Do I need root to capture Android traffic?

No. PCAPdroid records without root through Android's VPN interface. Root adds a capture of the real packets on the network interface, which matters when timing, packet sizes or TCP behaviour are the question.

Can I see what an app sends over HTTPS?

Not from the capture alone. A-Packets shows the server names, TLS versions and certificates of encrypted sessions, not their payloads. PCAPdroid can decrypt the TLS traffic of a chosen app with its own setup, which this guide does not cover.

Why does a PCAPdroid capture hold only connections the phone opened?

Without root, Android routes only the phone's outgoing connections into the VPN interface PCAPdroid listens on. Connections that other devices open to the phone stay out of the file; a root or upstream capture includes them.

Android

Capture Android traffic to a PCAP file

Updated 2026-11-06 · Every command run or checked against its tool's documentation

Upload PCAP All capture guides

Free uploads create public reports. Use only sanitized captures; choose private analysis for sensitive traffic.

An app talks to a domain nobody recognizes, a phone drains its data plan overnight, or a mobile client fails only on one Wi-Fi network. To answer any of these you need to capture Android traffic into a file, and Android gives ordinary apps no way to record raw packets. There are three practical routes: PCAPdroid without root, PCAPdroid's root capture, or a capture upstream of the phone on the network it uses. They produce different files, and the difference decides which questions the capture can settle.

A-Packets DNS view listing the queries of a capture by client and server — The DNS view of a public sample capture (dns-tunnel-iodine.pcap) lists every query by client and server. A phone's capture fills the same table with the names its apps look up, often the quickest map of who an app talks to.

Without root: PCAPdroid in VPN mode

PCAPdroid is an open-source capture app that works without root. It uses Android's VpnService to receive the traffic of the apps on the device; no outside VPN server is involved, and the traffic is processed on the phone. On the first start Android asks you to accept the VPN connection, and a key icon stays in the notification bar while the capture runs. To get a file, choose the PCAP File dump mode: PCAPdroid asks where to save it when you press start, and when you stop it offers to share, keep or delete the file. Keep the plain PCAP format and leave the PCAPdroid extensions option off. A-Packets reads the plain file, raw IP packets with no Ethernet header, and the extensions only add the app name and UID for tools that know how to read them. IPv6 capture is off by default in the VPN settings; switch it on if the network gives the phone IPv6.

What a VPN-mode capture can and cannot prove

To capture through VpnService, PCAPdroid has to relay every connection itself, and its documentation is plain about the cost. Packets coming from the internet carry synthetic IP and TCP or UDP headers: only the destination address and port match the real connection, and packet sizes differ from what crossed the air. Only connections the phone opens are captured. The application data is untouched, so the evidence that holds is above the transport layer: the DNS names an app resolves, the server names and certificates of its TLS sessions, and the full content of any cleartext HTTP. Questions about round-trip times, retransmissions or window sizes need one of the next two routes.

With root: PCAPdroid's root capture

On a rooted phone PCAPdroid can record from the network interface itself, without the VPN, and its documentation describes the result as an almost one-to-one view of the device's traffic. The packets are the real ones, so TCP timing and sizes can be trusted, and the capture can run while another VPN app is active. PCAPdroid strips the Ethernet header in this mode as well, which keeps the file in the same raw IP format whatever the interface, and A-Packets reads it the same way. If the rooted phone has a tcpdump binary instead, the commands in the tcpdump to a PCAP file guide apply on the phone; copy the file off it with adb pull.

Upstream: capture the phone on the network

The phone does not have to record anything if something on its path does. Share a laptop's connection as a hotspot and run tcpdump on the hotspot interface, capture on a router that can run tcpdump, or mirror the switch port of the access point. This route sees the real packets with their layer-2 headers and needs no app on the phone, which matters when the device belongs to someone else or the app detects a VPN. It sees only traffic that crosses that network, though: switch the phone to Wi-Fi only, because on mobile data it bypasses your capture entirely. Filter on the phone's address, which the router's lease table shows, to keep other devices out.

Read the capture in A-Packets

Upload the file like any other capture; public analysis takes up to 25 MB. Start with DNS, where the names an app resolves are the clearest sign of what it contacts, then SSL/TLS for the server names, protocol versions and, on TLS 1.2 and older, the certificates. Connections ranks the peers by bytes, which answers the data-plan question directly. The plain PCAP has no app names, so match connections to apps by domain and by when you used each app. A phone's capture can carry account names, locations sent to APIs and session tokens, so read how to sanitize a PCAP before a public upload, or analyze it in a private report.

Android capture questions

Do I need root to capture Android traffic?: No. PCAPdroid records without root through Android's VPN interface. Root adds a capture of the real packets on the network interface, which matters when timing, packet sizes or TCP behaviour are the question.
Can I see what an app sends over HTTPS?: Not from the capture alone. A-Packets shows the server names, TLS versions and certificates of encrypted sessions, not their payloads. PCAPdroid can decrypt the TLS traffic of a chosen app with its own setup, which this guide does not cover.
Why does a PCAPdroid capture hold only connections the phone opened?: Without root, Android routes only the phone's outgoing connections into the VPN interface PCAPdroid listens on. Connections that other devices open to the phone stay out of the file; a root or upstream capture includes them.