You notice your phone is sending data in the background and want to know which app is behind it. PCAPdroid logs the connections of user and system apps, shows hosts and IP addresses, and can save the traffic to a PCAP file. It is free, has no ads, and the version listed here is 2.0.2, updated on September 22, 2026.
Emanuele Faranda's GPL project on GitHub
PCAPdroid was created by Emanuele Faranda and first released on February 3, 2021. Its source code is public on GitHub under the GPL-3.0-or-later licence, and the developer also runs a project website.
It is tagged as open-source and ad-free, with a focus on network analysis and security.
Capture without root, with a local VPN trick
The app simulates a VPN to capture traffic, so no root is needed. It does not use a remote VPN server, and data is processed locally on the device. On rooted devices it can also capture while other VPN apps are running.
Inside, it keeps a log of connections and a summary of how much data each app sent and received. Hosts and IP addresses are extracted from DNS, TLS and HTTP, and an offline database lookup identifies the country and ASN of the remote server. The developer states that battery usage is low enough for continuous, all-day capture.
PCAP files, Wireshark streaming and TLS decryption
For deeper analysis, PCAPdroid records traffic to PCAP files with additional app metadata. It can also send traffic over PCAP-over-IP for real-time analysis, for example in Wireshark. The manual has a dedicated packet analysis section for this.
The app can decrypt HTTPS/TLS traffic, extract URLs and save the SSLKEYLOGFILE. It also inspects HTTP requests and replies and exports them to HAR. It works as a firewall as well, able to block connections made by other apps.
Android 6.0 or newer and a 16.7 MB download
PCAPdroid needs Android 6.0 or later. The APK is 16.7 MB, and the package ID is com.emanuelef.remote_capture.
The file is the unmodified APK, and its SHA-256 checksum is e03f79082278b3754b4954c7537e7c9f7681e5995a44e70aa1589eca10190066, so you can compare it against your download.
PCAPdroid pros and cons
Pros
- Works without root by simulating a local VPN
- No ads and no price, with GPL-3.0-or-later source on GitHub
- Exports PCAP, HAR and SSLKEYLOGFILE data for analysis tools
- Streams traffic to Wireshark through PCAP-over-IP
- Shows per-app data totals and offline country and ASN lookups
Cons
- Needs Android 6.0 or newer
- Packet analysis and TLS decryption call for some technical knowledge, and the manual covers them
- Capturing alongside other VPN apps requires a rooted device
- No Google Play rating or install count is available
Is PCAPdroid safe?
The APK's SHA-256 checksum is e03f79082278b3754b4954c7537e7c9f7681e5995a44e70aa1589eca10190066, which you can compare with your download. The code is open source under GPL-3.0-or-later and published on GitHub. According to the developer, PCAPdroid simulates a VPN to capture traffic without root, and the data is processed locally on the device instead of going to a remote VPN server.
How to install PCAPdroid
- Download the APK with the button on this page and wait for it to finish.
- Compare the file with the SHA-256 checksum shown here if you want to confirm it arrived intact.
- Open the file on your phone and allow installs from this source when Android asks.
- Finish the install, then open PCAPdroid from your app drawer.
