Turn Your Android Phone into a Wi‑Fi Sniffer Using Termux – No Root Required

Capturing network packets on a phone is a powerful way to debug apps, verify privacy settings, or simply learn how data moves across a Wi‑Fi network. While full‑blown Wi‑Fi monitoring (monitor mode) normally needs root, you can still sniff the traffic that your Android device itself generates and receives – all without unlocking the bootloader or flashing custom firmware.

Before you start

• Device requirements: Android 7.0 (Nougat) or newer. The steps work on most manufacturers, but menu wording may differ slightly.
• Battery: Ensure the phone is at least 50 % charged or plugged into power – packet capture can keep the CPU busy.
• Wi‑Fi connection: Connect to the network you want to monitor. Remember you will only see traffic to/from the phone, not other devices.
• PC with Wireshark: For deep analysis you’ll need a computer with Wireshark installed (free from wireshark.org).
• Storage space: A capture file can grow quickly. Allocate at least 100 MB of free internal storage.

Step 1 – Install Termux and set up the environment

Why this matters: Updating ensures you have the latest binaries that work with the current Android runtime. The proot-distro package is optional for later Linux‑based analysis, but installing it now avoids extra steps later.

Step 2 – Install tcpdump inside Termux

Note: The binary is built for Android’s ARM/ARM64 architecture. If you run a non‑standard CPU (e.g., x86 tablets) you may need to compile from source – that is beyond the scope of a no‑root tutorial.

Step 3 – Grant the required permissions

Starting with Android 10, apps need explicit runtime permission to access the network interface for packet capture.

If the permission dialog does not appear, you can manually enable it in Settings → Apps → Termux → Permissions.

Step 4 – Identify the Wi‑Fi interface name

Android names its network interfaces differently on each device. The most common names are wlan0 and wlp2s0. We’ll discover the correct one with ip.

ip link show

Look for a line that contains state UP and the word wlan. Example output:

3: wlan0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc mq state UP mode DORMANT group default qlen 1000
    link/ether aa:bb:cc:dd:ee:ff brd ff:ff:ff:ff:ff:ff

In this case the interface name is wlan0. Remember it for the capture command.

Step 5 – Capture traffic with tcpdump

Now we’re ready to start sniffing. The simplest command records everything for a limited time.

When the capture stops you’ll see something like:

12345 packets captured
12345 packets received by filter
0 packets dropped by kernel

That means the capture succeeded and the file is ready for analysis.

Step 6 – Transfer the capture file to a PC

Wireshark on a desktop provides a far richer UI for packet inspection.

Step 7 – Understanding the limitations of a no‑root sniffer

• Only device traffic: Without monitor mode you cannot see packets exchanged between other devices on the same Wi‑Fi network. You’ll capture only what the phone sends or receives.
• Encrypted traffic: Most modern apps use TLS. You’ll see the encrypted payload, not the plaintext. To inspect TLS content you need the app’s private keys (which requires root or a man‑in‑the‑middle proxy).
• Interface name changes: Some OEMs rename the Wi‑Fi interface per boot (e.g., wlan1). If tcpdump reports “interface not found”, re‑run ip link show to verify the name.
• Battery impact: Continuous capture can drain the battery quickly. Use the -c option to limit the number of packets, or the -G option to rotate files by time.

Step 8 – Advanced capture options

Below are a few tweaks you might find useful.

Capture only HTTP traffic

tcpdump -i wlan0 -w http_only.pcap 'tcp port 80'

Capture DNS queries and responses

tcpdump -i wlan0 -w dns.pcap -n -s 0 udp port 53

Limit capture duration to 60 seconds

timeout 60 tcpdump -i wlan0 -w short_run.pcap

Note: timeout is part of the coreutils package. Install it with pkg install coreutils if missing.

Step 9 – Troubleshooting common problems

• tcpdump: permission denied
  1. Confirm you granted the location permission (Settings → Apps → Termux → Permissions).
  2. Restart Termux after granting permissions.
  3. If the device runs Android 12+, you may also need to enable the “Nearby devices” permission because Wi‑Fi scans are tied to it.
• No packets are captured (0 packets)
  1. Make sure the phone is actually using Wi‑Fi, not cellular data. Verify in Settings → Network & internet → Wi‑Fi.
  2. Check the interface name again – a typo will result in a silent failure.
  3. Try a more permissive filter: omit any filter expression and run tcpdump -i wlan0 -w test.pcap.
• Capture file is empty or corrupted
  1. Ensure you have write permission to the target directory. Using ~/storage/downloads avoids sandbox restrictions.
  2. If you see “Permission denied” when opening the file in Wireshark, copy the file to the PC again – sometimes the USB transfer truncates large files.
• tcpdump crashes with ‘illegal instruction’

  This usually means the binary is incompatible with the device’s CPU architecture. Verify your device is ARM64 (most modern phones). If it’s an x86 tablet, consider using Termux’s pkg install qemu-user-static to emulate, but performance will be poor.

Step 10 – Clean up

When you’re done, it’s good practice to remove the large capture files to free space.

rm ~/storage/downloads/wifi_capture*.pcap

You can also uninstall tcpdump if you no longer need it:

pkg uninstall tcpdump

Bonus: Using a USB Wi‑Fi adapter for true monitor mode (optional)

If you ever decide to root your device, a cheap USB‑OTG Wi‑Fi dongle that supports monitor mode can give you full network visibility. The steps are similar, but you would replace wlan0 with the adapter’s interface (often wlan1) and add the -I flag to enable monitor mode. Because this tutorial focuses on a no‑root workflow, we only mention it for future reference.

Wrap‑up

By installing Termux and tcpdump, granting the necessary permissions, and using the right capture options, you can turn any Android phone into a lightweight Wi‑Fi sniffer that records the device’s own traffic. While you won’t see every packet on the network without root, the data you capture is sufficient for debugging apps, checking DNS leaks, verifying that a VPN is actually encrypting traffic, and learning how Android communicates over Wi‑Fi.

Remember to respect privacy – never capture traffic from devices you don’t own or have explicit permission to monitor.