PCAPdroid
PCAPdroid is an open-source Android app for capturing and inspecting network traffic without root privileges.
What PCAPdroid is
PCAPdroid is an open-source Android app for capturing and inspecting network traffic without root privileges. It uses Android VpnService to receive app connections and processes them locally rather than routing them through an external VPN. Its connection details include protocols, ports, addresses, status, and traffic volume. Captures can be saved as PCAP files or sent elsewhere for analysis, and the app supports offline trace analysis, display filters, command-line capture, and real-time PCAP-over-IP with tools such as Wireshark, ntopng, and tcpdump. It can decrypt HTTPS/TLS traffic for a selected app, subject to Android certificate trust limitations. The free plan includes core monitoring and capture; a one-time purchase adds a firewall, malware detection, and PCAPng format. In non-root mode, it captures only outgoing connections started by the device running the app, not traffic from other devices on the network. PCAPdroid says it collects no information and processes traffic locally.
Good
- Works without root privileges.
- Processes traffic locally without an external VPN.
- Shows connection protocol, ports, addresses, and volume.
- Supports offline trace analysis and display filters.
- Free plan includes core monitoring and capture.
Watch out
- Non-root mode captures only outgoing device connections.
- Does not capture traffic from other network devices.
- HTTPS/TLS decryption is subject to Android certificate trust limits.
- Firewall and malware detection are paid features.
Who it suits
PCAPdroid suits Android users who need to inspect traffic from apps on that device. It may also suit people who want to save captures for later analysis or send them to network-analysis tools.
Verdict
PCAPdroid provides local Android traffic capture and inspection, with exports and analysis options. Its capture scope is limited to the device running it, and some features require a one-time purchase.
Plans and prices
From PCAPdroid's own pricing page, checked 30 Sep 2026.
| Plan | Price | What it gives you |
|---|---|---|
| Free | Free | Core network monitoring and capture · paid features excluded |
| Paid Features | — | Firewall · malware detection · PCAPng format · one-time purchase |
The facts
Each one read from PCAPdroid's own pages, with the date it was checked.
What it does
- Analysis
- The app analyzes connections from user and system apps and shows protocol, ports, addresses, status and traffic volume.checked 30 Sep 2026
- Capture limit
- In non-root mode, PCAPdroid captures only outgoing connections started by the Android device.checked 30 Sep 2026
- Export
- Captured traffic can be saved as PCAP files or sent remotely for analysis such as with Wireshark.checked 30 Sep 2026
- Firewall
- The paid firewall can block individual apps, domains and IP addresses with configurable rules and allowlists.checked 30 Sep 2026
- Integrations
- PCAPdroid supports real-time PCAP-over-IP analysis with tools including Wireshark, ntopng and tcpdump.checked 30 Sep 2026
- Malware detection
- The paid malware-detection feature uses third-party blacklists and can block malicious traffic in default VPN mode.checked 30 Sep 2026
- Privacy
- PCAPdroid states that it collects no information, uses no remote VPN server and processes traffic locally.checked 30 Sep 2026
- Purpose
- PCAPdroid is an open-source network capture and monitoring tool that works without root privileges.checked 30 Sep 2026
- Support
- The project directs questions to Emanuele Faranda by email and provides Telegram and Matrix community channels.checked 30 Sep 2026
- TLS decryption
- PCAPdroid can decrypt HTTPS/TLS traffic for a specific app, subject to Android certificate trust limitations.checked 30 Sep 2026
- Traffic capture
- It uses Android VpnService to receive app traffic and processes it locally without creating an external VPN.checked 30 Sep 2026
Where it runs
- App integration
- Third-party Android apps can integrate the pcapd daemon on rooted devices or control PCAPdroid through its API on all devices.checked 30 Sep 2026
- Device scope
- PCAPdroid only captures traffic from the Android device where it is running, not other devices on the network.checked 30 Sep 2026
Alternatives to PCAPdroid
- 1
Wireshark
Free planOpen sourceAPILinuxmacOSSelf-hosted7.5Free plan - 2
Colasoft Capsa
Free planWindows7.4$295 one-time - 3
Sniffnet
Free planOpen sourceLinuxmacOSWindows7.4Free plan - 4
Arkime
Free planOpen sourceWebAPILinuxSelf-hosted7.3Free plan - 5
Avidemux
Free planOpen sourceWebLinuxmacOSWindows7.3Free plan - 6
NetworkMiner
Free planLinuxmacOSWindows6.9$1,300 one-time