Monitor network activity in Android Phones

Question

I would like to monitor network traffic of my Android Phone. I was thinking using tcpdump for Android, but I'm not sure if I have to cross-compile for the phone.

Another question is the following, If I want to monitor the trafic data for a certain application, there's any command for doing that?

Shark is no longer maintained and does not work on new versions of Android. Which method are you using now? — Arya, Oct 27 '15 at 23:05
@Arya, try this app https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture — Mateus Gondim, Oct 30 '15 at 21:58
@MateusGondim Thanks for that. Do you know anything I can use for TLS encryption? — Arya, Oct 31 '15 at 00:09

score 26 · Accepted Answer · edited Feb 08 '19 at 18:35

26

TCPDUMP is one of my favourite tools for analyzing network, but if you find difficult to cross-compile tcpdump for android, I'd recomend you to use some applications from the market.

These are the applications I was talking about:

Shark: Is small version of wireshark for Android phones). This program will create a *.pcap and you can read the file on PC with wireshark.
Shark Reader : This program allows you to read the *.pcap directly in your Android phone.

Shark app works with rooted devices, so if you want to install it, be sure that you have your device already rooted.

Good luck ;)

edited Feb 08 '19 at 18:35

Pramod Garg

1,831
1
22
26

answered Feb 28 '11 at 14:21

Martin Solac

830
1
11
21

16

Please provide direct link to download suggested tools. – Nabi K.A.Z. Nov 06 '15 at 13:45
What is "Shark"? Searching the web for "Android Shark" just returns a bunch of marine-themed mobile games. – jayhendren Apr 16 '21 at 20:42

score 16 · Answer 2 · edited May 23 '17 at 12:26

16

If you are doing it from the emulator you can do it like this:

Run emulator -tcpdump emulator.cap -avd my_avd to write all the emulator's traffic to a local file on your PC and then open it in wireshark

There is a similar post that might help HERE

edited May 23 '17 at 12:26

Community

1
1

answered Feb 25 '11 at 19:36

ninjasense

13,382
17
71
91

score 7 · Answer 3 · answered Feb 28 '11 at 06:42

Note: tcpdump requires root privileges, so you'll have to root your phone if not done already. Here's an ARM binary of tcpdump (this works for my Samsung Captivate). If you prefer to build your own binary, instructions are here (yes, you'd likely need to cross compile).

Also, check out Shark For Root (an Android packet capture tool based on tcpdump).

I don't believe tcpdump can monitor traffic by specific process ID. The strace method that Chris Stratton refers to seems like more effort than its worth. It would be simpler to monitor specific IPs and ports used by the target process. If that info isn't known, capture all traffic during a period of process activity and then sift through the resulting pcap with Wireshark.

score 4 · Answer 4 · edited May 23 '17 at 12:10

For Android Phones(Without Root):- you can use this application tPacketCapture this will capture the network trafic for your device when you enable the capture. See this url for more details about network sniffing without rooting your device.

Once you have the file which is in .pcap format you can use this file and analyze the traffic using any traffic analyzer like Wireshark.

Also see this post for further ideas on Capturing mobile phone traffic on wireshark

score 3 · Answer 5 · answered Jul 04 '13 at 08:26

The DDMS tool included in the Android SDK includes a tool for monitoring network traffic. It does not provide the kind of detail you get from tcpdump and similar low level tools, but it is still very useful.

Oficial documentation: http://developer.android.com/tools/debugging/ddms.html#network

AtomicBoolean · Answer 6 · 2020-04-09T18:41:41.293

Preconditions: adb and wireshark are installed on your computer and you have a rooted android device.

Download tcpdump to ~/Downloads
adb push ~/Downloads/tcpdump /sdcard/
adb shell
su root
mv /sdcard/tcpdump /data/local/
cd /data/local/
chmod +x tcpdump
./tcpdump -vv -i any -s 0 -w /sdcard/dump.pcap
Ctrl+C once you've captured enough data.
exit
exit
adb pull /sdcard/dump.pcap ~/Downloads/

Now you can open the pcap file using Wireshark.

As for your question about monitoring specific processes, find the bundle id of your app, let's call it com.android.myapp

ps | grep com.android.myapp
copy the first number you see from the output. Let's call it 1234. If you see no output, you need to start the app.
Download strace to ~/Downloads and put into /data/local using the same way you did for tcpdump above.
cd /data/local
./strace -p 1234 -f -e trace=network -o /sdcard/strace.txt

Now you can look at strace.txt for ip addresses, and filter your wireshark log for those IPs.

Note on some phones, you'll need to do `adb root` instead of `adb shell` `su root` — AtomicBoolean, Jul 08 '20 at 16:52
Note if you have `adb root` on a phone, you must `adb push ~/Downloads/tcpdump /data/local` — AtomicBoolean, May 24 '21 at 17:01

score 2 · Answer 7 · answered Nov 10 '15 at 13:37

2

Without root, you can use debug proxies like Charlesproxy&Co.

answered Nov 10 '15 at 13:37

Megachip

319
3
11

1

Thats true, I am using Charlesproxy for a long time and this tool is really cool. It provides throttling and SSL decryption (by using custom key) also. But it would be much more nicer to have this tool as a part of Android Studio. – Alexander Skvortsov Jan 18 '17 at 14:16

score 2 · Answer 8 · answered Feb 10 '16 at 09:35

2

Packet Capture is the best tool to track network data on the android. DOesnot need any root access and easy to read and save the calls based on application. Check this out

answered Feb 10 '16 at 09:35

Sai Prashanth R V

21
2

score 2 · Answer 9 · answered Apr 08 '17 at 17:46

2

Try this application https://play.google.com/store/apps/details?id=app.greyshirts.sslcapture

We can view all networking communications .. even SSL encrypted communications.

answered Apr 08 '17 at 17:46

hkbharath

307
6
15

score 2 · Answer 10 · answered Feb 25 '11 at 19:40

You would need to root the phone and cross compile tcpdump or use someone else's already compiled version.

You might find it easier to do these experiments with the emulator, in which case you could do the monitoring from the hosting pc. If you must use a real device, another option would be to put it on a wifi network hanging off of a secondary interface on a linux box running tcpdump.

I don't know off the top of my head how you would go about filtering by a specific process. One suggestion I found in some quick googling is to use strace on the subject process instead of tcpdump on the system.

score 0 · Answer 11 · edited May 23 '17 at 12:03

0

The common approach is to call "cat /proc/net/netstat" as described here:

Android network stats

edited May 23 '17 at 12:03

Community

1
1

answered Feb 25 '11 at 20:28

Peter Knego

78,855
10
118
147

1

That will provide a list of connections, but not permit monitoring the data itself. You may also miss channels without stateful connections unless you catch them at the right instant. Also using exec on cat is totally unnecessary - just read the /proc/net/netstat "file" in java. – Chris Stratton Feb 25 '11 at 21:50
I never tried it so wouldn't know for sure. First answer claims to work http://stackoverflow.com/questions/3394511/measure-data-roaming-traffic-on-android – Peter Knego Feb 25 '11 at 21:55

Monitor network activity in Android Phones

11 Answers11

Linked

Related