PocketPCAP

Source Code available at https://github.com/AlsatianConsulting/PocketPCAP

PocketPCAP is a packet capture and analysis tool for Android, built around the real Wireshark dissector engine. It bundles tshark 4.6.8 on the device, so captures are decoded by the same code that decodes them on a desktop — not by a simplified reimplementation.

It is a passive, diagnostic tool. It reads traffic and explains it. It has no injection, spoofing, deauthentication or attack features of any kind, and never will.

SUMMARY FIRST

Open a capture and you get an answer, not a wall of packets. The Summary tells you what the capture contains: size, duration, link layer, endpoint and conversation counts, and the protocols that dominate it. Every figure is a pivot — tap a protocol, a talker or a health metric and you land on the packets that justify it.

FINDS PROBLEMS, WITH EVIDENCE

The Issues view flags TCP resets, retransmissions, duplicate ACKs, zero windows, unanswered DNS and more. Each finding names the endpoints, the conversation, the first occurrence and the exact packet numbers behind it, so you can check the claim rather than take it on trust.

FULL ANALYSIS WORKSPACE

Conversations, Endpoints, Protocols, Issues, Objects, DNS, TLS, HTTP, Statistics, Timeline, grouped Search and Bookmarks. The Timeline plots packets or bytes per time bucket, marks retransmissions and resets, and lets you filter the capture down to a selected range.

CAPTURE

- Rootless: Android's VpnService captures device traffic with no root at all.

- Rooted: bundled dumpcap captures from any network interface, with capture filters, and autostop ceilings for size and duration so a forgotten capture cannot fill the device.

READ ANYTHING

Open a PCAP or PCAPNG from anywhere on the device. Follow a file another tool is still writing. Merge captures into one timestamp-ordered file. Decrypt TLS with an SSLKEYLOGFILE, or 802.11 with a WEP key, WPA/WPA2 passphrase or raw PSK.

EXPORT WHAT YOU FOUND

Filtered packets to a new PCAPNG. Headers-only PCAPNG with payloads stripped, for sharing safely. Annotated PCAPNG with your own packet notes written in as comments. Analysis tables as CSV or JSON. The traffic map as KML or GeoJSON. Everything lands in Documents/pocketpcap, where the Files app and a USB cable can both reach it.

PRIVATE BY DEFAULT

No account. No sign-in. No telemetry. No analytics. No ads. Your captures, notes and keys stay on the device. Name resolution uses your own aliases, local discovery and a bundled offline OUI database; reverse DNS is off unless you turn it on.

Three features reach the internet, each only when you invoke it: the Traffic Map and endpoint location look up addresses from your capture with third-party GeoIP and RDAP services, Check for Updates asks GitHub for the latest version number, and reverse DNS queries your own resolver if you enable it. Capture, decode, analysis, search and export are entirely offline. The privacy policy spells all of this out.

OPEN SOURCE

GPL-3.0-or-later, with full third-party attribution shipped in the app under Settings > About > Licences.

REQUIREMENTS

Android 10 or newer. Reading, decoding, analysing and exporting captures need no special permissions. Rootless VPN capture needs the VPN permission you grant on first use. Live capture from a named network interface needs root, because dumpcap needs CAP_NET_RAW — nothing else does.