Repolode
Submit
emanuele-f

emanuele-f/PCAPdroid

No-root Android app that monitors, blocks and records app network traffic as PCAP files, with TLS decryption and HAR export.

Open-source alternative to:Charles Proxy

View on GitHubWebsite
Stars
5,109
Forks
583
Open issues
43
Last commit
5 days ago

What is it?

PCAPdroid is an Android app that tracks, analyzes and blocks the network connections made by other apps on the device. It works without root by simulating a VPN on the device, so traffic is processed locally rather than sent to a remote VPN server.

The app shows which apps connect to which hosts and IP addresses, with a per-app summary of data sent and received. It can record traffic to PCAP files with app metadata, stream packets over PCAP-over-IP to Wireshark for real-time analysis, decrypt HTTPS/TLS traffic and save an SSLKEYLOGFILE, and inspect HTTP requests and responses with HAR export. Country and ASN lookups use an offline database.

A firewall that blocks apps, domains and IP addresses, malware detection using third-party blacklists, and PCAPng output are listed as paid features. The project also exposes an API so other Android apps can drive packet capture.

Key features

  • 01Shows which apps connect to which hosts and how much data each app transfers
  • 02Records traffic to PCAP files and streams it to Wireshark over PCAP-over-IP
  • 03Decrypts HTTPS/TLS traffic and saves SSLKEYLOGFILE
  • 04Inspects HTTP requests and exports them to HAR
  • 05Looks up remote server country and ASN from an offline database

Use cases

  • Checking which trackers and background services an Android app contacts
  • Capturing app traffic on a phone for analysis in Wireshark without rooting it
  • Debugging HTTP API calls made by a mobile app during development

Quick start

  1. 1

    Install from F-Droid or Google Play

  2. 2

    Clone the repository

  3. 3

    Initialize the git submodules

    git submodule update --init
  4. 4

    Open the project in Android Studio and build the app

Things to know

  • Android only; it does not run on other platforms.
  • Building from source requires Android Studio, the NDK and CMake 3.22.1.
  • Firewall, malware detection and PCAPng export are paid features.

In collections

Privacy & local-first toolsAndroid apps & phone tools

Topics

#android#network-analysis#pcap#packet-capture#traffic-monitor#privacy#wireshark#capture-traffic#decryption#firewall

FAQ

What is PCAPdroid?
No-root Android app that monitors, blocks and records app network traffic as PCAP files, with TLS decryption and HAR export. PCAPdroid is an Android app that tracks, analyzes and blocks the network connections made by other apps on the device. It works without root by simulating a VPN on the device, so traffic is processed locally rather than sent to a remote VPN server.
Is PCAPdroid free to use? What license does it have?
PCAPdroid is open source under the GPL-3.0 license. Check the license terms before using it in commercial products.
Is PCAPdroid still maintained?
Actively maintained. The last commit to PCAPdroid was on Nov 2, 2026.
What can I use PCAPdroid for?
Checking which trackers and background services an Android app contacts Capturing app traffic on a phone for analysis in Wireshark without rooting it Debugging HTTP API calls made by a mobile app during development
How do I install PCAPdroid?
Install from F-Droid or Google Play Clone the repository Initialize the git submodules: git submodule update --init Open the project in Android Studio and build the app
Where can I get PCAPdroid?
The source code and installation instructions are on GitHub: https://github.com/emanuele-f/PCAPdroid

Summary generated by AI from the project's README. GitHub stats refresh daily.

Related projects