How to Inspect Proxy Auto-Configuration (PAC) Services on Android Using ADB dumpsys pac_proxy

In enterprise mobile deployments, routing client network traffic through corporate proxies, secure web gateways (SWG), or traffic inspection firewalls is a standard security requirement. Rather than declaring static IP addresses and fixed port numbers that fail when employees roam across subnets, enterprise networks utilize Proxy Auto-Configuration (PAC) scripts. A PAC file contains a JavaScript function (FindProxyForURL(url, host)) that dynamically instructs client devices which proxy server to utilize based on target destination hostnames or IP subnets. In the Android operating system, the framework service PacProxyService manages downloading, compiling, executing, and distributing PAC proxy configurations. Using the Android Debug Bridge (ADB) to execute dumpsys pac_proxy, mobile security engineers, enterprise fleet administrators, and network auditors can inspect active PAC script URLs, verify local proxy port bindings, examine download alarm schedules, and diagnose proxy routing failures.

Architecture of the Android PacProxy Subsystem

The Android PAC architecture operates within com.android.server.connectivity.PacProxyService and bridges the gap between JavaScript PAC scripts and Android’s native Linux networking stack:

• Local PAC HTTP Daemon: Android does not evaluate PAC JavaScript inside every individual app process. Instead, PacProxyService runs an internal local HTTP proxy daemon on 127.0.0.1 bound to an ephemeral port. When an application attempts to make an outbound network call, its HTTP/HTTPS traffic directs to this local daemon.
• V8 JavaScript Execution Engine: The local daemon utilizes an embedded V8 JavaScript runtime engine to evaluate the corporate FindProxyForURL() function in real time against outbound target URLs, determining whether to direct traffic to an enterprise upstream proxy or issue a direct connection (DIRECT).
• Dynamic Script Downloader: When a network configuration specifies a PAC URL (e.g. http://proxy.corp.internal/wpad.dat), the service automatically schedules download tasks, verifies content signatures, and updates internal routing tables.
• Download Alarms & Refresh Cycles: Manages automatic refresh alarms, querying the upstream PAC server periodically to capture updated routing rules or corporate gateway shifts.

Extracting PAC Proxy Diagnostics via ADB

To inspect the status of Proxy Auto-Configuration on a connected physical device or emulator, execute dumpsys pac_proxy from an active ADB shell session:

# Extract complete PacProxyService diagnostic telemetry
adb shell dumpsys pac_proxy

# Filter for active PAC script URLs, port bindings, and download states
adb shell dumpsys pac_proxy | grep -E "URL|Port|Alarm|Service"

If the active Wi-Fi or Ethernet connection uses a direct connection or manual static proxy, the dump indicates that no dynamic PAC script is currently loaded while confirming that the daemon is listening for network configuration events.

Auditing Active PAC Script URLs and Local Port Bindings

When an enterprise network profile pushes a PAC configuration, examine the output to evaluate script status and local server bindings:

# Inspect the loaded PAC URL and local proxy socket
adb shell dumpsys pac_proxy | grep -A 8 "PAC:"

Review the primary operational fields exposed in the dump:

• mPacUrl: The remote or local URI from which the PAC script was downloaded. Confirm that the URL is reachable and does not report HTTP 404 or connection timeout errors.
• mCurrentLocalPort: The local TCP port bound on 127.0.0.1 where the Android PAC daemon listens for incoming HTTP requests. Verify that this port is alive and active.
• mHasSentBroadcast: A boolean indicating whether the framework broadcasted the proxy change notification (android.intent.action.PROXY_CHANGE) to running applications.
• mHasDownloaded: Confirms whether the PAC script file has been successfully retrieved from the remote web server and parsed into the V8 runtime.

Inspecting Periodic Download Schedules and Alarm Timers

To ensure proxy rules remain synchronized with enterprise network changes, PacProxyService registers system alarm timers:

# Inspect PAC download alarms in the dump
adb shell dumpsys pac_proxy | grep -A 4 "Alarm:"

Review the scheduled refresh intervals. If the corporate web server hosting the PAC file is temporarily offline, the service initiates an exponential backoff retry mechanism to prevent battery drain from continuous failed network polling.

Cross-Referencing with System Network Capabilities

To verify that the Android network stack recognizes the PAC proxy as the authoritative default route, cross-reference the dump with dumpsys connectivity:

# Verify active proxy settings in ConnectivityManager
adb shell dumpsys connectivity | grep -A 6 "HttpProxy:"

The output should confirm the local loopback host and port assigned by PacProxyService (e.g. HttpProxy: 127.0.0.1:41295 / ExclList: [] / PacUrl: http://...), ensuring that all web browsers and app runtimes route traffic through the PAC parser.

Troubleshooting Common Android PAC Proxy Failures

When enterprise users report connectivity loss or inability to reach internal intranet resources, evaluate common bottlenecks revealed in the diagnostic dump:

• Local Daemon Crash: If the V8 engine encounters an unhandled syntax error inside a poorly constructed FindProxyForURL() function, the local proxy daemon can crash. If mCurrentLocalPort: -1 persists, inspect system logs via adb logcat -s PacProxyService.
• Cleartext Traffic Restrictions: Modern Android versions block unencrypted HTTP traffic by default. If the PAC file is hosted over plain HTTP (e.g. http://wpad.corp.local/), Android’s Network Security Configuration may reject the download unless cleartext traffic is explicitly permitted for the domain.
• Captive Portal Interference: If a corporate Wi-Fi network requires splash screen authentication before granting Internet access, PAC downloads will fail until the captive portal login is satisfied. Inspect network validation tokens via dumpsys connectivity.