How to capture packets using tcpdump in android

Adbrootadbremountadbpush/wherever/you/put/tcpdump/system/xbin/tcpdumpadbshellchmod6755/data/local/tmp/logs/wherever/you/put/tcpdump/s adb root
Adb remount
Adb push/wherever/you/put/ Tcpdump/System/xbin/ Tcpdump
Adb shell chmod 6755/data/local/tmp/tcpdump
Adb root
Adb remount
Adb push/wherever/you/put/tcpdump/system/xbin/tcpdump
Adb shell chmod 6755/data/local/tmp/tcpdump

Running tcpdump

You need to have root access on yourdevice.

Batch mode capture

The typical procedure is to capture packets to a fileand then examine the file on the desktop, as your stratedbelow:


Adb shell tcpdump-I any-p-s 0-w/sdcard/capture. pcap

# "-I any": listen on any networkinterface

# "-P": disable promiscuous mode (doesn' t workanyway)

# "-S 0": capture the entire packet

# "-W": write packets to a file (rather than printing tostdout)

... Do whatever you want to capture, then ^ C to stop it...

Adb pull/sdcard/capture. pcap.

Sudo apt-get install wireshark # or ethereal, if you're 'restill on dapper

Wireshark capture. pcap # or ethereal

Look at your packets and be wise

An interactive shell or slave terminal generated in the tcpdump background. By default, tcpdump captures all traffic without filtering. Add a similar expression for tcpdump port 80 if you like. Real-Time packet monitoring
If you perform the following operations, you prefer to view the packages instead of capturing them into a file (you can search for the DNS. -0 capture the entire package, not just the title ):


Adb shell tcpdump-n-s 0

Adb shell tcpdump-n-s 0

Typical tcpdump options apply. For example, if you wantto see HTTP traffic:

Adb shell tcpdump-X-n-s 0 port 80