24/7 packet capture in Android using tcpdump

Question

I would like to get packet level data traffic captures (.pcap) in Android during a week (in several files if possible).

I thought that I could use tcpdump via Shark, however I find that the capture stops after some time. The biggest packet capture I got is around 40MB. I found out that tcpdump stops/crashes when changing the network interface. For example, when the phone is connected to 3G, when I run tcpdump from Shark I can see the process of tcpdump running until I switch on WiFi.

In the Galaxy S2, when connected via WiFi I have the following interfaces (got by using netcfg in adb shell): lo, svnet0, usb0, sit0, eth0. When I connect via 3G, I get pdp0 instead of eth0.

Is there any way that I can run tcpdump 24/7? Or any way to check when it is running and if it stops make it run again from a Java app? Checking the process of tcpdump or something like this maybe? Or monitoring the status of the network and running tcpdump every time the network is changed?

I had a look to: ReadLine on TCPDump-Buffer sometimes blocks until kill tcpdump , but it does not completely solve my problem.

I am using rooted devices.

Answer 1

How about trying tPacketCapture application ( works with non-rooted devices)

Android OS 4.0

Free

https://play.google.com/store/apps/details?id=jp.co.taosoftware.android.packetcapture

Answer 2

If you have rooted device then use SimplePacketCapture instead of tPacketCapture. tPacketCapture creates a vpn that can break your voip application.

Answer 3

I'v tried as follow to see what's going on about tcpdump after alternating network interface.
1.open wifi run tcpdump-arm
2.run ps|grep tcpdump-arm
3.close wifi and open mobile interface
4.run ps|grep tcpdump-arm

I've found that when alternating the network interface on the mobile phone, the tcpdump-arm process is still working, but it captures no packets.

I think you need tcpdump to keep capturing even when the network interface changed. You can catch the connectivity change broadcast as the tutorial of google says at first.
Then, you should run "killall" to kill the tcpdump processl
At last, restart the tcpdump process, if you don not specify an interface, it will listen on the newly opened interface.If you would like the tcpdump to return quickly, you can add "-l" option as the answer in TCPDump-Buffer sometimes blocks until kill tcpdump implies.