Skip to content
SPECIFICTION
Get listed

PCAPdroid

pcapdroid.org

Free plan Android
Visit pcapdroid.org
Spec score 7.4 #25 of 32 in Network Packet Analyzer Software

What it is

PCAPdroid is an Android app that captures, analyzes, and can block connections made by other apps. It uses Android VpnService without root, processes traffic locally, and does not create an external VPN. Logs show user and system app connections with protocol, remote host or IP, status, and traffic volume. Captures can be saved as PCAP, served through HTTP, or sent over PCAP-over-IP for real-time analysis. For a selected app, PCAPdroid can decrypt HTTPS/TLS traffic, inspect HTTP requests and replies, and export them to HAR. The free plan includes capture, monitoring, PCAP export, TLS decryption, and HTTP inspection. Paid features include a firewall, malware detection, and PCAPng format, with no price listed. Malware detection uses third-party blacklists and is active only during capture. The app requires Android 6.0 or newer.

Spec sheet

Purpose
PCAPdroid tracks, analyzes, and can block connections made by other apps on an Android device.Read 3 Oct 2026 · github.com
Integrations
For third-party apps, PCAPdroid exposes an API to control capture and send captured packets over UDP; rooted devices can integrate the pcapd daemon into an APK.Read 3 Oct 2026 · github.com
Privacy
The privacy policy says PCAPdroid collects no information and processes captured traffic locally; optional features such as malware detection may contact third-party servers.Read 3 Oct 2026 · emanuele-f.github.io
Headquarters
Anzio, ItalyRead 28 Sep 2026 · pcapdroid.org
Maker
The app is authored and maintained by Emanuele Faranda; the opened pages did not state a founding date or headquarters.Read 3 Oct 2026 · f-droid.org
Capture method
It uses Android VpnService to capture traffic without root and processes the traffic locally without creating an external VPN.Read 3 Oct 2026 · emanuele-f.github.io
Connection analysis
It logs connections from user and system apps and reports details such as protocol, remote host or IP, status, and traffic volume.Read 3 Oct 2026 · emanuele-f.github.io
Firewall limit
The firewall feature is unavailable with root capture, and blocking an app does not prevent it from performing name resolution through Android netd.Read 3 Oct 2026 · emanuele-f.github.io
Malware detection limit
Malware detection uses third-party blacklists, is active only while capture is running, and is explicitly not described as a comprehensive device security solution.Read 3 Oct 2026 · emanuele-f.github.io
Open source components
The project lists nDPI for connection metadata, mitmproxy for TLS decryption, and zdtun for non-root capture among its open source technologies.Read 3 Oct 2026 · github.com
Packet analysis caveat
The guide says non-root capture alters L3 and L4 packet headers and packet sizes, and recommends root capture for low-level packet analysis.Read 3 Oct 2026 · emanuele-f.github.io
Platform requirement
The F-Droid listing says the app requires Android 6.0 or newer.Read 3 Oct 2026 · f-droid.org
Support and community
The project lists a support email and invites users to join its Telegram or Matrix community.Read 3 Oct 2026 · play.google.com
TLS and HTTP
It can decrypt HTTPS/TLS traffic for a specific app, inspect HTTP requests and replies, and export them to HAR.Read 3 Oct 2026 · github.com
Traffic export
It can save traffic to PCAP files or serve captures through an HTTP server, and supports PCAP-over-IP for real-time analysis such as with Wireshark.Read 3 Oct 2026 · emanuele-f.github.io

Plans and prices

Free app Free Network capture, monitoring, PCAP export, TLS decryption, HTTP inspection · Android app Read 3 Oct 2026 · github.com
Paid features Price not published Firewall · malware detection · PCAPng format · Purchase through Google Play; price not stated on the pages opened Read 3 Oct 2026 · emanuele-f.github.io

Every PCAPdroid plan and price →

Strong points and limits

Strong points

  • Free plan includes capture and monitoring
  • Captures traffic without root using Android VpnService
  • Exports PCAP files and supports PCAP-over-IP
  • Decrypts TLS and inspects HTTP for an app
  • Provides protocol, host, status, and volume details

Limits

  • Android 6.0 or newer is required
  • Paid firewall, malware detection, and PCAPng have no listed price
  • Non-root capture alters packet headers and sizes
  • Firewall is unavailable with root capture

Who it suits

It suits Android users who need local traffic capture, connection inspection, or exports for analysis. It also supports developers and analysts integrating capture through its API or PCAP-over-IP.

Verdict

PCAPdroid provides local Android traffic visibility with capture, decryption, inspection, and export tools. Analysts should account for altered non-root packets, the firewall restriction with root capture, and the limited scope of malware detection.

Where Specifiction places it

Alternatives to PCAPdroidAll alternatives →