How to Inspect Network Management and Firewall Rules on Android Using ADB dumpsys network_management

In Android operating systems, network traffic routing, packet filtering, and data quota enforcement are governed at the platform level by the Network Management Service (NetworkManagementService / NMS). Acting as the bridge between Android’s high-level Java frameworks and the low-level Linux kernel network daemon (netd) and eBPF programs, NMS controls network interface operational states, enforces per-UID socket firewall rules, monitors data limit warnings, and maintains tethering DNS forwards. When debugging application network connectivity loss, investigating unexpected data usage blocks, or verifying corporate mobile device management (MDM) firewall rules, Android Debug Bridge (ADB) provides full diagnostic transparency via dumpsys network_management.

Architecture of the Android Network Management Service (NMS)

The NetworkManagementService implements low-level network governance across multiple architectural responsibilities:

• Interface State Coordination: Monitors physical and virtual interfaces (e.g. wlan0, rmnet_data0, tun0), detecting link state transitions (up/down), MTU configurations, and assigned IPv4/IPv6 address blocks.
• Firewall Chain Enforcement: Coordinates Netfilter and eBPF firewall chains to isolate UID execution:
  • standby: Restricts networking for applications placed in App Standby buckets.
  • dozable: Enforces network blackout windows when the device enters deep Doze mode.
  • powersave: Blocks background network synchronization when Battery Saver is toggled on.
  • restricted: Enforces enterprise MDM or work-profile network isolation rules.
• Bandwidth and Data Quota Alerts: Tracks byte counters against user-defined data warning and limit thresholds, dispatching kernel alerts when cellular allowances are exhausted.

Dumping Network Management State via ADB

Ensure USB debugging is authorized on your Android handset, connect it to your workstation via ADB, and execute the following command:

adb shell dumpsys network_management

The diagnostic dump provides a detailed breakdown of detected interfaces, active firewall chains, per-app UID rules, and data quota alert thresholds.

Auditing Detected Network Interfaces and MTU Settings

In the command output, locate the active interface table:

NetworkManagementService:
  Active interfaces:
    wlan0 (UP, running, MTU 1500)
      IPv4: 192.168.1.145/24
      IPv6: fe80::a12:56ff:fe78:9abc/64
    rmnet_data0 (DOWN, MTU 1430)

Inspect these records to verify:

• Interface Operational State: Confirms whether the interface is actively linked and operational (UP) or asleep (DOWN).
• MTU Size: Identifies maximum transmission unit mismatches (such as cellular MTU constrained to 1430 bytes vs standard 1500 bytes on Wi-Fi), which can cause fragmented packet loss across VPN tunnels.
• IP Address Bindings: Confirms whether valid link-local and global unicast addresses have been assigned to the network interface.

Inspecting Active Firewall Chains and UID Whitelists

Android isolates application networking by mapping Android package UIDs (e.g. u0_a142 = UID 10142) to firewall chains. Review the firewall rule tables in the dump:

adb shell dumpsys network_management | grep -A 15 "Firewall Rules"

Key chain tables to inspect include:

• Standby Chain: Displays UIDs restricted from network access due to inactivity:

  UID 10142: DENY (Standby)

• Dozable Chain: Shows whitelisted applications exempt from Doze mode network restrictions (such as push notification daemons or alarm managers):

  UID 10013: ALLOW (Dozable)

• Powersave Chain: Lists background services permitted to transmit data when Battery Saver is active.

Auditing Data Quota and Bandwidth Alert Thresholds

When users configure a cellular data warning (e.g. alert at 5 GB, cut off at 6 GB), NMS programs kernel bandwidth filters to raise alarms upon crossing byte thresholds:

adb shell dumpsys network_management | grep -A 10 "Data alerts"

The dump displays active byte triggers:

Global alert bytes: 5368709120 (5.00 GB)
Interface rmnet_data0 quota: 6442450944 (6.00 GB)
Quota remaining: 1073741824 bytes

If an application fails to access the network despite cellular data being enabled, checking these quotas confirms whether NMS has dropped interface routing due to an exhausted data cap.

Testing Network Management State and Resetting Rules via ADB

In automated testing environments, QA engineers can simulate firewall rules and bandwidth controls using the cmd network_management utility:

# Query active firewall state
adb shell cmd network_management get-firewall-type

# Check if a specific UID is restricted
adb shell cmd network_management is-uid-restricted 10142

To capture live kernel network daemon (netd) IPC transactions and firewall updates in real time:

adb logcat -d -s NetworkManagement:V netd:V | grep -iE "firewall|quota|interface"

Auditing dumpsys network_management equips Android developers and enterprise administrators with definitive visibility into operating system firewall enforcement, interface binding, and data quota compliance.