How to Inspect Network Data Usage and Per-App Bandwidth on Android Using ADB dumpsys netstats

Monitoring mobile data consumption, auditing background network leaks, and tracking bandwidth quotas are essential tasks when developing Android applications and managing enterprise-enrolled mobile fleets. When an application consumes mobile data unexpectedly or synchronises heavy payloads while running in the background, standard Settings screens offer only aggregated monthly figures. To extract exact byte-level network transfer logs, inspect per-UID historical records, and separate Wi-Fi from cellular traffic, the Android Debug Bridge (ADB) exposes the kernel-level network accounting service via dumpsys netstats.

Understanding the netstats Service and eBPF Network Accounting

Modern Android platforms (Android 9 through Android 15+) use kernel eBPF (extended Berkeley Packet Filter) programs attached to socket and network interface cgroups to record data transfer telemetry. The netstats service queries these eBPF maps to maintain persistent usage databases:

• UID-Based Tracking: Every Android application runs inside a dedicated Linux User ID (UID), typically ranging from 10000 upwards. Netstats categorises all transmitted (Tx) and received (Rx) bytes by UID.
• Set States (Foreground vs Background): The system tracks whether packets were sent while the app was active in the foreground (set=DEFAULT or set=FOREGROUND) or silently polling in the background (set=BACKGROUND).
• Network Interfaces: Netstats cleanly segregates physical network interfaces, distinguishing between Wi-Fi (wlan0), cellular mobile data (rmnet_data0), and VPN tunnels (tun0).

Generating a Complete Network Statistics Report

To inspect overall network usage across all active network interfaces and UID groups on your connected Android device:

adb shell dumpsys netstats

The command outputs historical usage matrices broken down into snapshot intervals. The primary sections include:

• Active interfaces: Lists currently bound network devices (e.g., iface=wlan0, iface=rmnet_data0).
• Dev stats: Total physical interface traffic across time buckets.
• Xt stats: eBPF-derived kernel accounting numbers.
• UID stats: Granular per-app byte counters.

Finding the UID of Your Target Application

Before filtering netstats output for a specific application, identify its assigned Android UID:

adb shell pm list packages -U | grep com.example.myapp

The command returns the package name along with its UID:

package:com.example.myapp uid:10245

Here, the app\u2019s UID is 10245.

Extracting Data Usage for a Specific Application UID

With the UID identified, filter the netstats output to inspect exact transferred and received byte counts:

adb shell dumpsys netstats detail | grep -E "uid=10245"

The output provides granular transfer records:

ident=[{type=WIFI, subType=COMBINED, subscriberId=...}] uid=10245 set=DEFAULT tag=0x0 rxBytes=14528100 rxPackets=12400 txBytes=1820450 txPackets=8900
ident=[{type=MOBILE, subType=COMBINED, subscriberId=...}] uid=10245 set=BACKGROUND tag=0x0 rxBytes=452100 rxPackets=850 txBytes=120400 txPackets=620

Notice the differentiation:

• rxBytes / txBytes: Exact payload sizes received and transmitted over the network socket.
• set=BACKGROUND: Quantifies how much data the app consumed while the user was not actively interacting with it. High background cellular consumption often indicates unoptimised sync jobs or background polling loops.
• type=MOBILE vs type=WIFI: Demonstrates network interface routing choices.

Auditing Tethering and Hotspot Data Usage

When an Android phone functions as a Wi-Fi hotspot or USB tethering gateway, client device traffic traverses through special kernel netfilter tables. You can monitor tethering bandwidth consumption directly:

adb shell dumpsys netstats | grep -A 10 "Tethering stats:"

The service reports cumulative upstream and downstream byte counters for USB, Wi-Fi hotspot, and Bluetooth tethering interfaces, helping diagnose data allowance exhaustion.

Triggering an Instantaneous Netstats Poll and Flush

Netstats periodically flushes eBPF counters from memory to disk. When conducting benchmark tests or verifying network optimizations before and after code changes, force an immediate update of the kernel stats tables:

adb shell dumpsys netstats --poll

This command instructs the Android network subsystem to immediately poll eBPF accounting maps and flush updated byte counters to the diagnostics interface, ensuring your subsequent queries reflect real-time network transfers.