emanuele-f/PCAPdroid

PCAPdroid is an open-source Android app for seeing what other apps on a phone connect to. It logs connections, summarizes per-app data usage, extracts hosts from DNS/TLS/HTTP, and can write traffic to PCAP files or stream it to a remote analyzer. The practical fit is on-device network inspection and packet capture for analysis or security review on a phone that is not rooted.

How capture works

The app runs a local VPN on the device to route traffic through its own capture path; no remote VPN server is involved and data is processed locally (README). Non-root capture relies on a minimal TCP/IP stack (zdtun), while connection metadata comes from nDPI deep packet inspection (tech stack). Coverage is for traffic from user and system apps on the device. A rooted device adds one specific capability: capturing while other VPN apps are running (feature list).

What you can do with the traffic

• Live connection log with per-app sent/received summaries, intended to run all day with low battery impact.
• Extract hosts and IPs from DNS, TLS and HTTP; inspect HTTP requests and replies and export them as HAR.
• Record to PCAP with app metadata, or send via PCAP-over-IP for analysis in Wireshark; identify remote server country and ASN from offline databases.
• Decrypt HTTPS/TLS traffic and save an SSLKEYLOGFILE for later analysis.

The README points packet analysts to a dedicated part of the manual before starting (packet analysis guide). Installation options include F-Droid and Google Play, plus a beta F-Droid repository for pre-release features (download options).

Paid features and licence

Firewall rules that block individual apps, domains or IPs, malware detection using third-party blacklists, and PCAPng export are listed as paid features (paid features, malware detection, PCAPng). The project is GPL-3.0; per the repository metadata, redistributing modified builds carries the usual copyleft obligations.

Requirements and limits

This is an Android application, not a desktop tool; the capture mechanism is the Android VPN service, so it competes with any other active VPN unless the device is rooted. TLS decryption is proxy-based (a local mitmproxy), so it applies only to traffic that can be made to go through that proxy path rather than being a universal decryptor. The README does not document specific Android version minimums, traffic-handling failures, or rollback consequences in the supplied excerpt; check the user guide for the current supported range. One 2021 HN commenter reported that after Wi-Fi disconnects while capture keeps running, DNS settings were ignored in favor of a default resolver — an old observation that may no longer apply (HN comment).

HotRepo's take

The repository has been on the daily board once in the supplied sample (2026-10-31, 5,024 stars, +7 that day), so the recorded history is too thin to describe a trend. Popularity does not by itself establish fitness for a given device or Android version.