iPhone and WireShark

Question

How can I sniff packets from my iPhone on my network? can someone give me some instructions? I tried Googling, but nothing teaches how to sniff iPhone packets、

I am on windows.

I found this, which uses WireShark. However, I need step by step instructions or something to do the wireshark and proxy together. — Strawberry, Oct 21 '09 at 04:57
Well, I know what WLAN is but I'm not sure how can I put the puzzle together. — Strawberry, Oct 21 '09 at 05:07

Nathan Kleyn · Accepted Answer · 2021-05-01T08:26:47.830

Update (2021-04-01): Paros no longer can be easily installed and run on many OS's due to using an extremely old version of Java.

However there is now OWASP ZAP which is a fork of Paros and can be used to achieve the same ends.

Basic steps are:

Install ZAP's root CA certificate on your iOS device.
Configure the proxy settings of the iOS device to point to your running ZAP.
Capture away.

Thre is a blogpost by Omer Levi Hevroni on OWASP ZAP with iOS which goes into significantly more detail on how to do these steps.

You can use Paros to sniff the network traffic from your iPhone. See this excellent step by step post for more information: http://blog.jerodsanto.net/2009/06/sniff-your-iphones-network-traffic/. Also, look in the comments for some advice for using other proxies to get the same job done.

One caveat is that Paras only sniffs HTTP GET/POST requests using the method above, so to sniff all network traffic, try the following:

Just turn on network sharing over WiFi and run a packet sniffer like Cocoa Packet Analyzer (in OSX).

Then connect to the new network from iPhone over WiFi. (SystemPreferences->Sharing->InternetSharing)

If you're after sniffing these packets on Windows, connect to the internet using Ethernet, share your internet connection, and use the Windows computer as your access point. Then, just run Wireshark as normal and intercept the packets flowing through, filtering by their startpoints. Alternatively, try using a network hub as Wireshark can trace all packets flowing through a network if they are using the same router endpoint address (as in a hub).

Thanks, if I wanted to sniff all the packets what program can I use for windows? — Strawberry, Oct 21 '09 at 02:46
The blog post does not make one thing clear: how do you get the address to use for the proxy? What you should do is startup the "network utility" app on your mac. You will see an "IP Address" on the Info tab (the first tab). That is the address you should use. — William Jockusch, Oct 02 '12 at 03:20
The instructions in the link are really bad. There are tons of people who can't get it working (see the comments). The author appears to arbitrarily pick an IP address to act as the proxy. But it should be the IP address of the computer/laptop. — Mike S, Mar 27 '14 at 14:36
I can get Paros to work as far as SSL errors, but that's all I can get. Pretty useless for sniffing traffic from legitimate applications which don't accept invalid certs — sam1370, Nov 29 '20 at 00:31

score 40 · Answer 2 · edited Nov 14 '15 at 00:18

40

This worked for me:

Connect your iOS device by USB
$ rvictl -s UDID where UDID is the UDID of your device (located in XCode under Devices, shortcut to with ⇧⌘2)
$ sudo launchctl list com.apple.rpmuxd
$ sudo tcpdump -n -t -i rvi0 -q tcp or $ sudo tcpdump -i rvi0 -n

If victl is not working install Xcode and the developer tools.

For more info see Remote Virtual Interface and for the original tutorial here's the Use Your Loaf blog post

edited Nov 14 '15 at 00:18

Ryan Brodie

6,554
8
40
57

answered Jan 11 '13 at 22:24

Oleh Kudinov

2,533
28
30

I would recommend reading `man` page for `tcpdump` to understand what the flags are. Also, there seems to be a difference in output between `stdout` and using `-w` flag. See also https://stackoverflow.com/a/19873132/307944 – Jeff Mar 12 '19 at 15:51
The OP is asking how to do this on Windows – Nubcake Apr 25 '21 at 13:50

EricP · Answer 3 · 2013-02-07T19:17:18.823

21

I have successfully captured HTTP traffic using Fiddler2 as a proxy, which can be installed on any Windows PC on your network.

In Fiddler, Tools -> Fiddler Options -> Connections -> [x] Allow remote computers to connect.
Make sure your windows firewall is disabled.
On the iphone/ipod, go to your wireless settings, use a manual proxy server, enter the fiddler machine's ip address and the same port (defaults to 8888).

edited Feb 07 '13 at 19:17

answered Apr 15 '11 at 21:13

EricP

3,395
3
33
46

7

+1 Great suggestion. I found this for a step-by-step: [here](http://www.diaryofaninja.com/blog/2010/11/09/using-fiddler-to-sniff-mobile-device-application-traffic). Also, help with getting https [on fiddler's site](http://fiddler2.com/Fiddler/help/httpsdecryption.asp) and [here](http://groups.google.com/group/httpfiddler/browse_thread/thread/55b865509faaf119) – hmqcnoesy Feb 04 '12 at 16:26

score 8 · Answer 4 · answered Dec 14 '12 at 06:52

The following worked for iPhone 4S (iOS 5) and Macbook Pro (10.8.2)

On your Mac, go to System Preferences > Sharing > Internet Sharing
On your iPhone, go to Settings > Wifi and choose your Mac as the Wifi Access Point. Press the blue detail disclosure next to it to and note down the IP Address (192.168.2.2 in my case). At this point, the wifi icon on Mac's your taskbar should change to the following:
Open wireshark. Click on start capture, and use the new bridge interface that should now be available among the options.
???
Profit!

As with all stuff networking related, you might have to restart wifi etc and repeat steps and invoke your favorite deity to get this incantation working :)

score 5 · Answer 5 · edited Apr 13 '17 at 12:36

I had to do something very similar to find out why my iPhone was bleeding cellular network data, eating 80% of my 500Mb allowance in a couple of days.

Unfortunately I had to packet sniff whilst on 3G/4G and couldn't rely on being on wireless. So if you need an "industrial" solution then this is how you sniff all traffic (not just http) on any network.

Basic recipe:

Install VPN server
Run packet sniffer on VPN server
Connect iPhone to VPN server and perform operations
Download .pcap from VPN server and use your favourite .pcap analyser on it.

Detailed'ish instructions:

Get yourself a linux server, I used Fedora 20 64bit from Digirtal Ocean on a $5/month box
Configure OpenVPN on it. OpenVPN has comprehensive instructions
Ensure you configure the Routing all traffic through the VPN section
Be aware the instructions for (3) are all iptables which has been superseded, at time of writing, by firewall-cmd. This website explains the firewall-cmd to use
Check that you can connect your iPhone to the VPN. I did this by downloading the free OpenVPN software. I then set up a OpenVPN certificate. You can embed your ca, crt & key files by opening up and embedding the --- BEGIN CERTIFACTE --- ---- END CERTIFICATE --- in < ca > < /ca > < crt >< /crt>< key > < /key > blocks. Note that I had to do this in Mac with text editor, when I used notepad.exe on Win it didn't work. I then emailed this to my iphone and picked installed it.
Check the iPhone connects to VPN and routes it's traffic through (google what's my IP should return the VPN server IP when you run it on iPhone)
Now that you can connect go to your linux server & install wireshark (yum install wireshark)
This installs tshark, which is a command line packet sniffer. Run this in the background with screen tshark -i tun0 -x -w capture.pcap -F pcap (assuming vpn device is tun0)
Now when you want to capture traffic simply start the VPN on your machine
When complete switch off the VPN
Download the .pcap file from your server, and run analysis as you normally would. It's been decrypted on the server when it arrives so the traffic is viewable in plain text (obviously https still encrypted)

Note that the above implementation is not security focussed it's simply about getting a detailed packet capture of all of your iPhone's traffic on 3G/4G/Wireless networks

In the end, just to finish up, I found out what was eating the data. I had it configured as a personal hotspot and if I rebooted the router then my PC would connect to it and route all data through it. So in the end I discovered I had to reset the router when the PC was doing some sort of network traffic and that killed my data! — PompeyPaul, Aug 19 '15 at 08:47

score 4 · Answer 6 · edited Sep 14 '11 at 18:56

4

The tcpdump tool is available under gnu.

You can use it instead of wireshark.

edited Sep 14 '11 at 18:56

Jérôme Verstrynge

57,710
92
283
453

answered Aug 19 '11 at 07:33

justme

51
2

score 3 · Answer 7 · answered Aug 11 '11 at 06:14

I recommend Charles Web Proxy

Charles is an HTTP proxy / HTTP monitor / Reverse Proxy that enables a developer to view all of the HTTP and SSL / HTTPS traffic between their machine and the Internet. This includes requests, responses and the HTTP headers (which contain the cookies and caching information).

SSL Proxying – view SSL requests and responses in plain text
Bandwidth Throttling to simulate slower Internet connections including latency
AJAX debugging – view XML and JSON requests and responses as a tree or as text
AMF – view the contents of Flash Remoting / Flex Remoting messages as a tree
Repeat requests to test back-end changes, Edit requests to test different inputs
Breakpoints to intercept and edit requests or responses
Validate recorded HTML, CSS and RSS/atom responses using the W3C validator

It's cross-platform, written in JAVA, and pretty good. Not nearly as overwhelming as Wireshark, and does a lot of the annoying stuff like setting up the proxies, etc. for you. The only bad part is that it costs money, $50 at that. Not cheap, but a useful tool.

iPhone and WireShark

10 Answers10

This worked for me:

Linked