Tcpdump for Android Network Development

When network communication is involved in Android development, some fields need to be captured. I have not written the correct Header Format because of the SSDP device. After packet capture analysis and comparison with the standard header, I found this problem that has plagued me for a long time. In short, it is necessary to capture packets in Android phones.

Preparations: Android mobile phones, network environments, tcpdump, and cracking root permissions of mobile phones. We recommend that you install the RE File Manager on your mobile phone and grant root permissions. The procedure is as follows:

First, use the adb tool to push tcpdump to your mobile phone. The tcpdump tool is http://www.strazzere.com/android/tcpdump. The operation can be done with one command: adb push c:/tcpdump/data/local/tcpdump. You can also use other methods to send tcpdump to your mobile phone.

Then, you need to modify the tcpdump permission:

C: \ adb shell

$ Su
# Chmod 777/data/local/tcpdump

When entering the su command, you may need to click the OK button on your phone. In this way, adb can have the permission to modify the attributes of tcpdump.

Start packet capture:

Adb shell
$ Su
/Data/local/tcpdump-p-vv-s 0-w/sdcard/capture. pcap

After the packet capture ends, press ctrl + c. Note: On Windows, ctrl + c is directly interrupted. use ctrl + d or other commands to end the program (Mac OS is not affected ).

Pull out the packet capture file: adb pull/sdcard/capture. pcap c:/if you have not installed the RE File Manager, you may not see the capture. pcap file, but it does exist because of insufficient permissions (the File Created by root is in Android and cannot be viewed by normal permission programs ).

Next, you can use Wireshark to analyze your captured packages. An error may be reported when the file is opened, because if you stop packet capture in an interrupted way, the pcap file is not written at the end. ignore this.

If you have reprinted the results of your hard work, please indicate the source. Thank you!