In today’s world there is an app for everything. We’ve all been conditioned to point our phones at the QR code to install the companion application for our watches, lightbulbs, cars, hotel rooms, restaurant menus, and washing machines. It happens over and over for almost every device and service we interact with.
In today’s connected world, employers often require their employees to install Mobile Device Management software onto their personal smartphones. The organization wants to put MDM software onto employee’s phones so that they can become safe nodes on their networks. Safe means some level of management and monitoring of the device’s applications, and data streams. This post isn’t about MDM software though.
This article is about monitoring who our smartphones are communicating with. Did that app uninstall or did it leave trackers that still report to the developer? Is that AI app sending our personal info to more places than we think? Is there spyware present ? Analyzing a mobile device’s network communications can go a long way toward answering questions like these.
Generally, the go to method for obtaining this type of information would be to install a network capture utility. Packet capture apps log and report on everything that passes through any of your device’s network connections. They acquire the information by installing a special driver into the network stack. Wireshark is a well known packet capturing tool that you may have heard mentioned in IT circles.
The installation of packet capturing software and its associated low-level drivers usually requires root or admin level access to the operating system. You can gain root level access to most mobile operating systems through a process called rooting. Here lies the conundrum. Rooted phones can arguably be more susceptible to attacks and manipulation. So, MDM software often blocks units that have been rooted from accessing company data.
This results in a situation in which people that use their phone for work are prevented from monitoring it’s data streams themselves. Enter PCAPdroid, it uses a VPN connection that loops back to your own Internet connection. It is an ingenious solution. Setting up a VPN connection does not require root. PCAPdroid sees most of the same network communications that a packet capture tool would, without triggering an MDM block.
PCAPdroid is open source and its base network logging and reporting functions are free. There are several ways to filter and view the information gathered by the app. In the settings you can enable full PCAP capturing and exporting. There’s also an option to decrypt traffic that is otherwise hidden from the report. I find myself using the apps and connections views along with the text filter most often.
There are paid unlocks available for advanced features like a customizable firewall and malware detection. I have other tools that do those jobs on my smartphone right now, so I didn’t purchase or test any of the DLC functions.
So far, I haven’t observed any unexpected connections on my phone. The knowledge gives me piece of mind. PCAPdroid has proved to be a very useful application. It’s great for keeping an eye on who your devices are connecting to. It’s also been useful in troubleshooting various applications and network connectivity issues. I haven’t seen or used a better tool for logging network traffic on Android. If you are prevented from rooting your device, it is the simplest way to get the information that I have found.
techbloggingfool.com 