Monitor device traffic with a spare Android phone¶

A rooted spare Android phone running PCAPdroid as a WiFi hotspot can capture traffic from a suspect device that connects through it. It needs no specialised hardware beyond a second Android phone, and nothing is installed on the device being checked. Whether the tethered traffic actually reaches the capture depends on the spare phone, so the setup is tested before it is trusted.

The phone acting as the monitor runs PCAPdroid. The suspect device connects to the hotspot that phone creates, and PCAPdroid captures what passes over the phone’s own uplink. You can then inspect that traffic, or export it for analysis elsewhere.

Before checking anyone else’s device, confirm you have their informed consent and that they understand what the process involves. The person whose device is being checked needs to be present and in control of the decision.

What you need¶

A rooted spare Android phone running Android 6 or later. It does not need to be fast or have much storage; it is only acting as a hotspot and capture point. PCAPdroid is free on the Play Store, on F-Droid and from its GitHub releases, with a few paid extras.

The suspect device can be any phone, tablet, or laptop that can connect to a WiFi hotspot. You do not need to install anything on it.

Set up the hotspot¶

On the spare Android phone, go to Settings, then Network and internet, then Hotspot and tethering, then Wi-Fi hotspot. Give the hotspot a neutral name that will not raise suspicion if the person whose device you are checking notices it. Enable the hotspot.

Install and configure PCAPdroid¶

Install PCAPdroid on the spare phone from the Play Store or F-Droid. Open it, and enable root capture in its settings. The default VPN mode needs no root, but it sees only the spare phone’s own traffic, never that of connected devices.

On a rooted spare phone, PCAPdroid’s root capture reads raw packets from whichever interface the phone is using for its own internet access, not from the hotspot interface. Whether the suspect device’s traffic shows up there depends on how the phone routes tethered traffic. The FAQ goes no further than “depends on your OS implementation”. Expect to test it before relying on it, and expect no TLS decryption in root mode.

If the spare phone is not rooted and you do not want to root it, PCAPdroid cannot see the suspect device’s traffic at all. The PCAPdroid FAQ is plain about this: it captures only the traffic of the phone it runs on, and hotspot traffic usually needs root. The one workaround the FAQ offers is to run an HTTP proxy on the spare phone and point the suspect device at it, which shows HTTP and HTTPS traffic only.

Running a capture¶

With PCAPdroid running and the suspect device connected to the hotspot, press the start button on PCAPdroid’s main screen. Let the suspect device run normally for ten to twenty minutes: open the apps that are suspected of behaving badly, send and receive messages, and allow background processes to run.

PCAPdroid logs each connection in real time. The Connections tab shows the remote host or domain, the protocol, the last seen time and the data volume. It names the app behind a connection only for apps on the spare phone itself. Traffic from the suspect device arrives with no app attached, so the host and the timing are what you have. You can tap any connection to see more detail.

Look for connections to hosts you do not recognise, particularly if they occur in the background without any visible activity on the suspect device. Regular periodic connections to the same external host, especially outside the times when an application would normally need to communicate, suggest a check-in or heartbeat from monitoring software.

PCAPdroid’s malware detection checks destinations against third-party blacklists and flags matches. It is a paid extra on every build, and the author gives “no guarantee” on its accuracy.

Reviewing and exporting the capture¶

Set the dump mode to PCAP file before starting. The default is an HTTP server on port 8080 that hands the capture to any device on the local network, which on a hotspot includes the suspect device. At the end of the session the PCAP file is a standard format readable by Wireshark and other analysis tools. If you want to inspect the traffic in more detail, or share it with a technical specialist, export the PCAP from the PCAPdroid menu and transfer it to a computer.

Wireshark can filter the PCAP by destination address, protocol, or time window to look at specific patterns. The PCAPdroid interface is sufficient for initial triage; Wireshark is useful for deeper investigation.

What this does and does not tell you¶

PCAPdroid sees the network traffic at the IP level. It has a TLS decryption mode, but that applies to the spare phone’s own apps and, in the documentation’s words, “decryption on common apps will not usually work”, since apps built for Android 7 or later distrust user-installed certificates. For a suspect device on the hotspot the content of encrypted traffic stays closed. What it can tell you is which remote hosts the device contacted, how often, and how much data was transferred.

A device contacting a known stalkerware server is a strong indicator. A device sending regular small packets to an unfamiliar host may indicate a heartbeat. Large data transfers at unexpected times may indicate exfiltration. None of these are conclusive alone, but patterns across a monitoring session build a picture.

If the assessment produces concerning results, contact a specialist organisation before taking action on the device itself. The Coalition Against Stalkerware lists support organisations by country, and advises reaching out from a device the suspected person has never had access to. See the check a device for stalkerware playbook for the considerations around next steps.

Last reviewed: 2026-09-04.