There's 3 probable cases:
- Android application setting another proxy on its http requests hence bypassing system proxy and burpsuite.
- Application setting its http handlers to ignore android proxy settings and connect directly to the destination.
- Application is using non-http protocol.
If 1 or 2 is the case, you'll have to use wireshark or reverse engineering techniques to find the domains that the application is interacting with, lets say xxx.com and yyy.org.
You then have to use adb shell to modify /etc/hosts ,let's assume burp's listening on 10.0.3.2, add the following lines to /etc/hosts:
You might need to remount system partition as "rw" to be able to change /etc/hosts:
mount -o rw,remount,rw /system
Then under burp proxy, set it to listen on port 80 and 443, then under settings for each of these listeners enable "invisible proxy" option, if there's http/https traffic sent by the application you will now be able to see/intercept them in burp.
We are making the device resolve application's domain names to our burpsuite's address. We can also change device's DNS to our controlled server which returns burp's address for all requests. This solution falls short if the application directly connects to IP addresses rather than domain names. If the application is using non-http protocols burpsuite won't be able to catch the traffic.