pcapdroid
An Android app that monitors the network connections of other apps without root, using a local VPN. It can log traffic, export PCAP files and inspect requests, with a paid firewall option.
Pick a small issue you can reproduce, then fix it with your AI coding agent.
Share on XLicense: GPL-3.0
Overview
PCAPdroid is an open-source Android app that tracks, analyzes and blocks the connections made by other apps on the device, without root. It creates a local VPN, so traffic is processed on the phone and no remote VPN server is used. It can show per-app data usage, export PCAP files with app metadata, stream traffic to Wireshark, decrypt TLS traffic, and inspect HTTP requests and export them to HAR. A firewall and malware detection are paid features.
Key features
- Logs connections of user and system apps without root
- Exports PCAP files with app information
- Streams traffic live to Wireshark using PCAP-over-IP
- Decrypts TLS traffic and saves the SSLKEYLOGFILE
- Inspects HTTP requests and exports them to HAR
Best for
Developers, analysts and privacy-minded users who want to see what their Android apps send. The firewall and malware detection are paid, and capturing beside other VPN apps needs a rooted device.
- Upstream
- emanuele-f/PCAPdroid
- Fork on GitHub
- Guo-astro/pcapdroid
- Upstream stars
- 5.1k
- Category
- Security and networking
- Language
- Java
- License
- GPL-3.0
- Forked
- 2026-09-12
- Sync status
- In syncLast synced 2026-11-09
More in Security and networking
A security research proof of concept for studying a PHP session lifecycle flaw in a specific PHP and Apache setup. It documents a controlled reproduction and an isolated environment for understanding the behavior.
Forked 2026-10-21Last synced 2026-11-09No license declaredSecurity and networkingGitHub
A ProxyPin script for rewriting Apple WLOC location responses in authorized iOS tests. It helps QA teams reproduce network-based location scenarios using selected coordinates.
Forked 2026-10-18Last synced 2026-11-09License: MITSecurity and networkingGitHub
Scripts that query crt.name Certificate Transparency records to find subdomains, with Bash and Python command-line tools for collecting results and saving them to a file.
Forked 2026-10-14Last synced 2026-11-09License: MITSecurity and networkingGitHub
A practical guide to running a personal Xray proxy on a VPS, with Hysteria2 as the main entry point and optional backup entries. Route selected AI traffic through WARP and, if needed, Claude or Anthropic through a fixed SOCKS5 exit.
Forked 2026-10-12Last synced 2026-11-09License: MITSecurity and networkingGitHub