PCAPdroid is a no-root network monitor and packet capture tool for Android that allows users to track, analyze, and block app connections without requiring device root access.
The tool solves the problem of monitoring network traffic on Android by simulating a VPN interface to intercept packets locally on the device, avoiding the need for root privileges or remote VPN servers. It captures traffic from both user and system applications, logging connection details and data usage per app. The captured data can be exported as PCAP files with app metadata, analyzed in real time via PCAP-over-IP streaming to tools like Wireshark, or inspected directly within the app. The tool can decrypt HTTPS and TLS traffic to extract URLs and SSL key logs, inspect individual HTTP requests and responses, and perform offline geolocation and ASN lookups on remote servers.
PCAPdroid suits developers, security researchers, and privacy-conscious users who need to audit app behavior on their own devices. It is particularly valuable for analyzing network activity without modifying system configuration or installing a separate VPN service. The free version provides comprehensive traffic logging, PCAP export, TLS decryption, and HTTP inspection. Paid features add firewall capabilities to block specific apps, domains, or IP addresses; malware detection using third-party blacklists; and PCAPng format support for easier analysis of decrypted traffic. On rooted devices, the tool can capture traffic while other VPN applications are simultaneously active.
The project maintains active community engagement through translation contributions on a dedicated platform and accepts sponsorships to support ongoing development. Documentation is comprehensive, with a quick start guide and full user manual available on the project website. The tool is distributed through both F-Droid and Google Play, with a beta repository available for testing unreleased features.
