How to Capture and Analyze Android Network Traffic Using a Local VPN Capture App (No Root)

Before you start

• Android 6.0 or newer (VpnService is stable).
• Device charged or connected to power.
• Wi‑Fi or mobile data connection you want to monitor.
• Computer with Wireshark installed if you plan to do deep analysis.
• Optional: a USB cable for fast file transfer.

Why a VPN‑based capture works without root

Android provides the VpnService API, which lets an app create a virtual network interface and route all device traffic through it. Because the traffic passes through the app, the app can record packets before they reach the network stack. This approach does not require root privileges, making it safe for most users.

Step‑by‑step guide

Optional: Decrypting HTTPS traffic

Most apps use TLS, which encrypts payloads. To see the clear‑text data you must install the capture app’s custom CA certificate:

1. In the capture app, enable HTTPS decryption. The app will generate a certificate file.
2. Navigate to Settings → Security → Encryption & credentials → Install a certificate → CA certificate (path may vary by manufacturer).
3. Select the generated .crt file and confirm installation.
4. Restart the capture. From now on, traffic from apps that respect the system’s trusted CAs will be decrypted.

Note: Some apps (e.g., banking apps) implement certificate pinning and will refuse the custom CA, so their traffic remains encrypted.

Troubleshooting

• No packets appear in the capture.
  • Ensure the VPN icon is visible. If it disappears, the app may have been killed by the system – whitelist the app in battery optimization settings.
  • Check that you selected the correct network interface (Wi‑Fi vs. mobile data) in the app’s settings.
• App crashes or “VPN not started” error.
  • Some manufacturers (e.g., Xiaomi, Huawei) restrict background VPN services. Disable aggressive battery saving or enable Auto‑start for the capture app.
  • Restart the device and try again.
• HTTPS traffic is still encrypted.
  • Verify the custom CA is installed and trusted. On Android 10+, you may need to enable Install from unknown sources for the capture app.
  • Remember that apps with certificate pinning cannot be decrypted.
• Large capture files consume storage.
  • Limit the capture duration or filter to specific apps.
  • Periodically delete old .pcap files.

Safety and privacy considerations

Capturing network traffic gives you visibility into passwords, tokens, and personal data. Treat the resulting .pcap files as sensitive:

• Store them in an encrypted folder or delete them after analysis.
• Never share captures that contain personal information without anonymising the data.
• Only capture traffic on devices you own or have explicit permission to monitor.

When to use a root‑based approach instead

If you need to capture traffic from apps that enforce certificate pinning, or you want kernel‑level packet data (e.g., raw Wi‑Fi frames), a rooted solution such as tcpdump via adb is required. The VPN method described here covers the majority of everyday debugging scenarios without the risks associated with rooting.

Wrap‑up

By leveraging Android’s built‑in VPN service, you can record and analyse network traffic without rooting your device. The workflow outlined above—installing a capture app, configuring VPN permissions, exporting a .pcap file, and opening it in Wireshark—provides a practical, low‑risk method for developers, security enthusiasts, or anyone troubleshooting connectivity issues.