I'm using cyanogenmod's rom with droidwall activated with whitelist mode, and nothing checked.

I've seen some strange ips being called, and droidwall blocking them. I wan to analyse these packets. Which is the best way?

PS: I dont have Android Market installed.

1 Answer 1


Cyanogenmod has tcpdump installed. You can run it from the shell, just make sure you select the correct interface:

tcpdump -i tiwlan0 -vv

Or, you can write the dump to a file on your sdcard, and analyze it with Wireshark on your desktop later:

tcpdump -i tiwlan0 -w /mnt/sdcard/tcpdump.out

There is also software like Shark for Root, which will capture the packets like tcpdump (it requires root, but does not require tcpdump, which is available on my Cyanogenmod 7.1, but I'm not sure if it is available in all versions of Cyanogenmod).

  • Thanks @haimg. The sdcard option is really interesting. If I stop the command, will it have all dumps from before stopping? Jan 11, 2012 at 2:37
  • @SomebodystillusesyouMS-DOS: Yes, that's the idea...
    – haimg
    Jan 11, 2012 at 4:23
  • I've disabled my adsl modem, and tried to do this command, but it didn't save any http packet. Is this command correct? Am I doing something wrong? Jan 26, 2012 at 0:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .