PocketPCAP
Everyone
info
0+
Downloads
Everyone
Learn more
About this app
Source Code available at https://github.com/AlsatianConsulting/PocketPCAP
PocketPCAP is a packet capture and analysis tool for Android, built around the real Wireshark dissector engine. It bundles tshark 4.6.8 on the device, so captures are decoded by the same code that decodes them on a desktop — not by a simplified reimplementation.
It is a passive, diagnostic tool. It reads traffic and explains it. It has no injection, spoofing, deauthentication or attack features of any kind, and never will.
SUMMARY FIRST
Open a capture and you get an answer, not a wall of packets. The Summary tells you what the capture contains: size, duration, link layer, endpoint and conversation counts, and the protocols that dominate it. Every figure is a pivot — tap a protocol, a talker or a health metric and you land on the packets that justify it.
FINDS PROBLEMS, WITH EVIDENCE
The Issues view flags TCP resets, retransmissions, duplicate ACKs, zero windows, unanswered DNS and more. Each finding names the endpoints, the conversation, the first occurrence and the exact packet numbers behind it, so you can check the claim rather than take it on trust.
FULL ANALYSIS WORKSPACE
Conversations, Endpoints, Protocols, Issues, Objects, DNS, TLS, HTTP, Statistics, Timeline, grouped Search and Bookmarks. The Timeline plots packets or bytes per time bucket, marks retransmissions and resets, and lets you filter the capture down to a selected range.
CAPTURE
- Rootless: Android's VpnService captures device traffic with no root at all.
- Rooted: bundled dumpcap captures from any network interface, with capture filters, and autostop ceilings for size and duration so a forgotten capture cannot fill the device.
READ ANYTHING
Open a PCAP or PCAPNG from anywhere on the device. Follow a file another tool is still writing. Merge captures into one timestamp-ordered file. Decrypt TLS with an SSLKEYLOGFILE, or 802.11 with a WEP key, WPA/WPA2 passphrase or raw PSK.
EXPORT WHAT YOU FOUND
Filtered packets to a new PCAPNG. Headers-only PCAPNG with payloads stripped, for sharing safely. Annotated PCAPNG with your own packet notes written in as comments. Analysis tables as CSV or JSON. The traffic map as KML or GeoJSON. Everything lands in Documents/pocketpcap, where the Files app and a USB cable can both reach it.
PRIVATE BY DEFAULT
No account. No sign-in. No telemetry. No analytics. No ads. Your captures, notes and keys stay on the device. Name resolution uses your own aliases, local discovery and a bundled offline OUI database; reverse DNS is off unless you turn it on.
Three features reach the internet, each only when you invoke it: the Traffic Map and endpoint location look up addresses from your capture with third-party GeoIP and RDAP services, Check for Updates asks GitHub for the latest version number, and reverse DNS queries your own resolver if you enable it. Capture, decode, analysis, search and export are entirely offline. The privacy policy spells all of this out.
OPEN SOURCE
GPL-3.0-or-later, with full third-party attribution shipped in the app under Settings > About > Licences.
REQUIREMENTS
Android 10 or newer. Reading, decoding, analysing and exporting captures need no special permissions. Rootless VPN capture needs the VPN permission you grant on first use. Live capture from a named network interface needs root, because dumpcap needs CAP_NET_RAW — nothing else does.
PocketPCAP is a packet capture and analysis tool for Android, built around the real Wireshark dissector engine. It bundles tshark 4.6.8 on the device, so captures are decoded by the same code that decodes them on a desktop — not by a simplified reimplementation.
It is a passive, diagnostic tool. It reads traffic and explains it. It has no injection, spoofing, deauthentication or attack features of any kind, and never will.
SUMMARY FIRST
Open a capture and you get an answer, not a wall of packets. The Summary tells you what the capture contains: size, duration, link layer, endpoint and conversation counts, and the protocols that dominate it. Every figure is a pivot — tap a protocol, a talker or a health metric and you land on the packets that justify it.
FINDS PROBLEMS, WITH EVIDENCE
The Issues view flags TCP resets, retransmissions, duplicate ACKs, zero windows, unanswered DNS and more. Each finding names the endpoints, the conversation, the first occurrence and the exact packet numbers behind it, so you can check the claim rather than take it on trust.
FULL ANALYSIS WORKSPACE
Conversations, Endpoints, Protocols, Issues, Objects, DNS, TLS, HTTP, Statistics, Timeline, grouped Search and Bookmarks. The Timeline plots packets or bytes per time bucket, marks retransmissions and resets, and lets you filter the capture down to a selected range.
CAPTURE
- Rootless: Android's VpnService captures device traffic with no root at all.
- Rooted: bundled dumpcap captures from any network interface, with capture filters, and autostop ceilings for size and duration so a forgotten capture cannot fill the device.
READ ANYTHING
Open a PCAP or PCAPNG from anywhere on the device. Follow a file another tool is still writing. Merge captures into one timestamp-ordered file. Decrypt TLS with an SSLKEYLOGFILE, or 802.11 with a WEP key, WPA/WPA2 passphrase or raw PSK.
EXPORT WHAT YOU FOUND
Filtered packets to a new PCAPNG. Headers-only PCAPNG with payloads stripped, for sharing safely. Annotated PCAPNG with your own packet notes written in as comments. Analysis tables as CSV or JSON. The traffic map as KML or GeoJSON. Everything lands in Documents/pocketpcap, where the Files app and a USB cable can both reach it.
PRIVATE BY DEFAULT
No account. No sign-in. No telemetry. No analytics. No ads. Your captures, notes and keys stay on the device. Name resolution uses your own aliases, local discovery and a bundled offline OUI database; reverse DNS is off unless you turn it on.
Three features reach the internet, each only when you invoke it: the Traffic Map and endpoint location look up addresses from your capture with third-party GeoIP and RDAP services, Check for Updates asks GitHub for the latest version number, and reverse DNS queries your own resolver if you enable it. Capture, decode, analysis, search and export are entirely offline. The privacy policy spells all of this out.
OPEN SOURCE
GPL-3.0-or-later, with full third-party attribution shipped in the app under Settings > About > Licences.
REQUIREMENTS
Android 10 or newer. Reading, decoding, analysing and exporting captures need no special permissions. Rootless VPN capture needs the VPN permission you grant on first use. Live capture from a named network interface needs root, because dumpcap needs CAP_NET_RAW — nothing else does.
Wireshark-grade packet capture and analysis. Real tshark. No account, no ads.
Updated on
Safety starts with understanding how developers collect and share your data. Data privacy and security practices may vary based on your use, region, and age. The developer provided this information and may update it over time.
- No data shared with third partiesLearn more about how developers declare sharing
- No data collectedLearn more about how developers declare collection
What’s new
tun2socks is now built from source
Google Play's release dashboard flagged base/lib/arm64-v8a/libgojni.so as a crash risk
on 16 KB page-size devices. Alignment was never the problem; provenance was. That library
came from the prebuilt com.ooimi.library:tun2socks:1.0.4 AAR, whose
.note.android.ident records NDK r19c — a 2019 toolchain — and Play rejects anything
below r28. The artifact has had no release since November 2023, so there was no newer
version to
Everyone
Learn moreApp support
About the developer
ALSATIAN CONSULTING LLC
info@alsatian.consulting
640 Nighthorse Cir
Waxahachie, TX 75165-1872
United States
+1 682-225-3550
