Gilles' Blog
For marketers
who love technology
Home » , , , » Wireshark packer sniffer: How to capture iPhone iOS packets?

Wireshark packer sniffer: How to capture iPhone iOS packets?

How to Use Wireshark to Sniff Ios App Requests

If you want to use wireshark on an IOS app or TCPdump for iphone traffic, you are on the right post! I wanted to analyze the traffic that my phone generates. On a computer such packet capture is super easy to do:
  • If you are interested in HTTP traffic, you use Google Chrome developer tools or firebug. 
  • If you want all the network layers with full visibility, then you use tcpdump or Wireshark.
However, how to capture the traffic from my iPhone? Turns out it is pretty easy, as you should see below. And you do not even need to install a paid iPhone sniffer app, you can just use wireshark on your computer and sniff iPhone traffic. Have fun!

First, check your UDID/AdID/AIFA

  1. Connect your iPhone to the mac through a USB cable
  2. Install and open Xcode
  3. In the Xcode menu bar, go to Window > Devices. You should a screen like this:
  4. See the identifier line? That's the UDID of the phone, also called AdID. That's the ID advertisers use to track your activity on the web. Note this AdID, we will use it to capture the traffic of generated by the iPhone.
  5. In the Xcode window, you have access to the device logs, the list of apps and a bunch of information about anything you have done with your iPhone.

How to wireshark the iPhone's Apps and web network traffic

We will proceed in two steps:
  1. We create a virtual interface of your mac, dedicated to iPhone's traffic
  2. We run a capture on this specific interface
Let's start with the creation of the virtual interface.
  1. Open a Terminal window.
  2. Enter following command to create a network interface dedicated to the iPhone's traffic:
    3.  rvictl -s YourIDFA

  3. As you can see through ifconfig, the interface creation was successful.
  4. To remove this interface after you are done with your capturing, use following command:
    5.  rvictl -x YourIDFA

Now, let's capture the iPhone's communications:
  1.  Install and open Wireshark.
  2. You should see our virtual interface rvi0 listed among the capture interfaces:
  3. Double click on rvi0 to start a live capture. Open any App on your iPhone, to trigger information exchanges. Your screen will update with every IP packet sent / received by the iPhone.
  4. Stop the capture with the red square button at the top of Wireshark window.
Finally let's analyze the Wireshark trace we have gathered:
  1.  In Wireshark menu, go to Analyze > Follow > TCP stream.
  2. The Wireshark filter changes to "tcp.stream eq 0", it means that you are seeing only the packets related to the first TCP connection established. Edit the TCP connection number of trigger the "Follow > TCP stream" command on a specific packet, to analyze the exact TCP streams you are interested in.
  3. Now let's say I am interested in ad-calls, so I want only the traffic related to well known advertising platforms. I'll go to Statistics > Resolved Addresses to see which domains are involved in the captured network exchanges.
  4. You can play a do a lot of things, Wireshark is super powerful. A quick tip: in the capture options enable network address resolution: it makes it easier to analyze the capture.
Of course, most of the traffic is encrypted. So your capture will exhibit gibberish content. Don't be surprised. Especially with Apple moving towards full encryption of Apps communication with Application Transport Security (ATS) end of 2016.

To conclude the tutorial, let's consider a case where you just want to see TCP packets that bear your adId anywhere in their content. For this, tcpdump could be more convenient than Wireshark.

 tcpdump -i rvi0 -A -vvv  -s0 -w capture.txt

In above command we use:
  • -i option to indicate the interface we want to capture 
  • -A option to show the packet contents in ascii
  • -vvv to see as much information as possible
  • -s0 to capture full packets, not just the first few bytes
  •  -w to write the capture to a file
Cut the capture when you are done with cmd+c or ctrl+c. Then we can use the usual suspects: grep, cat, to analyze the captured file.



Have fun !
SHARE

About Gilles

24 comments :

  1. Radhika PothukuchiFebruary 16, 2017 at 7:38 PM

    Very Helpful!!! Thank you!!

    ReplyDelete
    Replies
    1. SankarAugust 27, 2020 at 5:09 AM

      Great Article Cloud Computing Projects

      Networking Projects

      Final Year Projects for CSE

      JavaScript Training in Chennai

      JavaScript Training in Chennai

      The Angular Training covers a wide range of topics including Components, Angular Directives, Angular Services, Pipes, security fundamentals, Routing, and Angular programmability. The new Angular TRaining will lay the foundation you need to specialise in Single Page Application developer. Angular Training

      Delete
  2. GillesFebruary 16, 2017 at 8:39 PM

    Happy to help :) thanks for your appreciation Radhika!

    ReplyDelete
  3. UnknownSeptember 1, 2017 at 12:58 PM

    This article was very helpful ios online training Hyderabad

    ReplyDelete
  4. AndyFebruary 26, 2018 at 3:39 PM

    I have an app that controls my TV over WiFi. I would like to be able to control the TV from my home automation system, could I get a list of commands that the app sends by using this method?

    ReplyDelete
  5. UnknownApril 10, 2018 at 12:21 PM

    it is a beautiful post, and I want to say thank you so much for sharing this information.
    digital marketing services in india

    ReplyDelete
  6. AnonymousJuly 19, 2018 at 3:38 PM

    Thank you!

    ReplyDelete
  7. UnknownNovember 20, 2018 at 10:57 AM

    Hello, I am thomus jons thank you for this informative post. That is a great job. Wish you more success.Thank you so much and for you all the best. Takes Down
    123movies

    ReplyDelete
  8. AnonymousMay 17, 2019 at 2:00 PM

    thanks man, super info here!!!

    btw. xcode seems to give idiotic problems with license approval on first start, here the fix:
    $sudo xcodebuild -license accept

    ReplyDelete
  9. Willa AndersonJuly 13, 2019 at 10:18 AM

    Thanks for sharing this amazing article.iOs is now trending. And due to this the iPhone user have increased day by day. Thus iPhone app development is important to get innovative app.

    ReplyDelete
  10. man9ar00December 5, 2019 at 4:03 AM

    This script helps alleviate the steps to deal with rvictl and finding & using device UUID: https://thrysoee.dk/iospcap/.

    ReplyDelete
  11. SugarSparkkJanuary 16, 2020 at 3:53 PM

    If the rvictl command isnt found, that's cause Apple changed it's location to /Library/Apple/usr/bin/rvictl

    ReplyDelete
  12. Avi GoyalMay 2, 2020 at 8:46 AM

    TimesTech provides Latest electronics news, Semiconductor News, Technology News, Get connected to global community of tech news, Electronics Projects, Electronics Circuit here at https://timestech.in/ for more inquiery mail us at info@timestech.in ,91-122-3550122

    ReplyDelete
  13. katetechMay 4, 2020 at 8:45 AM

    Nice Information, your blog is sharing unique information....
    Thanks for sharing!!!
    top web designing companies in gachibowli
    the best web design services in kukatpally
    android Mobile Apps Development in hyd
    web designing services in vijayawada

    ReplyDelete
  14. parthisthaMay 18, 2020 at 5:17 PM

    Hellio gomovies It is a great job, I love your posts and wish you all the very best. And I hope you continue doing this job well.
    https://www.smore.com/2wgm0-gomovies-2020

    ReplyDelete
  15. taniya dsouzaMay 23, 2020 at 11:48 AM

    Hellio fillmyzilla It is an excellent job, I really like your articles and wish you all the very best. And I hope you continue doing this work well.
    https://www.smore.com/9k3ds-fillmyzilla-in-watch-online-movies

    ReplyDelete
  16. taniya dsouzaMay 23, 2020 at 11:48 AM

    Hellio fillmyzilla It is an excellent job, I really like your articles and wish you all the very best. And I hope you continue doing this work well.
    https://www.smore.com/9k3ds-fillmyzilla-in-watch-online-movies

    ReplyDelete
  17. NandishJuly 16, 2020 at 11:53 AM

    Thank you. It was very helpful.

    ReplyDelete
  18. DannyJuly 31, 2020 at 8:22 AM

    It is really good to secure the data leakage. For any business, IP phone Canada is giving good support to secure data and also voice communication at lower cost. It coverts the voice into data pack and send as clear and secure to the receiver end.

    ReplyDelete
  19. ChadAugust 6, 2020 at 7:33 AM

    Great!! Thank you for sharing this post on software testing. Software testing outsourcing services are in great demand these days. Good to see such nice articulated post.

    ReplyDelete
  20. alishaAugust 16, 2020 at 11:41 AM

    Hellio 2movierulz It is a great job, I love your posts and wish you all the very best. And I hope you continue doing this job well.
    https://www.smore.com/ety8u-2movierulz-2020

    ReplyDelete
  21. Worlds MovieAugust 17, 2020 at 2:23 PM

    Hellio It is a great job, I love your posts and wish you all the very best. And I hope you continue doing this job well.
    https://www.smore.com/6p8ba-cinemavilla-2020

    ReplyDelete
  22. jane hollySeptember 24, 2020 at 4:09 PM

    This professional hacker is absolutely reliable and I strongly recommend him for any type of hack you require. I know this because I have hired him severally for various hacks and he has never disappointed me nor any of my friends who have hired him too, he can help you with any of the following hacks:

    -Phone hacks (remotely)
    -Credit repair
    -Bitcoin recovery (any cryptocurrency)
    -Make money from home (USA only)
    -Social media hacks
    -Website hacks
    -Erase criminal records (USA & Canada only)
    -Grade change
    -funds recovery

    Email: onlineghosthacker247@ gmail .com

    ReplyDelete