PCAPdroid

No entries match these filters. Clear filters

1. v2.0.0 Aug 19, 2026 · issue 051

   PCAPdroid v2.0.0 adds Capture List, app isolation, settings export/import, port mapping exemptions, and configurable connection log size.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v2.0.0 https://github.com/emanuele-f/PCAPdroid.git
   # already have the repo? check out this version:
   $ git checkout v2.0.0

   • Adds Capture List screen showing past captures and their size on disk.
   • Implements per-app allowlist (app isolation) to restrict which apps' traffic is captured.
   • Adds settings export and import for backing up and restoring PCAPdroid configuration.
   • Adds port mapping exemptions to exclude specific ports from VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. port remapping.
   • Makes the connections log size configurable.

   +6 more show less

   • Bumps mitm addon to v2.3 (mitmproxy 12.2.3) with full 16 KB page-size device support.
   • Bumps ushark decryption module to Wireshark v4.7.1.
   • Implicitly enables PCAPdroid extensions when using the pcapng capture format.
   • Persists packet direction in root mode via pcapng EPB flags option.
   • Adds Android 17 (Target SDK 37) support.
   • Adds new UI translations: Bengali (BN), French (FR), Hindi (HI), Japanese (JA), Korean (KO), Malay (MS), Urdu (UR), Vietnamese (VI).

   11 details in Everything

   └──▷ BREAKING ON UPGRADE

   • !PCAPdroid now requires Android 23+ (minSdk raised to 23); devices running Android 22 or below are no longer supported.
   • !The mitm addon now requires Android 24+ and drops support for the x86 and armeabi-v7a ABIs.
2. v1.9.0 Feb 12, 2026 · release notes

   PCAPdroid v1.9.0 adds HARHARAn HTTP Archive file, a JSON-format log of all network requests and responses captured by a browser's developer tools, used by cyber tools to replay, inspect, or analyze web traffic without re-running a live session. export, zstd support, and background extraction

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.9.0 https://github.com/emanuele-f/PCAPdroid.git
   # already have the repo? check out this version:
   $ git checkout v1.9.0

   └──▷ HOW TO FIND IT
   Export captured HTTP traffic as a HAR file for inspection in browser DevTools or external analysis tools.
   📍Use the Export HTTP data option and select HAR format from the dropdown menu.
   Enable the system app visibility toggle to see traffic generated by pre-installed Android components.
   📍Go to Settings › App Filter and enable Show system apps.
   • Export HTTP data in the HAR format allows sharing captured traffic with browser dev tools or other HAR-compatible analyzers.
   • Support the zstd compression enables decompression of PCAP files compressed with the Zstandard algorithm.
   • Add toggle to show system apps lets you filter out user-installed apps from the analysis view to focus on specific targets.

   3 details in Everything

3. v1.8.8 Sep 3, 2025 · release notes

   Adds configurable PCAP/CSV prefix and new API options for payload access and decryption.

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.8.8 https://github.com/emanuele-f/PCAPdroid.git
   # already have the repo? check out this version:
   $ git checkout v1.8.8

   └──▷ HOW TO FIND IT
   Configure the output file name prefix in the settings.
   📍Settings › Output › set prefix
   Use the new API options to access full payloads and decryption keys.
   copy

   $ {
     "full_payload": true,
     "keylog_filename": "/path/to/keylog",
     "decryption_rules": [...] 
   }

   • prefix setting allows making the PCAP/CSV file name prefix configurable
   • New full_payload, keylog_filename, and decryption_rules API options

   2 details in Everything

4. v1.8.3 Mar 8, 2025 · release notes

   PCAPdroid v1.8.3 adds support for building ushark from source on F-Droid

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.8.3 https://github.com/emanuele-f/PCAPdroid.git
   # already have the repo? check out this version:
   $ git checkout v1.8.3

   └──▷ HOW TO FIND IT
   Build the ushark protocol parser component locally for F-Droid distribution instead of using a pre-built binary.
   📍# Build ushark from source # (Requires appropriate Android NDK and build environment setup) cd path/to/PCAPdroid/source ./build_ushark.sh
5. v1.8.0 Mar 4, 2025 · release notes

   PCAPdroid v1.8.0 adds TLS decryption via Wireshark, country/CIDRCIDRA notation for a block of IP addresses, such as 10.0.0.0/24. The number after the slash says how many leading address bits identify the network. firewall rules, and expanded Pcapng support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.8.0 https://github.com/emanuele-f/PCAPdroid.git
   # already have the repo? check out this version:
   $ git checkout v1.8.0

   • Enables TLS traffic decryption in captured PCAP/Pcapng files through Wireshark integration
   • Adds New UI filter to show connections bigger than a given bytes threshold
   • Supports PCAPdroid extensions in Pcapng files

   3 details in Everything

6. v1.7.3 Sep 7, 2024 · release notes

   Adds system language support for Android 13+, always-on VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. detection after capture start, and Mitm addon v1.2 capabilities

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.7.3 https://github.com/emanuele-f/PCAPdroid.git
   # already have the repo? check out this version:
   $ git checkout v1.7.3

   • Allows setting the app language from the system (for Android 13+)
   • Detects if always-on VPN is enabled after a capture starts
   • Mitm addon v1.2: allows public files write
   • Permits using a compatible mitm addon with the same major version

   4 details in Everything

7. v1.7.0 Feb 10, 2024 · release notes

   PCAPdroid v1.7.0 adds multiple target selection, connection payload export, QUICQUICA UDP-based transport protocol standardized by the IETF that bakes in TLS 1.3, multiplexed streams, and connection migration, giving tools low-latency encrypted transport without head-of-line blocking. blocking on decryption only, and Tor/DNSCrypt integrations

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.7.0 https://github.com/emanuele-f/PCAPdroid.git
   # already have the repo? check out this version:
   $ git checkout v1.7.0

   └──▷ HOW TO FIND IT
   Export the raw payload of captured connections for offline analysis in a cyber tool like Wireshark or custom parser.
   📍In the PCAPdroid GUI, select a connection entry and choose Copy/export the connections payload.
   Configure PCAPdroid to use Tor for anonymized traffic capture instead of standard proxying.
   📍In PCAPdroid settings, enable Integrations and select Tor.
   Block QUIC traffic specifically during decryption processes to prevent bypass or interference.
   📍In the PCAPdroid GUI settings, enable 'Ability to block QUIC only on decryption'.
   • Select multiple target apps allows filtering traffic capture for several applications simultaneously.
   • Copy/export the connections payload enables extracting raw data from network connections within the GUIGUIA graphical user interface, controls such as windows, buttons and menus. It lets people use software visually rather than entering commands..
   • Ability to block QUIC only on decryption provides granular control over QUIC protocol blocking during decryption workflows.
   • Integrations to run with Tor and DNSCrypt allows using external privacy infrastructure directly from PCAPdroid.
   • Use your own mitmproxy addons (experimental) lets users load custom mitmproxy addon scripts for extended traffic manipulation.

   +2 more show less

   • Updated mitmproxy version to 10.1.6.
   • CSV exports now use ISOISOA widely adopted international standards body that publishes technical specifications; cyber tools cite ISO standards to signal compliance with recognized benchmarks for quality, security, or interoperability. 8601 date format for standard timestamp compatibility.

   7 details in Everything

8. v1.6.7 Aug 31, 2023 · release notes

   Adds Ukrainian translation and prevents SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. host resolution when disabled in PCAPdroid v1.6.7

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.6.7 https://github.com/emanuele-f/PCAPdroid.git
   # already have the repo? check out this version:
   $ git checkout v1.6.7

   └──▷ HOW TO FIND IT
   Disable DNS leakage or unnecessary network queries when using a SOCKS5 proxy by ensuring the server hostname is not resolved if the proxy itself is turned off.
   📍Go to Settings › Network › Proxy, toggle SOCKS5 ON, then toggle it OFF to verify no host resolution occurs
9. v1.6.6 Aug 28, 2023 · release notes

   PCAPdroid v1.6.6 adds PCAP/PCAPNG file opening and SOCKS5SOCKS5A proxy protocol that relays TCP and UDP traffic through an intermediary server without inspecting it, letting cyber tools tunnel connections through firewalls or pivot hosts with minimal overhead. host name support

   └──▷ GET THIS VERSION

   copy

   $ git clone --branch v1.6.6 https://github.com/emanuele-f/PCAPdroid.git
   # already have the repo? check out this version:
   $ git checkout v1.6.6

   • Open PCAP/PCAPNG files option now available to load existing capture files directly.
   • SOCKS5 proxy mode now accepts host names instead of only IP addresses, and supports IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. destinations.

   2 details in Everything

10. v1.6.5 Jun 15, 2023 · release notes

    PCAPdroid v1.6.5 adds JS injection to mitm, rule-based TLS decryption, and SSLKEYLOG export on anomalous stops

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.5 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.6.5

    • Adds the ability to inject JavaScript into web pages via PCAPdroid-mitm
    • Makes TLS decryption rule-based so it only applies to specified connections

    2 details in Everything

11. v1.6.3 Apr 23, 2023 · release notes

    Adds QR code activation for paid features in non-Play builds

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.3 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.6.3

12. v1.6.0 Jan 16, 2023 · release notes

    PCAPdroid v1.6.0 adds pcapng output, TLS/ firewall whitelists, configurable DNS/mitmproxy, and API parameters for custom naming and format control

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.6.0 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.6.0

    • Add pcap_name parameter to specify a custom PCAP file name via the API
    • Add pcapng_format parameter to enable pcapng dump format via the API
    • Add mitmproxy_opts parameter to pass custom options to mitmproxy via the API
    • DNS servers are now configurable in the UI
    • Add firewall whitelist mode: block everything, unless whitelisted

    +3 more show less

    • Support TLS decryption whitelist
    • Apps stats can now be reset
    • The application and the mitmproxy logs can now be viewed in-app

    8 details in Everything

    └──▷ BREAKING ON UPGRADE

    • !The pcap_uri parameter is now only an identifier, check out [Dumping PCAP to file](https://github.com/emanuele-f/PCAPdroid/blob/master/docs/app_api.md#dumping-pcap-to-file) for instructions
13. v1.5.6 Sep 24, 2022 · release notes

    PCAPdroid v1.5.6 adds STUN compatibility extension and ability to skip TLS certificate installation.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.6 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.5.6

    • Extends STUN protocol compatibility

    1 detail in Everything

14. v1.5.5 Aug 25, 2022 · release notes

    PCAPdroid v1.5.5 enables access to paid features via unlock tokens in non-Play builds.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.5 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.5.5

15. v1.5.3 Jul 13, 2022 · release notes

    PCAPdroid v1.5.3 adds VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. app exemptions, IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only.-only mode, firewall blocking, and cleartext filtering

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.3 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.5.3

    • vpn_exempt_apps config key allows specifying apps to exclude from the VPN tunnel
    • Supports ipv6_only mode for the VPN interface
    • New show_cleartext_only filter option to display only unencrypted connections
    • Firewall feature adds ability to block newly installed applications automatically
    • Firewall capability includes temporary unblock functionality for specific apps

    5 details in Everything

16. v1.5.2 Jun 23, 2022 · release notes

    Adds firewall connection filtering and low-memory payload disabling

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.2 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.5.2

    └──▷ HOW TO FIND IT
    Filter captured traffic to focus only on permitted flows when debugging app connectivity.
    📍In the UI, enable Show only firewall allowed connections to reduce noise.
    Prevent out-of-memoryout-of-memoryAn out-of-memory condition: a program requests more memory than the system or device can provide. The allocation fails or the operating system may stop the process. crashes on devices with constrained RAMRAMWorking memory that holds programs and data while a computer is running. Its contents usually disappear when power is removed. by skipping full payload capture.
    📍In the UI, ensure Disable full payload on low memory is enabled to monitor and react to memory pressure.
    • Add ability to only show the connections allowed by the firewall
    • Monitor memory usage and disable full payload on low memory

    2 details in Everything

17. v1.5.0 Jun 2, 2022 · release notes

    PCAPdroid v1.5 adds no-root firewall, TLS decryption with SSLKEYLOGFILE export, and rule import/export.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.5.0 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.5.0

    • Ability to decrypt TLS traffic and display the decrypted data
    • Export the SSLKEYLOGFILE for use with external decoders (e.g., Wireshark)
    • Inspect HTTP requests and replies using built-in decoders (brotli, deflate, gzip)

    3 details in Everything

18. v1.4.8 Apr 22, 2022 · release notes

    PCAPdroid v1.4.8 adds Ready button capture start, post-capture inspection, UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. STUN in non-root mode

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.8 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.4.8

    └──▷ HOW TO FIND IT
    Use the new Ready button to manually trigger PCAP recording only when needed
    📍Tap Ready in the UI to start capture
    Inspect captured traffic after the session ends using the new post-capture view
    📍Stop the capture, then open the Connections list
    • Adds a Ready button that must be tapped to start the capture, giving explicit control over when recording begins
    • Supports UDP STUN traffic inspection in non-root mode

    2 details in Everything

19. v1.4.6 Feb 6, 2022 · release notes

    PCAPdroid v1.4.6 adds full Always-on VPNVPNA virtual private network, an encrypted tunnel between devices or networks. It carries traffic across another network as though the endpoints had a private connection. support, Norwegian/French translations, and root mode crash fixes

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.6 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.4.6

    • Always-on VPN is now fully supported
    • Add Norwegian translation (credits: Allan Nordhøy)
    • Add French translation (credits: J. Lavoie and Maxime Leroy)

    3 details in Everything

20. v1.4.5 Jan 6, 2022 · release notes

    PCAPdroid v1.4.5 adds interface filtering in root mode and malware connection blocking

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.5 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.4.5

    └──▷ HOW TO FIND IT
    Filter captured network traffic to only include packets from a specific interface while running with root privileges.
    📍Use the new 'filter by capture interface' option in the PCAPdroid UI settings under Root Mode.
    Prevent malware from communicating with its command-and-control server without needing root access, utilizing the paid security tier.
    📍Ensure Malware detection is enabled in the settings; malicious connections are now automatically blocked.
    • Add ability to filter connections by capture interface in root mode
    • Malware detection now blocks malicious connections in non-root mode (paid feature)

    2 details in Everything

21. v1.4.4 Nov 23, 2021 · release notes

    PCAPdroid v1.4.4 adds malware detection overview, destination country/ASNASNAutonomous System Number — a globally unique identifier assigned by regional internet registries to a network operator, letting routing protocols distinguish which organization controls a block of IP addresses. details, boot-time capture, and persistent permissions

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.4 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.4.4

    • New malware detection overview: show blacklists and detection status
    • Show destination country and ASN in the connection details
    • Add ability to start the capture at boot
    • Add ability to grant persistent capture control permissions

    4 details in Everything

22. v1.4.3 Oct 30, 2021 · release notes

    PCAPdroid v1.4.3 adds blacklist malware detection, connection filtering options, and Hidden Connections rename

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.3 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.4.3

    └──▷ HOW TO FIND IT
    Use the new whois lookups to identify connection hosts directly from the interface.
    📍Long-press a host/IP entry and select whois lookup from the menu
    Apply connection filters to view only specific traffic states.
    📍Use the filter options: plaintext, only open, not hidden, or malicious
    • Adds blacklist-based malware detection with alerts
    • Adds connection filters for plaintext, open state, not hidden, or malicious connections
    • Adds whois IP lookup button

    3 details in Everything

23. v1.4.2 Sep 11, 2021 · release notes

    PCAPdroid v1.4.2 adds interface selection in root mode and app-to-app capture control via Intent.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.2 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.4.2

    • pcapd error reporting improved for easier diagnostics
    • The copy action now dumps the request plaintext alongside other data
    • Added ability to start/stop the capture from other apps via Intent
    • Added ability to select the capture interface when in root mode

    4 details in Everything

24. v1.4.0 Jul 20, 2021 · release notes

    PCAPdroid v1.4.0 adds Wireshark trailer export, root IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only./ICMP support, and app metadata UI.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.4.0 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.4.0

    • Adds ability to export app name to Wireshark via PCAPdroid trailer
    • Adds apps details page displaying app metadata and permissions
    • Allows searching packets by source and destination port
    • Enables IPv6 and ICMP support for root capture
    • Adds packet drops display for root capture

    5 details in Everything

25. v1.3.9 Jun 16, 2021 · release notes

    PCAPdroid v1.3.9 adds connection whitelisting, search, and DNS resolution

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.9 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.3.9

    └──▷ HOW TO FIND IT
    Find specific connections among hundreds without scrolling manually.
    📍Use the search bar to filter connections by domain or IP
    • Long press a connection to whitelist it for filtering background traffic
    • Improves resolution of netd DNS connections to their actual apps

    2 details in Everything

26. v1.3.3 Mar 25, 2021 · release notes

    PCAPdroid v1.3.3 adds IPv6IPv6The current version of the Internet Protocol, standardized by the IETF, using 128-bit addresses to replace the exhausted IPv4 space. Cyber tools target it because modern networks run dual-stack or IPv6-only. support and language switching

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.3 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.3.3

    • Add ability to switch between system language and english

    1 detail in Everything

27. v1.3.0 Mar 6, 2021 · release notes

    PCAPdroid v1.3.0 adds Android TV support, CSV export for connection logs, and an Apps view.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.3.0 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.3.0

    • Android TV support added to the app
    • Export the connections log to a CSV file
    • Filter the connections log by app
    • New Apps view to review the total traffic and connections by app

    4 details in Everything

28. v1.2.13 Feb 12, 2021 · release notes

    PCAPdroid v1.2.13 adds a stats view with traffic and debug information.

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.13 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.2.13

    • ViewPager2 migration

    1 detail in Everything

29. v1.2.6 Nov 16, 2020 · release notes

    PCAPdroid v1.2.6 adds mitmproxy integration for TLS decryption

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.6 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.2.6

    └──▷ HOW TO FIND IT
    Enable decrypted packet capturepacket captureA packet capture, recorded network packets that can be inspected later. Analysts use it to reconstruct communication and investigate protocol behavior or suspicious traffic. by connecting to a local or remote mitmproxy instance.
    📍Settings › Network › Proxy › Select mitmproxy and enter host:port
    • Add support for TLS decryption via mitmproxy

    1 detail in Everything

30. v1.2.1 Jan 6, 2020 · release notes

    v1.2.1 adds an embedded HTTP server and UDPUDPA network protocol that sends individual messages without guaranteeing delivery or order. Applications trade built-in reliability for less overhead and can add their own recovery. exporter for PCAP download options

    └──▷ GET THIS VERSION

    copy

    $ git clone --branch v1.2.1 https://github.com/emanuele-f/PCAPdroid.git
    # already have the repo? check out this version:
    $ git checkout v1.2.1

    └──▷ HOW TO FIND IT
    Stream captures from an Android device to another machine for analysis without USB tethering.
    📍In the capture settings, select HTTP server as the dump method, then access the displayed URL from a browser on the remote device.
    Send raw packet dumps to a local capture listener for custom processing.
    📍In the capture settings, select UDP exporter and specify the target IP and port.
    • Adds an embedded HTTP server to enable downloading the PCAP file from multiple devices simultaneously
    • Allows users to choose the packet dump method via a new option menu including HTTP server, UDP exporter, or none

    2 details in Everything