Capture Android Network Traffic with Wireshark Using ADB (No Root)

Why capture Android traffic without rooting?

Developers, security enthusiasts, and power users often need to see exactly what data their phone sends and receives. A full packet capture lets you verify SSL pinning, debug API calls, or spot unwanted telemetry. Rooting would give you raw access to tcpdump, but it also voids warranties and introduces security risks. This guide shows a completely no‑root workflow that relies on a trusted open‑source app (PCAPdroid) and the standard Android Debug Bridge (ADB) to move the capture to your PC where Wireshark can dissect it.

Before you start

• PC with Wireshark installed – download the latest stable version from wireshark.org for Windows, macOS, or Linux.
• ADB installed on the PC – you can get it via the Android SDK Platform‑Tools package (https://developer.android.com/studio/releases/platform-tools).
• USB cable (or Wi‑Fi ADB) – a good quality data cable avoids intermittent connections.
• Android device running Android 7.0 or newer (the VpnService‑based capture works on most modern phones).
• Enough free storage – a 10 minute capture of normal browsing can fill 5‑10 MB per megabyte of traffic.

Make sure the phone is charged above 50 % or keep it plugged in; the capture runs continuously and may drain the battery quickly.

Step 1 – Enable Developer Options and USB debugging

Why this matters: ADB needs the debugging flag to communicate with the device over USB. Without it the PC cannot pull files or issue commands.

Step 2 – Install PCAPdroid (the no‑root capture engine)

The app uses Android’s VpnService API, which runs in user space and can capture packets from every app while preserving the original network flow.

Step 3 – Configure the capture parameters

What you’ll see: the notification shows the current file name (e.g., capture_2024‑10‑13_15‑30‑00.pcap) and the amount of data captured so far.

Step 4 – Perform the network activity you want to analyse

Use the phone normally – browse a website, open the app you are testing, or trigger the network request you suspect is problematic. All packets that pass through the VPN are written to the .pcap file in PCAPdroid’s private storage.

Step 5 – Stop the capture and locate the file

If you forget the path, you can also retrieve the list of capture files via ADB (see the next step).

Step 6 – Pull the capture file to your PC using ADB

Why we use ADB: pulling via ADB respects the app’s private storage sandbox, so you don’t need a file manager with root rights.

Step 7 – Open the capture in Wireshark

Now you can verify whether the app is sending the data you expect, spot unexpected redirects, or confirm that certificate pinning is active (you’ll only see the TLS handshake, not the payload).

Troubleshooting

1. No packets appear in Wireshark

• Check that the VPN is active – the persistent notification from PCAPdroid must be present. If it disappeared, the capture stopped.
• Ensure the correct file was pulled – sometimes older captures remain in the folder. Verify the file size; a zero‑byte file means the capture never started.
• ADB connection issues – run adb kill-server then adb start-server. Re‑connect the USB cable if necessary.

2. Capture file is empty or only contains DNS queries

• Some devices block VPN‑based capture for certain system apps. Try disabling Battery optimization for PCAPdroid (Settings → Apps → PCAPdroid → Battery → Don’t optimize).
• Make sure you performed network activity after starting the capture. Opening a website or refreshing an app is a quick test.

3. Wireshark reports "File format not recognized"

• PCAPdroid can export in pcapng as well. If you selected that format, change the file extension to .pcapng and open it again.
• Verify that the file was fully transferred; a truncated transfer can corrupt the header.

4. Android shows “VPN not allowed for this app”

• Some manufacturers (e.g., Huawei, Xiaomi) ship a custom VPN manager that restricts third‑party VPNs. Open Settings → Network & internet → VPN and make sure PCAPdroid is listed as an active VPN.
• If the device refuses to start the VPN, you may need to disable any pre‑installed VPN or security app that enforces its own policy.

Safety and privacy notes

Alternative approaches (when PCAPdroid is not an option)

• Use a packet‑capture app that writes to pcap via a local VPN – e.g., "Packet Capture" or "tPacketCapture". The workflow is identical: start capture, pull file with ADB.
• Run tcpdump on a rooted device – you can start it directly with adb shell su -c "tcpdump -i any -w /sdcard/capture.pcap" and stream the output to Wireshark with adb exec-out tcpdump -i any -w - | wireshark -k -i -. This method is faster but requires root.
• Use a hardware proxy such as a Wi‑Fi router running OpenWrt with tcpdump, and point the phone’s Wi‑Fi to that router. This captures traffic without any software on the phone but requires extra hardware.

Wrap‑up

By combining the free PCAPdroid app with ADB and Wireshark, you get a fully functional, no‑root network‑traffic capture solution that works on the majority of Android phones. The steps above give you a repeatable workflow: enable debugging, start the VPN‑based capture, perform the activity, pull the file, and analyse it in Wireshark. With the troubleshooting tips and safety notes, you can confidently investigate API calls, verify encryption, or debug connectivity problems without compromising device security.