pcapdroid
An Android app that monitors the network connections of other apps without root, using a local VPN. It can log traffic, export PCAP files and inspect requests, with a paid firewall option.
Pick a small issue you can reproduce, then fix it with your AI coding agent.
Share on XLicense: GPL-3.0
Overview
PCAPdroid is an open-source Android app that tracks, analyzes and blocks the connections made by other apps on the device, without root. It creates a local VPN, so traffic is processed on the phone and no remote VPN server is used. It can show per-app data usage, export PCAP files with app metadata, stream traffic to Wireshark, decrypt TLS traffic, and inspect HTTP requests and export them to HAR. A firewall and malware detection are paid features.
Key features
- Logs connections of user and system apps without root
- Exports PCAP files with app information
- Streams traffic live to Wireshark using PCAP-over-IP
- Decrypts TLS traffic and saves the SSLKEYLOGFILE
- Inspects HTTP requests and exports them to HAR
Best for
Developers, analysts and privacy-minded users who want to see what their Android apps send. The firewall and malware detection are paid, and capturing beside other VPN apps needs a rooted device.
- Upstream
- emanuele-f/PCAPdroid
- Fork on GitHub
- Guo-astro/pcapdroid
- Upstream stars
- 4.9k
- Category
- Security and networking
- Language
- Java
- License
- GPL-3.0
- Forked
- 2026-09-12
- Sync status
- In syncLast synced 2026-10-19
More in Security and networking
A ProxyPin script for rewriting Apple WLOC location responses in authorized iOS tests. It helps QA teams reproduce network-based location scenarios using selected coordinates.
Forked 2026-10-18Last synced 2026-10-19License: MITSecurity and networkingGitHub
Scripts that query crt.name Certificate Transparency records to find subdomains, with Bash and Python command-line tools for collecting results and saving them to a file.
Forked 2026-10-14Last synced 2026-10-19License: MITSecurity and networkingGitHub
A practical guide to running a personal Xray proxy on a VPS, with Hysteria2 as the main entry point and optional backup entries. Route selected AI traffic through WARP and, if needed, Claude or Anthropic through a fixed SOCKS5 exit.
Forked 2026-10-12Last synced 2026-10-19License: MITSecurity and networkingGitHub
Clearcam adds object detection, tracking, event search, and notifications to security camera feeds. Run its Python NVR locally and optionally use the iOS app for remote viewing and alerts.
Forked 2026-10-12Last synced 2026-10-19License: GPL-3.0Security and networkingGitHub