adb抓包

前言本文介绍如何通过 tcpdump 在 Android 手机上抓取网络数据包并在电脑端使用 Wireshark 进行分析。适用于需要排查 App 网络请求、分析接口调用或调试网络问题的开发与测试场景。1. 手机要有 root 权限2. 下载 tcpdump3. adb push C:\Users\zhangkuixun\Downloads\tcpdump /data/local/tcpdump4. adb shell chmod 6755 /data/local/tcpdump5. adb shellsu 获得 root 权限6. cd /data/local7. ./tcpdump -i any -p -s 0 -w /mnt/sdcard/capture.pcap命令参数# -i any: listen on any network interface# -p: disable promiscuous mode (doesnt work anyway)# -s 0: capture the entire packet# -w: write packets to a file (rather than printing to stdout)... do whatever you want to capture, then ^C to stop it ...8. adb pull /mnt/sdcard/capture.pcap d:/Cache9. 在电脑上用 Wireshark 打开 capture.pcap 即可分析 log10. 过滤日志ip.addr182.138.27.88 http.request.methodPOSTExecute the following if you would like to watch packets go by rather than capturing them to a file (-n skips DNS lookups. -s 0 captures the entire packet rather than just the header):adb shell tcpdump -n -s 0Typical tcpdump options apply. For example, if you want to see HTTP traffic:只监听httpadb shell tcpdump -X -n -s 0 port 80根据以上的信息写一个 bat 去执行tcpdump 文件必须在当前目录里。开始 tcpdumpadb push tcpdump /data/local/tcpdumpadb shell chmod 6755 /data/local/tcpdumpadb shell rm -r /mnt/sdcard/capture.pcapadb shell /data/local/tcpdump -i any -p -s 0 -w /mnt/sdcard/capture.pcappause下载 tcpdump 文件到电脑adb pull /mnt/sdcard/capture.pcap capture.pcap问题有些机器 root 后通过 adb shell 后默认不是 root 用户需要输入 su 才能切换到 root这样在执行批处理时会有问题解决方法如下adb shell su -c sleep 1adb start-serveradb push tcpdump /data/local/tcpdump因没有 root 权限导致的问题adb shell su -c /data/local/tmp/tcpdump -i any -p -s 0 -w /mnt/sdcard/netCapture.pcap