How to Inspect Network Quality Scoring and Evaluator Services on Android Using ADB dumpsys network_score

Network Evaluation Architecture and NetworkScoreService in Android

Modern mobile devices operate in constantly shifting radio environments where cellular LTE/5G signals compete with public Wi-Fi hotspots, office SSIDs, and home networks. To ensure seamless user experience during voice calls, video streaming, and background sync, the Android operating system must continuously decide whether to keep traffic on the current Wi-Fi link or perform an automated handover to mobile data (such as Adaptive Connectivity or Wi-Fi to Cellular handoff). This arbitration is coordinated by NetworkScoreService.

Under the Android networking architecture, NetworkScoreService manages communication with registered network evaluators and recommendation providers. These recommendation engines evaluate connection quality metrics—including Received Signal Strength Indicator (RSSI), packet loss, round-trip latency, link speed, and captive portal availability. Based on these observations, the system assigns a dynamic integer score to network interfaces, determining whether an access point is considered high-quality, metered, poor, or unvalidated.

For Android network engineers, mobile app developers, and cellular field testers, the Android Debug Bridge (ADB) provides full diagnostic transparency into this decision engine through dumpsys network_score. This command outputs active evaluator package bindings, cached BSSID network scores, and system scoring policies.

Establishing an ADB Session and Verifying Service Availability

To inspect the network scoring subsystem, connect your target Android smartphone or tablet via USB or Wireless ADB, and verify that USB debugging is authorized:

# Verify connected Android device
adb devices -l

# Check that network scoring service is registered and active
adb shell service check network_score

If the service is operational, the shell returns Service network_score: found. You can now execute diagnostic dumps against the subsystem.

Dumping Network Scoring Records via dumpsys network_score

The dumpsys network_score command queries NetworkScoreService directly, outputting runtime parameters, active evaluator client bindings, and cached BSSID scores:

# Dump complete NetworkScoreService diagnostic state
adb shell dumpsys network_score

A typical diagnostic output reveals essential operational fields:

NetworkScoreService:
  Active Scorer: com.google.android.apps.gcs (uid=10120)
  Scoring App Component: ComponentInfo{com.google.android.apps.gcs/com.google.android.apps.gcs.service.NetworkScorerService}
  Network Recommendations Enabled: true
  Use Open Wi-Fi Automatically: false
  Cached Network Scores (Count: 14):
    BSSID: 00:27:0d:94:a2:10, RSSI: -54, Score: 78, Curve: [(-80, 10), (-65, 50), (-55, 80)]
    BSSID: a4:2b:b0:12:ef:44, RSSI: -82, Score: 15, Curve: [(-85, 5), (-70, 30), (-60, 60)]

Understanding Network Scoring Attributes

Each recorded entry reflects critical parameters influencing network selection:

• Active Scorer: The package name and UID of the active network recommendation provider (commonly Google Connectivity Services, com.google.android.apps.gcs, or an OEM carrier provider).
• Network Recommendations Enabled: A boolean flag indicating whether the operating system permits external recommendation engines to score access points and recommend automatic connection handovers.
• Cached Network Scores: An in-memory cache indexing known Basic Service Set Identifiers (BSSIDs) alongside observed RSSI levels and calculated quality scores.
• Scoring Curve: A piece-wise linear mapping function that converts physical radio signal strength (dBm) into an integer score (typically from 0 to 100). When score thresholds drop below cellular data benchmarks, Android triggers network validation probes and prepares for failover.

Auditing Active Scorer Bindings and App Permissions

Only applications granted the privileged system permission android.permission.SCORE_NETWORKS can register as an active network evaluator. Verify the active scorer package and its bound services:

# Filter active network recommendation package
adb shell dumpsys network_score | grep -E "Active Scorer|Scoring App"

Security engineers audit this property to ensure that unvetted third-party applications have not usurped scoring provider privileges or manipulated connection metrics.

Testing Network Selection and Simulating Evaluator Handoffs

Developers testing how mobile applications react when switching between Wi-Fi and mobile data can evaluate network scores alongside active default network capabilities using dumpsys connectivity:

# Inspect active default network and transport types
adb shell dumpsys connectivity | grep -A 10 "Active default network:"

To view how the Wi-Fi subsystem translates scores into network selection decisions:

# Inspect Wi-Fi score and candidate access points
adb shell dumpsys wifi | grep -A 10 "mCurrentClientModeManager"

Observe the Score value assigned to the active Wi-Fi link. When signal attenuation drops the score below the threshold of cellular data, Android engages mobile data while keeping the Wi-Fi interface in a validation hold state.

Utilizing dumpsys network_score provides vital visibility into Android’s intelligent network selection pipeline, helping engineers diagnose unexpected Wi-Fi disconnects, optimize network evaluators, and ensure smooth data handovers.