Not able to capture Android traffic with Fiddler

[Edna]

I would like to see what is going through my Android device at all, not for a certain app. Therefore, I saw this tutorial and did everything step by step.

• Fiddler Classic is installed my laptop computer, which is NOT, but is connected to my access point.
• I have an Android tablet device which is NOT, but is connected to my access point.

As you can see on the attached screenshot, the packet sizes were 0 and it says "Tunnel to" ?!

I've read, the reason is because there would be no trust to Fiddler? But I already installed the FiddlerRootCa.cer already?!?!?!

The mobile device is a Huawei Mediapad M5

The laptop pc has running Windows 10 on it and I use Fiddler Classic

EDIT: I've setup an Android emualator. When I enter for instance amazon.de I am asked to continue to amazon.de as in screenshot*.png. Then Fiddler capture looks like in amazon.png .. Most of traffic still tunneled and size 0.  

What do I need to do when I want to capture traffic from an app and not a browser? Screenshot_1620659395.png shows Google Assistant, which is not communicating as the chrome browser.. 

(Side question: I also have a Android TV device onwhich I have root access. How can I install the Fiddler certificate on that?)

[Nick Iliev]

Hello Edna,

 

 

The screenshot does not indicate if the traffic is coming from the FIddler host or the remote device. In any way, I would advise enabling the root certificate on the host and verifying that you can capture any traffic from the mobile device. One mandatory requirement is that both the Fiddler proxy and the mobile device should be in the same network, and the mobile device should be discoverable. 

You could refer to this updated documentation article for setting up Fiddler Everywhere and an Android device. Fiddler Everywhere is a newer product that supports macOS, Linux, and Windows but it is pretty much laid on the foundation of Fiddler Classic. The instructions can be reused for the FIddler Classic, with the only difference being the used port (8888 for Classic vs. 8866 for Everywhere)

 

Regards,
Nick Iliev
Progress Telerik

[Edna]

Thw screenshot was from the mobile device. The cert was enabled on the host as well. Both host and mobile are connected to the same WIFI access point.

[Nick Iliev]

Hey Edna,

 

To capture traffic from a browser, the browser should be set to use the system proxy (usually a default setting). Also, the root certificate should be installed and explicitly trusted on the Android device. Note that some servers are using certificate pinning (meaning that they have an additional security layer and expect a specific certificate). In such cases, Fiddler won't capture the traffic from that server (as the MITM certificate is not the one the server expects).

 

Q: What do I need to do when I want to capture traffic from an app and not a browser?  

 The Android applications (starting from API24), unlike the browsers, also have an additional security setting enabled by default for all Android applications. To capture traffic from an android application, you need to have access to the codebase (to develop the application in debug mode or to rebuild the entire Android app) and modify the application network security shown in this documentation article. The article is for Fiddler Everywhere, but the very same steps are applicable for the Fiddler Classic.

 

Regards,
Nick Iliev
Progress Telerik