How to Use Wireshark to Sniff Ios App Requests
If you want to use wireshark on an IOS app or TCPdump for iphone traffic, you are on the right post! I wanted to analyze the traffic that my phone generates. On a computer such packet capture is super easy to do:- If you are interested in HTTP traffic, you use Google Chrome developer tools or firebug.
- If you want all the network layers with full visibility, then you use tcpdump or Wireshark.
First, check your UDID/AdID/AIFA
- Connect your iPhone to the mac through a USB cable
- Install and open Xcode
- In the Xcode menu bar, go to Window > Devices. You should a screen like this:
- See the identifier line? That's the UDID of the phone, also called AdID. That's the ID advertisers use to track your activity on the web. Note this AdID, we will use it to capture the traffic of generated by the iPhone.
- In the Xcode window, you have access to the device logs, the list of apps and a bunch of information about anything you have done with your iPhone.

How to wireshark the iPhone's Apps and web network traffic
We will proceed in two steps:- We create a virtual interface of your mac, dedicated to iPhone's traffic
- We run a capture on this specific interface
- Open a Terminal window.
- Enter following command to create a network interface dedicated to the iPhone's traffic:
- As you can see through ifconfig, the interface creation was successful.
- To remove this interface after you are done with your capturing, use following command:
rvictl -s YourIDFA
rvictl -x YourIDFA
- Install and open Wireshark.
- You should see our virtual interface rvi0 listed among the capture interfaces:
- Double click on rvi0 to start a live capture. Open any App on your iPhone, to trigger information exchanges. Your screen will update with every IP packet sent / received by the iPhone.
- Stop the capture with the red square button at the top of Wireshark window.
- In Wireshark menu, go to Analyze > Follow > TCP stream.
- The Wireshark filter changes to "tcp.stream eq 0", it means that you are seeing only the packets related to the first TCP connection established. Edit the TCP connection number of trigger the "Follow > TCP stream" command on a specific packet, to analyze the exact TCP streams you are interested in.
- Now let's say I am interested in ad-calls, so I want only the traffic related to well known advertising platforms. I'll go to Statistics > Resolved Addresses to see which domains are involved in the captured network exchanges.
- You can play a do a lot of things, Wireshark is super powerful. A quick tip: in the capture options enable network address resolution: it makes it easier to analyze the capture.
To conclude the tutorial, let's consider a case where you just want to see TCP packets that bear your adId anywhere in their content. For this, tcpdump could be more convenient than Wireshark.
tcpdump -i rvi0 -A -vvv -s0 -w capture.txt
In above command we use:
- -i option to indicate the interface we want to capture
- -A option to show the packet contents in ascii
- -vvv to see as much information as possible
- -s0 to capture full packets, not just the first few bytes
- -w to write the capture to a file
Have fun !
Very Helpful!!! Thank you!!
ReplyDeleteHappy to help :) thanks for your appreciation Radhika!
ReplyDeleteThis article was very helpful ios online training Hyderabad
ReplyDeleteI have an app that controls my TV over WiFi. I would like to be able to control the TV from my home automation system, could I get a list of commands that the app sends by using this method?
ReplyDeleteYep, should work.
Deleteit is a beautiful post, and I want to say thank you so much for sharing this information.
ReplyDeletedigital marketing services in india
Thank you!
ReplyDeleteHello, I am thomus jons thank you for this informative post. That is a great job. Wish you more success.Thank you so much and for you all the best. Takes Down
ReplyDelete123movies
thanks man, super info here!!!
ReplyDeletebtw. xcode seems to give idiotic problems with license approval on first start, here the fix:
$sudo xcodebuild -license accept
This script helps alleviate the steps to deal with rvictl and finding & using device UUID: https://thrysoee.dk/iospcap/.
ReplyDeleteIf the rvictl command isnt found, that's cause Apple changed it's location to /Library/Apple/usr/bin/rvictl
ReplyDelete