The difference between using tcpdump and rawsocket to sniff packets?

Question

I tried to capture the package on VoLTE android phone. Which has an IPv6 addr when I turn on the VoLTE.

connect to android phone shell through adb shell

This address is used by the phone to connect to the ims core net.

What I trying to do :

sniff the package on this interface by tcpdump. But I can't get anything. Is there any one do the similar thing?

  # tcpdump -i rmnet_ims -s 0 -n -w package.pcap

next step I try to use rawsocket to sniff the packet . I don't know the difference between them. What I know is that tcpdump base on libpcap . And if the package doesn't go into the linux network stack, tcpdump can not catch them.

Answer 1

Assume you have root access to the phone, you should get all the packets sent/received by the phone on that interface. The only concern is, they would be encrypted.