📊 Install PCAPdroid
Monitor Network Traffic & Detect Suspicious Connections
Learn how to install and use PCAPdroid, a free network monitoring tool that lets you see every connection your Android device makes. Perfect for detecting spyware, data leaks, and suspicious app behavior.
Why Network Monitoring Matters
Most apps on your phone are constantly communicating with servers in the background—sending data, downloading ads, tracking your location, and more. Without network monitoring, you have no idea what's being sent or where it's going.
PCAPdroid reveals:
- Every connection your apps make - See which servers they contact
- How much data is being sent - Identify apps using excessive bandwidth
- Suspicious domains and IPs - Detect spyware, trackers, and malware
- Background activity - See what apps do when you're not using them
🔍 Real-World Use Cases
- Detect spyware: Stalkerware apps often connect to specific domains
- Find data leaks: See if apps are sending your data to third parties
- Identify trackers: Discover which analytics and ad networks are tracking you
- Monitor suspicious apps: Verify if an app's behavior matches its claims
Before You Start
What You'll Need:
- Android device running Android 5.0 or newer
- 15 minutes of time
- Internet connection to download the app
- Basic understanding of apps and permissions
📱 How PCAPdroid Works
PCAPdroid uses Android's VPN API to monitor network traffic without requiring root access. It creates a local VPN on your device to intercept and log all network connections. Your data never leaves your device—everything is processed locally.
Step-by-Step Instructions
Open Google Play Store
Open the Google Play Store app on your Android device and tap the search bar at the top.
✓ You should see: The Play Store home screen with the search bar at the top
Search for PCAPdroid
Type "PCAPdroid" in the search bar. The official app by Emanuele Faranda should appear at the top of the results.
✓ You should see: PCAPdroid app with a network icon, rated 4.5+ stars, marked as "Free"
Install the App
Tap on the PCAPdroid app, then tap the green "Install" button. Wait for the download and installation to complete (usually takes 30-60 seconds).
✓ You should see: Installation progress bar, then "Open" button when complete
Open PCAPdroid & Grant VPN Permission
Tap "Open" to launch PCAPdroid. The app will immediately request VPN permission. This is essential for network monitoring—tap "OK" to grant permission.
🔒 Is This Safe?
Yes! PCAPdroid is open-source and highly trusted in the security community. The VPN permission allows it to monitor traffic locally on your device. Your data never goes to external servers—everything stays on your phone.
Start Monitoring (Stopped State)
You'll see the PCAPdroid main screen with a large "Start" button. Before starting, familiarize yourself with the interface. You can configure settings by tapping the menu icon (three dots) in the top right.
✓ You should see: Large circular "Start" button, connection statistics at zero, settings menu
Begin Network Capture
Tap the "Start" button to begin monitoring. PCAPdroid will now capture all network connections. The button will change to "Stop" and you'll see connection statistics updating in real-time.
✅ Monitoring Active!
PCAPdroid is now capturing all network activity. You'll see counters for connections, bytes sent/received, and active apps. A persistent notification will appear showing that monitoring is active.
View Connection Details
Tap the "Connections" tab to see a detailed list of every connection your device is making. Each entry shows:
- App name - Which app made the connection
- Domain/IP address - Where the connection went
- Protocol - HTTP, HTTPS, DNS, etc.
- Data transferred - Bytes sent and received
✓ You should see: Scrollable list of connections with app icons, domains, and data statistics
How to Interpret PCAPdroid Data
🚩 Red Flags to Watch For
- Unknown apps making connections: Apps you don't recognize sending data
- Suspicious domains: Connections to unfamiliar or sketchy-looking domains
- Excessive background activity: Apps using data when you're not using them
- Unusual ports: Connections on non-standard ports (not 80, 443, 53)
- High data usage: Apps sending large amounts of data unexpectedly
✅ Normal vs. Suspicious Connections
Normal connections you'll see:
- Google Play Services → google.com, googleapis.com
- Social media apps → facebook.com, instagram.com, twitter.com
- Messaging apps → whatsapp.net, signal.org
- DNS queries → 8.8.8.8, 1.1.1.1 (Google/Cloudflare DNS)
Suspicious connections to investigate:
- Apps connecting to IP addresses instead of domains
- System apps connecting to unknown servers
- Apps sending data to countries you don't recognize
- Connections to known tracking/analytics domains (doubleclick.net, etc.)
⚠️ If You Find Spyware
If PCAPdroid reveals suspicious connections from an unknown app:
- Take screenshots of the connections for evidence
- Don't uninstall yet if you're in danger (abuser may notice)
- Follow our spyware removal guide for safe removal steps
- Consider a factory reset if spyware is deeply embedded
Tips & Best Practices
📊 When to Use PCAPdroid
- Periodic audits: Run it weekly to check for new suspicious apps
- After installing new apps: Monitor what they connect to
- When battery drains fast: Identify apps using excessive data
- If you suspect spyware: Look for hidden connections
⚡ Performance Impact
PCAPdroid has minimal impact on battery and performance, but for best results:
- Only run it when actively monitoring (don't leave it on 24/7)
- Stop monitoring when you're done reviewing connections
- Clear old connection logs periodically to save storage
🔗 Combine with NetGuard
For maximum control, use PCAPdroid to identify suspicious connections, then use NetGuard (our next guide) to block them. This two-tool approach gives you complete visibility and control.
Troubleshooting
❓ VPN permission denied
If you can't grant VPN permission, check if another VPN app is running. Android only allows one VPN at a time. Disconnect any active VPN, then try again.
📵 No connections showing up
Make sure you tapped "Start" to begin monitoring. If still no connections appear, try:
- Stopping and restarting PCAPdroid
- Opening a web browser to generate traffic
- Checking that VPN permission is still granted
🔋 Battery draining faster
PCAPdroid uses minimal battery, but if you notice drain:
- Stop monitoring when not actively reviewing connections
- Reduce the connection log size in settings
- Only monitor specific apps instead of all traffic
🌐 Internet not working
Rarely, PCAPdroid's VPN can interfere with internet. If this happens:
- Stop PCAPdroid monitoring
- Disconnect and reconnect to WiFi/mobile data
- Restart your device if issues persist
What's Next?
Now that you can see what your apps are doing, the next step is controlling them. PCAPdroid shows you the connections—NetGuard lets you block them.
🎯 Recommended Next Steps
- Run PCAPdroid for 24 hours to see your normal traffic patterns
- Identify suspicious apps connecting to unknown servers
- Install NetGuard (next guide) to block unwanted connections
- Audit app permissions to reduce data collection
