In July 2010, a developer posted Shark for Root to the XDA forums as a replacement for AndroShark, a capture tool whose original author had stopped releasing updates. Shark for Root, a front end for the tcpdump packet-capture utility, became one of the best-known network tools for rooted Android handsets. It is the app that later how-to posts pointed readers to when they needed tcpdump settings.
What did Shark for Root do?
It captured network traffic on a phone with root access and wrote it to a pcap file. Users could then open the file in Wireshark on a computer. A Computerworld guide to monitoring Wi-Fi traffic on Android listed it, with SniffDroid, as a free and simple sniffer. Both needed another app to view the packets.
Shark for Root had a companion viewer, SharkReader. According to the developer’s own XDA posts, the viewer labelled any packet it did not recognise as RAW, which at the time meant anything that was not TCP or UDP. Traffic was tagged by content signature and port, and filters could use those tags.
How were the capture parameters set?
The parameter field in Shark for Root passed options straight to tcpdump. The developer told users to read tcpdump manuals and examples rather than app-specific documentation. A user who entered options the tool rejected could see the capture fail at start, which is the problem the linking blog post describes.
The same XDA thread records an early bug report. A user on CyanogenMod 6 said pressing stop did not end the capture, and the file kept growing. Users of rooted phones were therefore advised to confirm that a capture had really ended.
What else ran on rooted handsets?
The Computerworld guide named several alternatives:
- Dr Network, which bundled basic tools such as Ping, Netstat, Tcpdump, ARP cache and IP routing table views.
- bitShark, a paid app priced at US$2.99 in that guide.
- Wi.cap. Network sniffer Pro was listed at US$15.00.
Computerworld said the two paid sniffers offered only packet sniffing. It described their interfaces as friendlier than the free apps’ and better for analysing packets on the phone itself. They could still export pcap files.
Why does root matter for packet capture?
Capturing raw packets needs privileges that ordinary Android apps do not have. That is why these tools were limited to rooted devices. A current example is SharkDroid, which brings Wireshark’s dumpcap and tshark tools to Android. Its F-Droid listing says live capture requires root, while opening saved capture files does not. It lists support for BPF capture filters, Wireshark display filters and streaming captures to desktop Wireshark over an authorised USB adb connection.
The listing also states the limits. Wi-Fi monitor mode is not supported, and encrypted TLS or QUIC content cannot be read without the keys. The app has no internet permission, advertising or telemetry, and captures stay in app-private storage until the user exports them.
Is there a way to capture without root?
Yes. A 2025 guide from the 0xTeamSec security blog describes Packet Capture, a Play Store app that uses a local VPN to intercept traffic. That route trades raw-interface access for convenience. The same guide still lists Shark for Root as a graphical tcpdump front end for rooted devices. It also covers running tcpdump through Termux.
Captured traffic can contain credentials, messages and personal data. Capture only devices and networks you own or are authorised to test, and store or delete pcap files with the same care as any sensitive log.