network-traffic-debug

Android network traffic is captured end-to-end by routing device connections through a SOCKS5 proxy and VPN tunnel, enabling simultaneous on-device packet capture and TLS interception for comprehensive traffic inspection.

TLS traffic interception is achieved by starting mitmproxy in SOCKS5 mode, configuring the Android device to route its connection through the proxy, and applying appropriate device configuration to decrypt secure debugging traffic.

Raw packet capture is supported on non-rooted Android emulators by running tcpdump directly on the VPN tunnel interface, allowing you to capture network traffic without requiring elevated device privileges.

PCAP export and analysis is handled by utilizing PCAPdroid-friendly capture workflows, which allow you to record on-device network traffic and export it directly into PCAP format for external inspection.

DNS behavior and routing are validated by running TUN interface diagnostics directly on the Android device, checking how the VPN tunnel handles network path requests and resolves domain queries across the host and device.

Setting up the network traffic debugging environment requires installing mitmproxy and tcpdump, alongside appropriate Android device configuration, to enable end-to-end traffic capture and route validation across host and device.