How to Inspect Network Daemon Routing and Firewall Rules on Android Using ADB dumpsys netd

In the Android operating system, all low-level networking operations—including Linux iptables and nftables packet filtering, policy-based routing tables, network interface tethering, DNS proxy caching, and eBPF bandwidth accounting—are controlled by the privileged Network Daemon (netd). When higher-level services like the ConnectivityService configure Wi-Fi, cellular data, or VPN tunnels, they communicate with netd via IPC over the Binder interface. When diagnosing captive portal bypass issues, unexplained per-app network throttling, firewall packet drops, or DNS resolution timeouts on Android, Android Debug Bridge (ADB) provides full diagnostic access through dumpsys netd.

Architecture and Role of the Android Network Daemon (netd)

The netd daemon acts as the bridge between Android’s Java application framework and the underlying Linux kernel networking subsystem. It orchestrates several critical network subsystems:

• Bandwidth Controller: Enforces cellular data limits, background data restrictions, and Data Saver policies by manipulating kernel eBPF cgroup socket filters and iptables quota chains.
• Firewall Controller: Implements system-level application isolation, enforcing network access permissions (such as blocking network sockets for apps when the screen is locked in Doze mode).
• Route Controller: Manages complex multi-homed policy routing rules (multiple routing tables and ip rule lookups) to route traffic simultaneously across Wi-Fi, mobile networks, and enterprise VPNs.
• DNS Resolver Proxy: Hosts a local Unix domain socket proxy (/dev/socket/dnsproxyd) that intercepts client DNS requests, resolves queries through active network resolvers, and manages local DNS caching.

Dumping netd Diagnostic State via ADB

To capture the complete real-time networking state maintained by netd, execute the diagnostic dump via ADB on a connected device:

# Dump the full Network Daemon internal state
adb shell dumpsys netd

Because the output includes routing rules, firewall tables, and traffic controllers, pipe specific sections or grep for targeted components:

# Inspect netd firewall rules and chain state
adb shell dumpsys netd | grep -A 20 -i "Firewall"

# Inspect active DNS resolver parameters and per-network latency
adb shell dumpsys netd | grep -A 30 -i "DnsProxyListener"

Auditing Bandwidth Management and Per-App Network Quotas

Android manages app data usage by assigning each installed application a Linux User ID (UID). netd tracks and limits traffic for each UID across eBPF maps and bandwidth chains:

# Inspect bandwidth controller statistics and restricted UIDs
adb shell dumpsys netd | grep -A 35 -i "BandwidthController"

The dump output reveals:

• Global Alert Quotas: Hardware byte counters that trigger alerts when total monthly mobile data limits approach.
• Penalised UIDs: Specific application UIDs currently restricted to throttled background bandwidth queues.
• Data Saver Whitelists: Applications granted exemption from background mobile data suppression.

Inspecting Policy Routing Rules and Interface Tables

Android isolates network interfaces using dedicated routing tables (e.g. Table 100 for Wi-Fi, Table 101 for Cellular, and Table 102 for VPN). netd manages these rules dynamically:

# Query active policy routing tables managed by netd
adb shell ip rule show

# Inspect routing entries in a specific interface table (e.g. table 1002)
adb shell ip route show table 1002

When a VPN application connects, netd creates high-priority routing rules matching the VPN UID or specific destination subnets, ensuring corporate traffic cannot leak into default physical interfaces.

Auditing DNS Resolver Latency and Cache Performance

The DNS proxy component within netd provides granular per-network query telemetry:

# Dump DNS resolver stats across all active network interfaces
adb shell dumpsys netd | grep -A 25 -i "DnsResolver"

Reviewing the resolver section clarifies:

• Nameservers: The primary and secondary DNS server IP addresses assigned by DHCP or cellular RRC.
• Cache Hit Rates: The percentage of domain lookups resolved instantly from local memory.
• Sample Query Latency: Real-time average query response times in milliseconds across different network interfaces.

Testing netd Commands Dynamically via the Command Runner

Developers and network engineers can test specific netd functions directly from the shell using the cmd netd utility:

# Check available cmd netd command parameters
adb shell cmd netd help

# Query bandwidth stats for a specific network interface
adb shell cmd netd trafficcontroller getwifistats wlan0

# Inspect network event logging
adb shell cmd netd events log

Troubleshooting Common Network Daemon Errors

When diagnosing network dropouts or socket connection failures on Android:

• Doze Mode Firewall Blocks: If an app stops receiving network push messages in standby, check whether its UID is listed in the standby or powersave drop chains in the firewall dump.
• DNS Timeout Outliers: If web views fail to load while raw IP pinging succeeds, inspect DnsProxyListener. High failure counts indicate the configured nameserver is unreachable or failing TLS handshakes.
• Interface Routing Blackholes: If traffic fails after disconnecting a VPN, inspect ip rule show to verify that netd flushed obsolete VPN lookup rules.