#NETWORK INSPECTOR ANDROID FOR ANDROID#
#NETWORK INSPECTOR ANDROID ANDROID#
#NETWORK INSPECTOR ANDROID CODE#

The resulting HTTP Toolkit Android app implements all the above. Most of the existing implementations are unmaintained demos, but they are open-source so we can build upon them! My own solution is based on a GitHub proof-of-concept called ToyShark (a pun on Wireshark, I assume) which was in turn based on some of the open-source network collection internals of an old AT&T project called Application Resource Optimizer ( source). We effectively need to reimplement UDP & TCP from scratch!įortunately, we're not the first people to want to do this. Cleanly (or messily) close connections when the upstream socket is done.Write the resulting bytes back into the tunnel.Build our own complete TCP/UDP + IP packet data around the received data.(For TCP) Match that to the tunnelled TCP connection.When we receive a TCP/UDP response from upstream: Send the equivalent TCP/UDP content upstream, using Android's TCP/UDP APIs.(For TCP) Track the connection state of the overall TCP connection, and ack/fin/etc each packet in the session appropriately.Parse the TCP/UDP packet within and extract its content.

Parse the raw packet bytes into an IP packet.

When we read an IP packet from our tunnel: If we want to proxy these bytes, we need to match these two APIs up. Instead, we have higher level APIs for TCP and UDP, and the IP part is always done invisibly under the hood. Our file descriptor works with raw IP data, but Android doesn't actually have an API for us to send raw IP data anywhere else. Unfortunately that's easier said than done. In that case, we get to see every network byte, but we don't interfere with the network connection of the device, and we don't need an externally hosted VPN provider to do it. Things get interesting if rather than forwarding these bytes to a VPN provider, we examine them, and then simply put them straight back on the real network. Once we have a VPN service running, our app will receive every network byte the device sends, and has the power to inject raw bytes back. That's what's this is primarily designed for, but that doesn't mean that that's all we can do with it. The VPN provider would then forward that data on as part of the VPN's traffic, forward response packets back to your app over your connection, and you'd write the resulting packets back to the file descriptor. In that case, your app would forward all the read bytes directly to a VPN provider over some protected separate connection, without any substantial processing of them on the device. This is designed to allow implementing a VPN connection in your app. When you read from it you're given raw network bytes directly, and when you write bytes to it they're treated as bytes received directly from the network interface. Once this is activated, when an app sends some data, instead of that going out to the network, each IP packet is buffered behind this file descriptor. In addition, your VPN service is given the power to create protected sockets that don't use this tunnel, so the VPN app can communicate with the network without going through itself. That tunnel interface is then used by the whole device for all network traffic. These VPN APIs allow you to register a service in your app, which when activated is given a file descriptor that backs a network tunnel interface. The Android developer docs have a VPN guide, which is a good starting point.

Simulating connection issues by adding delays or randomly injecting packet resets.

Recording metrics on the traffic sent & received by your device.

#NETWORK INSPECTOR ANDROID FOR ANDROID#

Building a firewall for Android that blocks outgoing app connections according to your custom rules.

Inspecting & rewriting mobile traffic for testing & debugging (this is HTTP Toolkit's raison d'être).

There are some interesting & constructive use cases this opens up though for developer tooling. In addition this doesn't give you any way to read the contents of encrypted traffic, by default (in the next post, we'll talk about how HTTP Toolkit can do that). When you actually do this Android provides clear warnings & permission prompts to the user during setup, and requires persistent UI notifications any time this is active. To be clear, this is not intended (or very effective) as a attack on the security of traffic from the device.

#NETWORK INSPECTOR ANDROID CODE#

Here I want to talk through how that works, look at the code that makes it happen, and show you how you can do the same thing for yourself. HTTP Toolkit does exactly this, by building an app on top of the Android VPN APIs that fully simulates a fake VPN connection entirely within the device. Can you build an Android app that can inspect & rewrite the network traffic from every other app on the device?

Network inspector android