Android Enthusiasts Stack Exchange is a question and answer site for enthusiasts and power users of the Android operating system. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using cyanogenmod's rom with droidwall activated with whitelist mode, and nothing checked.

I've seen some strange ips being called, and droidwall blocking them. I wan to analyse these packets. Which is the best way?

PS: I dont have Android Market installed.

share|improve this question
up vote 3 down vote accepted

Cyanogenmod has tcpdump installed. You can run it from the shell, just make sure you select the correct interface:

tcpdump -i tiwlan0 -vv

Or, you can write the dump to a file on your sdcard, and analyze it with Wireshark on your desktop later:

tcpdump -i tiwlan0 -w /mnt/sdcard/tcpdump.out

There is also software like Shark for Root, which will capture the packets like tcpdump (it requires root, but does not require tcpdump, which is available on my Cyanogenmod 7.1, but I'm not sure if it is available in all versions of Cyanogenmod).

share|improve this answer
Thanks @haimg. The sdcard option is really interesting. If I stop the command, will it have all dumps from before stopping? – Somebody still uses you MS-DOS Jan 11 '12 at 2:37
@SomebodystillusesyouMS-DOS: Yes, that's the idea... – haimg Jan 11 '12 at 4:23
I've disabled my adsl modem, and tried to do this command, but it didn't save any http packet. Is this command correct? Am I doing something wrong? – Somebody still uses you MS-DOS Jan 26 '12 at 0:02

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.