collects no information and processes traffic locally without a remote VPN server. Rooted-device apps can integrate its pcapd daemon; apps on any device can control PCAPdroid through its API.

Pricing

The Free plan costs nothing and includes core network monitoring and capture. It is the sensible starting point for users who need connection details, capture and analysis without firewall or malware-detection features.

Paid Features are available as a one-time purchase, with custom pricing. This adds firewall, malware detection and PCAPng format. The purchase suits users who need those capabilities; the free plan gives up those paid controls and the PCAPng format. No subscription renewal is involved.

Platforms

PCAPdroid runs on Android. In non-root mode, it captures only outgoing connections initiated by the device running the app. It cannot monitor other devices on the same network, so network-wide visibility calls for a different tool.

Who it's for

Choose PCAPdroid if you want to inspect traffic from Android apps locally, save a capture, or pass live traffic to a desktop or network-analysis tool. It also fits users who want per-app, domain or IP blocking on Android and are willing to buy the paid features.

Look elsewhere if you need to capture traffic from other devices, or if your analysis workflow must run on a platform other than Android. For questions, the project directs users to Emanuele Faranda by email and to its Telegram and Matrix community channels.

Pros and cons

Pros

• Core capture works without root and processes traffic locally, avoiding an external VPN server.
• PCAP export and real-time integrations with Wireshark, ntopng and tcpdump extend analysis beyond the phone.
• The paid firewall can apply configurable blocks to apps, domains and IP addresses, with allowlists.
• Live capture, offline analysis, display filters and command-line capture cover several inspection workflows.

Cons

• Non-root capture is limited to outgoing connections started by the Android device.
• It sees only the device where it runs, not other devices on the network.
• TLS decryption is constrained by Android certificate trust limitations.
• Firewall, malware detection and PCAPng require a one-time purchase with custom pricing.

Alternatives

For a broader comparison, see Network Packet Capture Software.

• Termshark is a free option for Android, Linux, macOS and Windows, but requires tshark v1.10.2 or newer in PATH and does not expose every tshark feature.
• Airtool Pi is a paid option for iPhone, iPad and macOS, priced at $14.99, paid once.
• Colasoft Capsa offers a Windows free plan that monitors 10 IP addresses and ends sessions after four hours; it also has a free trial.
• Malcolm is a free, self-hosted option for Linux, macOS, Windows, web and API environments, under Apache License 2.0.
• netsniff-ng is a free, open-source Linux toolkit under GNU GPL 2.0.
• NetworkMiner is a free, open-source option for Linux, macOS and Windows, with source code released under GPLv2.
• Sniffnet is a fully free, open-source option for Linux, macOS and Windows, under MIT or Apache-2.0.
• Arkime is a free, open-source option for Linux, self-hosted, web and API environments, with no paid-only features or license fees.

Verdict

PCAPdroid is a strong fit for Android users who want local visibility into app connections and a path from phone capture to deeper analysis. Its free core covers monitoring and capture, while the one-time paid features add useful blocking and malware detection. Choose another tool if you need to observe traffic beyond the Android device itself.