Android Traffic Capture

This guide walks you through capturing the traffic inside a phone / emulator on Android, step by step. Android capture most often gets stuck on certificates — you install the certificate in the app and it still isn't trusted, and apps with certificate pinning can't be captured at all. Here's a different approach: whole-device capture + automatic decryption, with no certificate installed on the phone at any point; it works on both real devices and emulators, and even apps with pinning and custom encryption can have their plaintext extracted from the inside. Follow the steps below to capture your first request.

1. When to Use It, and How to Choose Among the Methods

Match your device and goal first, then jump to the corresponding steps below:

Your situation	Which one to use	Need root?	Install a certificate?
Old device / emulator / unsure about age, want the most reliable	NIC key (recommended default)	Yes	No
Newer rooted real device, want the least hassle	NIC capture	Yes	No
Only care about one app, or it only emits ciphertext in whole-device mode	App-layer capture	Yes	No
Device isn't rooted, or you want to view and modify on the fly (rewrite / replay)	Proxy capture	No	Yes (see Section 2)

• The first three are all whole-device / targeted capture + automatic decryption, with no certificate installed on the phone — that's exactly what makes them easier on Android than traditional proxy capture.
• If unsure, start with "NIC key": it has the best compatibility and works on almost any rooted device.
• Only proxy capture requires installing a certificate; Section 2 below explains how to get around the certificate problem on newer Android versions.

2. Prerequisites

General setup (real device)

1. Connect the phone to the computer with a data cable, and enable USB debugging on the phone (in "Developer options").
2. On first connection, the phone prompts "Allow USB debugging?" — tap Allow.
3. Launch TraceEagle; the device appears in the list of selectable devices. Emulators need no cable and are usually detected automatically.

About root

• The first three capture methods (NIC key / NIC capture / app-layer capture) all require a rooted device. Emulators usually come with root or can enable it with one click, so they qualify.
• None of these three require installing a certificate on the phone: they aren't man-in-the-middle proxies and don't rely on the phone trusting a certificate to decrypt. The helper components needed for capture are downloaded and cached automatically according to the device architecture, so you don't have to set up the environment manually.

About certificates (only proxy capture needs them)

• Only proxy capture requires installing a root certificate on the phone. And newer Android versions don't trust user-installed certificates by default — which is the root cause of "I installed the certificate but still can't capture."
• Two ways to handle it: ① if the device is rooted, you can let the tool install the trusted certificate at the system level automatically, skipping the manual steps; ② or skip certificates entirely and switch to the certificate-free whole-device methods above (NIC key / NIC capture). For the full certificate installation steps, see Certificate Installation.

3. NIC Key: Whole-Device Capture (Recommended Default)

Captures all traffic on the device's NIC (Wi-Fi by default) and decrypts it automatically, with no need to pick an app or install a certificate. Best compatibility — works on old devices and all kinds of emulators.

1. Select the target device in the device list (real device or emulator).
2. Choose "NIC key" as the capture method.
3. Choose the NIC to capture; normally just keep the default Wi-Fi.
4. Click Start.
5. Use the app normally on the phone to generate network requests; traffic appears in the request list in real time.

An emulator's system kernel is often old and may not support "NIC capture" — in that case just use "NIC key," which has the best emulator compatibility.

4. NIC Capture: Whole-Device Capture (Newer Real Devices, Least Hassle)

Also captures all traffic on the device's NIC and decrypts it automatically; it's characterized by being self-contained and the least hassle (the data and the information needed for decryption are packaged together).

1. Select the target device.
2. Choose "NIC capture" as the capture method.
3. Choose the NIC (default Wi-Fi).
4. Click Start and generate requests on the phone to see live traffic.

The prerequisite is a relatively new device (newer kernel). If the device is too old to qualify, starting capture will clearly report "NIC capture not supported" — just follow the prompt and switch to NIC key.

5. App-Layer Capture: Focus on One App, Pull Plaintext from Inside

Targets a single app and pulls plaintext directly from inside it — certificate pinning and custom encryption can't stop it. For apps whose traffic can't be decrypted in whole-device mode, use this targeted approach.

1. Select the target device.
2. Choose "App-layer capture" as the capture method.
3. Specify the app to capture: pick it from the installed app list, or enter its package name / process name; leave it blank to capture the current foreground app.
4. To capture traffic from the app's early startup, check "Restart target program" (it will close the app and relaunch it).
5. Click Start and use that app to see its requests.

When the regular approach can't get plaintext (stubborn apps with static linking / custom libraries), turn on the "socket traffic" switch as a fallback and take a lower-level path to the data.

---

6. Proxy Capture: No Root, or View-and-Modify on the Fly

When the device isn't rooted, or you need to do rule rewriting / replay on requests, take the proxy route: point the phone's Wi-Fi proxy at your computer and install the root certificate, and you can capture HTTPS plaintext just like on a PC, with full rewrite and replay capabilities.

1. In the phone's Wi-Fi settings, point the proxy at your computer (the tool provides the address and port).
2. Install the root certificate on the phone: usually by scanning a QR code for one-click installation; see Certificate Installation for details.
3. On newer Android versions where apps don't trust user certificates: if the device is rooted, let the tool install the certificate at the system level; if the app uses certificate pinning, see Bypassing Certificate Pinning.
4. Go back to the tool and start capturing, then use the app on the phone.

7. Verification: Confirming You Captured and Decrypted

Click any entry in the request list and check the details:

• You can see the request: the request line, request headers, and body are all there.
• TLS shows "Decrypted": the response is readable plaintext (e.g., JSON), not garbled ciphertext.

With whole-device methods (NIC key / NIC capture), HTTPS for most apps shows up as plaintext directly; a few apps that use built-in / non-standard crypto components may only emit ciphertext — use app-layer capture to target them.

---

8. Can't Capture or Decrypt? Check Item by Item

Symptom	Most likely cause	What to do
Device doesn't appear in the list at all	USB debugging not enabled, or "Allow" not tapped	Enable USB debugging on the phone and allow this computer; restarting the emulator once usually gets it detected
"NIC capture not supported"	Device kernel is too old to meet the NIC capture prerequisites	Switch to NIC key, which doesn't care about the kernel
Traffic captured, but one app only shows ciphertext	That app uses built-in / non-standard crypto components	Switch to app-layer capture for that app to get plaintext from inside
App-layer capture also can't get plaintext	The target is a stubborn app with static linking / custom libraries	Turn on the "socket traffic" switch as a fallback
You only want the few requests from when the app starts, but always miss them	The app is already running when you start capturing	In app-layer capture, check "Restart target program" to capture its early-startup traffic
Certificate installed, but HTTPS still can't be captured through the proxy	Newer Android doesn't trust user certificates by default, or the app uses certificate pinning	If rooted, install the certificate at the system level; or just switch to the certificate-free NIC key / NIC capture; for pinning see Bypassing Certificate Pinning

Next Steps

• How to read, switch views, and decode after capturing: see Data Viewing and Decoding.
• To modify a request before sending it, or intercept and edit it mid-flight: see Request Construction and Replay, Rule Rewriting and Breakpoint Interception.
• For an app's certificate pinning: see Bypassing Certificate Pinning.
• To capture iPhone / iPad: see iOS Capture.