No-root network monitor, firewall and PCAP dumper for Android
Go to file
2019-09-16 00:52:49 +02:00
.idea First commit 2019-09-08 22:09:03 +02:00
app Add NULL checks to prevent crash 2019-09-16 00:52:49 +02:00
gradle/wrapper First commit 2019-09-08 22:09:03 +02:00
zdtun First commit 2019-09-08 22:09:03 +02:00
.gitignore First commit 2019-09-08 22:09:03 +02:00
build.gradle First commit 2019-09-08 22:09:03 +02:00
COPYING Add license 2019-09-08 22:11:07 +02:00
gradle.properties First commit 2019-09-08 22:09:03 +02:00
gradlew First commit 2019-09-08 22:09:03 +02:00
gradlew.bat First commit 2019-09-08 22:09:03 +02:00
README.md Update README.md 2019-09-08 22:20:39 +02:00
settings.gradle First commit 2019-09-08 22:09:03 +02:00

Remote Capture

Capture traffic on Android devices and send the PCAP via UDP. No root privileges required.

Features:

  • Capture DNS traffic
  • Only capture traffic of a specific APP

TODO:

  • ICMP support
  • App icon and layout

Receiving the PCAP

In order to receive the PCAP on the collector host, perform the following steps in order:

  1. Ensure that the Remote Capture VPN is not running (key icon is not shown)
  2. Run the PCAP collector program (e.g. wireshark) on the host
  3. Start the Remote Capture VPN via the start button

To start a new capture, stop the VPN and repeat the steps above.

Examples

  • Analyze the traffic in Wireshark:
socat -b 65535 - udp4-listen:1234 | wireshark -k -i -
  • Write the traffic to a PCAP file:
socat -b 65535 - udp4-listen:1234 | tcpdump -w dump.pcap -r -

Note: the -b option of socat is required as the default UDP buffer size of 8192 B of nc or socat is not enough to handle the encapsulated packets.

Building

In order to build the app, you need to clone https://github.com/emanuele-f/zdtun beside the RemoteCapture directory