3. SYSTEMOVERVIEW The AntMonitor system consists of three components: a clientside Android application, called AntClient, and two server applications, called AntServer and LogServer for routing and collecting packets, respectively. Fig. 1 shows how the three work together. Each component is described in detail elsewhere [5]. Here, we provide the overview of the functionalities of AntMonitor. Traffic Interception and Routing. AntClient establishes a VPN service on the device. This VPN service creates a virtual (layer-3) TUN interface that intercepts all outgoing traffic. Once a packet arrives at the TUN interface, AntMonitor sends it through a UDP socket to AntServer. AntServer routes the packets to the intended Internet host and delivers responses back to AntClient using another TUNinterface and IP Masquerading (packet forwarding with Network Address Translation). Data Collection. AntClient saves packets in log files and uploads them to LogServer at a later time, e.g., when the device is charging and has Wi-Fi or when explicitly requested by the user. LogServer extracts features from the log files and inserts them into a database to support various types of analysis. LogServer receives crowdsourced data from a large number of devices, which enables global large-scale analysis. In our pilot deployment to volunteering students