PCAPdroid
PCAPdroid is an Android app for capturing, analyzing, and blocking connections made by other apps.
What PCAPdroid is
PCAPdroid is an Android app for capturing, analyzing, and blocking connections made by other apps. It uses Android VpnService to capture traffic without root, processes captures locally, and does not create an external VPN. Connection logs show activity from user and system apps, including protocol, remote host or IP, status, and traffic volume. Captures can be saved as PCAP files, served through HTTP, or sent through PCAP-over-IP for real-time analysis. For a selected app, PCAPdroid can decrypt HTTPS/TLS traffic, inspect HTTP requests and replies, and export them to HAR. The free app includes network capture, monitoring, PCAP export, TLS decryption, and HTTP inspection. The app requires Android 6.0 or newer and is maintained by Emanuele Faranda.
Good
- Captures traffic without root
- Processes captures locally
- Exports PCAP and HAR files
- Supports TLS decryption
- Free core app
Watch out
- Android 6.0 or newer required
- Malware detection is not comprehensive security
- Non-root capture alters packet headers
Who it suits
It suits Android users who need local network capture, connection monitoring, traffic export, or app-specific inspection. It also fits users analyzing captures with external tools such as Wireshark.
Verdict
PCAPdroid offers substantial capture and inspection tools in its free Android app, with additional paid features. Users doing low-level packet analysis should note the non-root capture limitations and firewall restrictions.
Plans and prices
From PCAPdroid's own pricing page, checked 3 Oct 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Free app | Free | Network capture, monitoring, PCAP export, TLS decryption, HTTP inspection · Android app |
| Paid features | — | Firewall · malware detection · PCAPng format · Purchase through Google Play; price not stated on the pages opened |
The facts
Each one read from PCAPdroid's own pages, with the date it was checked.
What it does
- Capture method
- It uses Android VpnService to capture traffic without root and processes the traffic locally without creating an external VPN.checked 3 Oct 2026
- Connection analysis
- It logs connections from user and system apps and reports details such as protocol, remote host or IP, status, and traffic volume.checked 3 Oct 2026
- Firewall limit
- The firewall feature is unavailable with root capture, and blocking an app does not prevent it from performing name resolution through Android netd.checked 3 Oct 2026
- Integrations
- For third-party apps, PCAPdroid exposes an API to control capture and send captured packets over UDP; rooted devices can integrate the pcapd daemon into an APK.checked 3 Oct 2026
- Malware detection limit
- Malware detection uses third-party blacklists, is active only while capture is running, and is explicitly not described as a comprehensive device security solution.checked 3 Oct 2026
- Open source components
- The project lists nDPI for connection metadata, mitmproxy for TLS decryption, and zdtun for non-root capture among its open source technologies.checked 3 Oct 2026
- Packet analysis caveat
- The guide says non-root capture alters L3 and L4 packet headers and packet sizes, and recommends root capture for low-level packet analysis.checked 3 Oct 2026
- Privacy
- The privacy policy says PCAPdroid collects no information and processes captured traffic locally; optional features such as malware detection may contact third-party servers.checked 3 Oct 2026
- Purpose
- PCAPdroid tracks, analyzes, and can block connections made by other apps on an Android device.checked 3 Oct 2026
- Support and community
- The project lists a support email and invites users to join its Telegram or Matrix community.checked 3 Oct 2026
- TLS and HTTP
- It can decrypt HTTPS/TLS traffic for a specific app, inspect HTTP requests and replies, and export them to HAR.checked 3 Oct 2026
- Traffic export
- It can save traffic to PCAP files or serve captures through an HTTP server, and supports PCAP-over-IP for real-time analysis such as with Wireshark.checked 3 Oct 2026
The company
- Headquarters
- Anzio, Italychecked 28 Sep 2026
- Maker
- The app is authored and maintained by Emanuele Faranda; the opened pages did not state a founding date or headquarters.checked 3 Oct 2026
Where it runs
- Platform requirement
- The F-Droid listing says the app requires Android 6.0 or newer.checked 3 Oct 2026
Alternatives to PCAPdroid
- 1
NETCAP
Free planOpen sourceWebAPILinuxmacOS8.1From €49 a month - 2
PacketSafari
Free planOpen sourceWebAPILinuxmacOS7.6Free plan - 3
A-Packets
Free planWebAPILinuxSelf-hosted7.5From $99 a year - 4
Wireshark
Free planOpen sourceAPILinuxmacOSSelf-hosted7.5Free plan - 5
Colasoft Capsa
Free planWindows7.4$295 one-time - 6
PcapAI
Open sourceWebAPILinuxmacOS7.4From $114 a year