iPhone and WireShark [closed]

Question

How can I sniff packets from my iPhone on my network? can someone give me some instructions? I tried Googling, but nothing teaches how to sniff iPhone packets、

I am on windows.

Answer 1

I have successfully captured HTTP traffic using Fiddler2 as a proxy, which can be installed on any Windows PC on your network.

1. In Fiddler, Tools -> Fiddler Options -> Connections -> [x] Allow remote computers to connect.
2. Make sure your windows firewall is disabled.
3. On the iphone/ipod, go to your wireless settings, use a manual proxy server, enter the fiddler machine's ip address and the same port (defaults to 8888).

Answer 2

This worked for me:

1. Connect your iOS device by USB

2. $ rvictl -s UDID where UDID is the UDID of your device (located in XCode under Devices, shortcut to with ⇧⌘2)

3. $ sudo launchctl list com.apple.rpmuxd

4. $ sudo tcpdump -n -t -i rvi0 -q tcp or $ sudo tcpdump -i rvi0 -n

If victl is not working install Xcode and the developer tools.

For more info see Remote Virtual Interface and for the original tutorial here's the Use Your Loaf blog post

Answer 3

The following worked for iPhone 4S (iOS 5) and Macbook Pro (10.8.2)

1. On your Mac, go to System Preferences > Sharing > Internet Sharing

2. On your iPhone, go to Settings > Wifi and choose your Mac as the Wifi Access Point. Press the blue detail disclosure next to it to and note down the IP Address (192.168.2.2 in my case). At this point, the wifi icon on Mac's your taskbar should change to the following:

3. Open wireshark. Click on start capture, and use the new bridge interface that should now be available among the options.

4. ???

5. Profit!

As with all stuff networking related, you might have to restart wifi etc and repeat steps and invoke your favorite deity to get this incantation working :)

Answer 4

You can proceed as follow:

1. Install Charles Web Proxy.
2. Disable SSL proxying (uncheck the flag in Proxy->Proxy Settings...->SSL
3. Connect your iDevice to the Charles proxy, as explained here
4. Sniff the packets via Wireshark or Charles