Skip to content
SPECIFICTION
Get listed

PCAPdroid

emanuele-f.github.io

Free plan Android
Visit emanuele-f.github.io
Spec score 7.2 #18 of 22 in Network Packet Capture Software

What it is

PCAPdroid is an open-source Android network capture and monitoring tool that works without root privileges. It uses Android VpnService to receive app traffic, then processes it locally without creating an external VPN. Its connection view shows protocol, ports, addresses, status and traffic volume. Captures can be saved as PCAP files or sent remotely for analysis, and the app supports offline trace analysis, display filters and command-line capture. It can decrypt HTTPS/TLS traffic for a specific app, subject to Android certificate trust limitations. The free plan covers core monitoring and capture; paid features add a firewall for blocking apps, domains and IP addresses with configurable rules and allowlists, as well as malware detection using third-party blacklists and PCAPng format. PCAPdroid supports real-time PCAP-over-IP analysis with tools such as Wireshark, ntopng and tcpdump. In non-root mode it captures only outgoing connections started by the device running it, not traffic from other devices on the network. The project says it collects no information and processes traffic locally.

Spec sheet

Purpose
PCAPdroid is an open-source network capture and monitoring tool that works without root privileges.Read 30 Sep 2026 · emanuele-f.github.io
Integrations
PCAPdroid supports real-time PCAP-over-IP analysis with tools including Wireshark, ntopng and tcpdump.Read 30 Sep 2026 · emanuele-f.github.io
Privacy
PCAPdroid states that it collects no information, uses no remote VPN server and processes traffic locally.Read 30 Sep 2026 · emanuele-f.github.io
Support
The project directs questions to Emanuele Faranda by email and provides Telegram and Matrix community channels.Read 30 Sep 2026 · emanuele-f.github.io
Analysis
The app analyzes connections from user and system apps and shows protocol, ports, addresses, status and traffic volume.Read 30 Sep 2026 · emanuele-f.github.io
App integration
Third-party Android apps can integrate the pcapd daemon on rooted devices or control PCAPdroid through its API on all devices.Read 30 Sep 2026 · github.com
Capture limit
In non-root mode, PCAPdroid captures only outgoing connections started by the Android device.Read 30 Sep 2026 · emanuele-f.github.io
Device scope
PCAPdroid only captures traffic from the Android device where it is running, not other devices on the network.Read 30 Sep 2026 · emanuele-f.github.io
Export
Captured traffic can be saved as PCAP files or sent remotely for analysis such as with Wireshark.Read 30 Sep 2026 · emanuele-f.github.io
Firewall
The paid firewall can block individual apps, domains and IP addresses with configurable rules and allowlists.Read 30 Sep 2026 · emanuele-f.github.io
Malware detection
The paid malware-detection feature uses third-party blacklists and can block malicious traffic in default VPN mode.Read 30 Sep 2026 · emanuele-f.github.io
TLS decryption
PCAPdroid can decrypt HTTPS/TLS traffic for a specific app, subject to Android certificate trust limitations.Read 30 Sep 2026 · emanuele-f.github.io
Traffic capture
It uses Android VpnService to receive app traffic and processes it locally without creating an external VPN.Read 30 Sep 2026 · emanuele-f.github.io

Plans and prices

Free Free Core network monitoring and capture · paid features excluded Read 30 Sep 2026 · emanuele-f.github.io
Paid Features Price not published one-time purchase Firewall · malware detection · PCAPng format Read 30 Sep 2026 · emanuele-f.github.io

Every PCAPdroid plan and price →

Strong points and limits

Strong points

  • Core monitoring and capture are free
  • Processes traffic locally without an external VPN
  • Exports captures as PCAP files
  • Supports real-time analysis with Wireshark, ntopng and tcpdump
  • Includes offline trace analysis and display filters

Limits

  • Non-root mode captures only outgoing device connections
  • Does not capture traffic from other network devices
  • TLS decryption is subject to Android certificate trust limits
  • Firewall and malware detection are paid features

Who it suits

It suits Android users who want to inspect and capture traffic from the device itself without root access. Users needing firewall controls or malware detection can consider the paid features.

Verdict

PCAPdroid provides local traffic capture and analysis on Android, with export and live-analysis options. Its non-root scope is limited to outgoing connections from the device itself, while firewall and malware-detection features require paid access.

Where Specifiction places it

Alternatives to PCAPdroidAll alternatives →