How to Capture and Analyze Android Network Traffic Using Termux and tcpdump (No Root)

Why capture network traffic on Android?

Understanding what data your apps send and receive can help you spot privacy leaks, debug connectivity problems, or verify that a VPN is actually routing traffic. Unlike desktop operating systems, Android does not expose a built‑in packet sniffer, so you need a lightweight, command‑line tool that works on the device itself.

This tutorial shows how to use Termux – a terminal emulator and Linux environment for Android – together with tcpdump to record packets from a single app. The method works on Android 8‑13 without requiring root access. Because the capture runs under the app’s own UID, you only see traffic that belongs to that app, which is usually enough for privacy checks and debugging.

Before you start

• Device requirements: Android 8 (Oreo) or newer, at least 2 GB of free storage, and a USB‑C or micro‑USB cable for file transfer.
• Computer: Any PC or Mac with Wireshark installed (free).
• Permissions: You will grant Termux access to storage (so the capture file can be saved) and enable Developer Options → USB debugging.
• Battery: Keep the phone plugged in or ensure >50 % charge; packet capture can be CPU‑intensive.

Step 1 – Install Termux and prepare the environment

Why these steps matter: updating ensures you get the latest binaries, and termux-setup-storage creates a /storage/emulated/0/ shortcut inside Termux, making it easy to move files to your PC later.

Step 2 – Install a compatible tcpdump binary

Termux’s package repository does not ship tcpdump because it needs raw socket access, which is restricted on non‑rooted devices. However, a pre‑compiled, non‑root version exists that works when launched via the app’s own UID. Follow these steps:

Note: This binary captures only traffic that the invoking UID can see. That means you can capture packets from the app you run run-as on, but you cannot see system‑wide traffic without root.

Step 3 – Identify the package name of the target app

You need the exact Android package identifier (e.g., com.whatsapp) to run the capture under that app’s UID.

Write down the package name – you will need it in the next step.

Step 4 – Switch to the app’s UID with run-as

The Android run-as command lets you execute commands as if you were the app itself, provided the app is debuggable. Many popular apps are not debuggable by default, but you can still capture traffic from any app that you have installed from the Play Store by using the adb shell run-as trick when the device is in developer mode. If the app is not debuggable, the method will fail, and you will need root or a VPN‑based capture tool.

After stopping, you will have a capture.pcap file stored in /sdcard/Download. Because the file lives in shared storage, Termux can access it later.

Step 5 – Pull the capture file to your computer

Now you have a standard PCAP file that any network analyzer can read.

Step 6 – Open and analyze the capture with Wireshark

Wireshark provides a graphical interface to filter, decode, and visualize packets.

By inspecting the filtered view you can answer questions such as:

• Does the app contact third‑party analytics domains?
• Are any requests sent over plain HTTP?
• What is the typical request‑response latency?

Alternative: Capture without run-as using a VPN‑based app

If the target app is not debuggable, the run-as method will fail with run-as: Package 'com.example.app' is not debuggable. In that case you have two practical options:

1. Use a VPN‑based packet capture app (e.g., Packet Capture or tPacketCapture). These apps create a local VPN, route all traffic through it, and write a PCAP file without requiring root. The downside is that they cannot capture traffic from apps that use certificate pinning unless you also install a user‑installed CA certificate.
2. Root the device and run the standard tcpdump binary with su. Rooting is outside the scope of this tutorial because it voids warranties and may brick devices.

Both alternatives are mentioned here so you can decide which path matches your risk tolerance.

Troubleshooting

1. run-as reports “package not debuggable”

Most production apps are built with android:debuggable="false". You can only use run-as on apps you have built yourself (e.g., a test version of the target app). To work around this:

• Install a debug build of the app (use Android Studio or the adb install -t flag).
• Temporarily enable android:debuggable by modifying the APK with apktool, but this requires re‑signing and is not recommended for casual users.

2. tcpdump exits immediately with “permission denied”

Even with run-as, the binary may need the CAP_NET_RAW capability, which is granted only to root. The pre‑compiled binary used in this guide is built with the --disable-suid flag to work under a normal UID, but it still fails on some OEM‑restricted ROMs. If you encounter this:

• Try the --interface any flag omitted; some devices expose lo only.
• Switch to a VPN‑based capture app as described above.

3. Capture file is empty or only contains DNS queries

This usually means the app’s traffic is encrypted inside a VPN tunnel or uses QUIC over UDP, which the simple tcpdump build may not see on the any interface. To capture QUIC:

• Specify the UDP port used by the service (e.g., -i any udp port 443).
• Disable any system‑wide VPN before starting the capture.

4. Wireshark cannot open the file ("Invalid file format")

Make sure the capture was written with -w. If you used -c (capture count) without -w, tcpdump prints packets to stdout, which Termux may have discarded. Re‑run the capture with the proper -w flag.

Safety and privacy considerations

• Data sensitivity: Captured packets may contain personal data, authentication tokens, or cookies. Store the .pcap file in an encrypted folder or delete it after analysis.
• Legal compliance: Only capture traffic from apps you own or have explicit permission to monitor. Intercepting other users’ traffic without consent can violate local laws.
• Device stability: Running tcpdump for extended periods can increase CPU usage and battery drain. Limit captures to a few minutes unless you have a power source.

Recap of the workflow

1. Install Termux and grant storage access.
2. Download a non‑root tcpdump binary and make it executable.
3. Find the target app’s package name.
4. Enable USB debugging and connect the phone to a PC.
5. Use adb shell run-as <package> to switch to the app’s UID.
6. Run tcpdump -i any -s 0 -w capture.pcap while you exercise the app.
7. Stop the capture, pull the .pcap file to your computer.
8. Open the file in Wireshark, apply filters, and review the traffic.

Following these steps gives you a reproducible, no‑root method to peek inside an Android app’s network behavior. The same pattern can be reused for any app you develop or audit, making it a valuable addition to your Android troubleshooting toolkit.