PCAPdroid review
A focused, rootless Android traffic analyzer with useful export and filtering tools.
Reviewed by iTechGuides Editors · Editorial team · Updated Oct 2026
PCAPdroid is an open-source Android application for capturing, monitoring, and analyzing network connections made by apps on a device. It is aimed at Android users, developers, security practitioners, and researchers who need local visibility into user and system app traffic. The app captures without root access by using Android VPN functionality, then records traffic to PCAP files. It also supports PCAPNG captures with additional metadata and can stream traffic through PCAP-over-IP for real-time analysis.
Its main strength is the amount of app-level control in a mobile-focused tool. Connections can be filtered by app, IP address, host, protocol, or UID, making it easier to isolate traffic from a particular application or service. PCAPdroid can inspect HTTP requests and replies, export HTTP traffic to HAR, and decrypt selected HTTPS/TLS traffic. Firewall rules extend the analysis workflow into traffic control, with rules for apps, domains, and IP addresses. Malware detection using third-party blacklists adds another review layer, while Wireshark integration supports further PCAP analysis.
PCAPdroid follows a freemium model with a free plan, and some advanced features are sold separately. Its narrow Android focus is an advantage for device-level app traffic analysis but limits its usefulness for broader network-analysis work across operating systems. Choose it when rootless Android capture, app filtering, PCAP export, and local inspection are the priority. Consider an alternative when the requirement is general-purpose, multi-platform packet analysis rather than focused Android visibility.
PCAPdroid pros and cons
- Where it wins
- Captures app traffic without root access
- Exports PCAP, PCAPNG, and HTTP traffic to HAR
- Filters traffic and applies app, domain, and IP firewall rules
- Where it doesn't
- Focused on Android rather than broad multi-platform analysis
- HTTPS/TLS decryption is limited to selected traffic
- Some advanced features are sold separately
PCAPdroid fact sheet, pricing and score →
Advertiser disclosure: iTechGuides is reader-supported. Vendors can pay for top positions in our rankings and for a place on other products' pages, and we may earn a commission when you click some links. Bought places stand at the number bought; this page and our disclosure say so. Paying vendors may get a fuller, more detailed review from our editors, and that review can change their score. How we rank.
Last updated · How we research and update