Technical Tip: Perform Application Based packet capture on Android devices using PCAPdroid - Fortitoken Mobile, FortiClient, FortiExplorer

[jiahoong112]

Description	This article describes how to use PCAPdroid to troubleshoot Fortinet products. PCAPdroid is an Android application that can be downloaded from the Google Play Store to perform packet captures on the device. This can be useful when troubleshooting issues related to Fortitoken Mobile, FortiClient Android, FortiExplorer, etc. These on-device packet captures can be done in conjunction with debugs and packet captures that are done at the same time on the FortiGate to more effectively troubleshoot issues.
Scope	Android devices.
Solution	Download the PCAPdroid from the Google Play Store:                                    After opening the application, tap on ‘Target apps’ to select the application that intends to perform the packet capture. If not doing so, then the application will just capture all packets.                                                                       Once the target application is selected, options will be available to choose the specific application for which the capture is desired, as shown below: To capture website traffic from Google Chrome, simply select the Chrome application as shown below: Then try accessing www.fortinet.com on the Chrome browser. As the PCAP file has been saved in the device storage, it is possible to browse it by opening the File Manager, browsing to the Downloads folder, and then the PCAPdroid folder.                                                   Once the pcap is opened, the packet capture for the www.fortinet.com website can be viewed and analyzed. The PCAP file can then be uploaded to Google Drive, OneDrive, etc, and can be accessed through the computer. The PCAP file can then be uploaded to the TAC ticket.