Monitor network activity in Android Phones

Question

I would like to monitor network traffic of my Android Phone  I was thinking using tcpdump for Android  but I m not sure if I have to cross-compile for the phone   Another question is the following  If I want to monitor the trafic data for a certain application  there s any command for doing that

User · Accepted Answer

TCPDUMP is one of my favourite tools for analyzing network, but if you find difficult to cross-compile tcpdump for android, I'd recomend you to use some applications from the market.

These are the applications I was talking about:

Shark: Is small version of wireshark for Android phones). This program will create a *.pcap and you can read the file on PC with wireshark.
Shark Reader : This program allows you to read the *.pcap directly in your Android phone.

Shark app works with rooted devices, so if you want to install it, be sure that you have your device already rooted.

Good luck ;)

User · Answer

Without root  you can use debug proxies like Charlesproxy amp Co

User · Answer

Try this application  https   play google com store apps details id app greyshirts sslcapture  We can view all networking communications    even SSL encrypted communications

User · Answer

Packet Capture is the best tool to track network data on the android  DOesnot need any root access and easy to read and save the calls based on application  Check this out

User · Answer

The common approach is to call  cat  proc net netstat   as described here   Android network stats

User · Answer

You would need to root the phone and cross compile tcpdump or use someone else s already compiled version   You might find it easier to do these experiments with the emulator  in which case you could do the monitoring from the hosting pc   If you must use a real device  another option would be to put it on a wifi network hanging off of a secondary interface on a linux box running tcpdump   I don t know off the top of my head how you would go about filtering by a specific process   One suggestion I found in some quick googling is to use strace on the subject process instead of tcpdump on the system

User · Answer

Note  tcpdump requires root privileges  so you ll have to root your phone if not done already  Here s an ARM binary of tcpdump  this works for my Samsung Captivate   If you prefer to build your own binary  instructions are here  yes  you d likely need to cross compile    Also  check out Shark For Root  an Android packet capture tool based on tcpdump    I don t believe tcpdump can monitor traffic by specific process ID  The strace method that Chris Stratton refers to seems like more effort than its worth  It would be simpler to monitor specific IPs and ports used by the target process  If that info isn t known  capture all traffic during a period of process activity and then sift through the resulting pcap with Wireshark

User · Answer

If you are doing it from the emulator you can do it like this   Run emulator -tcpdump emulator cap -avd my avd to write all the emulator s traffic to a local file on your PC and then open it in wireshark  There is a similar post that might help HERE

User · Answer

The DDMS tool included in the Android SDK includes a tool for monitoring network traffic  It does not provide the kind of detail you get from tcpdump and similar low level tools  but it is still very useful   Oficial documentation  http   developer android com tools debugging ddms html network

User · Answer

For Android Phones Without Root  - you can use this application tPacketCapture this will capture the  network trafic for your device when you enable the capture  See this url for more details about network sniffing without rooting your device   Once you have the file which is in  pcap format you can use this file and analyze the traffic using any traffic analyzer like Wireshark   Also see this post for further ideas on Capturing mobile phone traffic on wireshark

User · Answer

Preconditions  adb and wireshark are installed on your computer and you have a rooted android device    Download tcpdump to   Downloads adb push   Downloads tcpdump  sdcard  adb shell su root mv  sdcard tcpdump  data local  cd  data local  chmod  x tcpdump   tcpdump -vv -i any -s 0 -w  sdcard dump pcap Ctrl C once you ve captured enough data  exit exit adb pull  sdcard dump pcap   Downloads    Now you can open the pcap file using Wireshark   As for your question about monitoring specific processes  find the bundle id of your app  let s call it com android myapp   ps   grep com android myapp copy the first number you see from the output  Let s call it 1234  If you see no output  you need to start the app   Download strace to   Downloads and put into  data local using the same way you did for tcpdump above   cd  data local   strace -p 1234 -f -e trace network -o  sdcard strace txt   Now you can look at strace txt for ip addresses  and filter your wireshark log for those IPs

[android] Monitor network activity in Android Phones

Examples related to android

Examples related to monitoring

Examples related to wireshark

Examples related to tcpdump