Best IT Recipes

IPhone and WireShark

How can I sniff packages from my iPhone on my network? can someone give me some instructions? I tried Googling but teaches nothing how to sniff iPhone packages,

I am in the windows.

+61
iphone packet packet-sniffers packet-capture sniffing
Oct. 21 '09 at 2:17
source share
10 answers

You can use Paros to sniff network traffic from your iPhone. See this great step-by-step post for more information: http://blog.jerodsanto.net/2009/06/sniff-your-iphones-network-traffic/ . Also, check out the comments for some tips on using other proxies to do the same job.

One caveat is that Paras only sniffs HTTP GET / POST requests using the method described above, so to sniff all network traffic, try the following:

  • Just enable WiFi access and run a packet sniffer like Cocoa Packet Analyzer (on OSX).
  • Then connect to the new network from the iPhone via WiFi. (SystemPreferences-> Sharing> InternetSharing)

If you sniff these packages on Windows, connect to the Internet using Ethernet, share your Internet connection and use your Windows computer as an access point. Then simply start Wireshark as usual and intercept the passing packets, filtering their starting points. Alternatively, try using a network hub, as Wireshark can monitor all packets passing through the network if they use the same router endpoint address (as in the hub).

+66
Oct 21 '09 at 2:33
source share

This worked for me:

  • Connect your iOS device via USB

  • $ rvictl -s UDID where UDID is the UDID of your device (located in Xcode under Devices, shortcut with ⇧ ⌘ 2 )

  • $ sudo launchctl list com.apple.rpmuxd

  • $ sudo tcpdump -n -t -i rvi0 -q tcp or $ sudo tcpdump -i rvi0 -n

If victl does not work, install Xcode and the developer tools.

For more information, see Remote Virtual Interface and for the source tutorial here. Use your Blog Blog.

+33
Jan 11 '13 at 22:24
source share

I successfully captured HTTP traffic using Fiddler2 as a proxy server that can be installed on any Windows PC on your network.

  • In Fiddler, Tools → Fiddler Settings -> Connections → [x] Allow remote computers to connect.
  • Make sure your windows firewall is turned off.
  • On the iphone / ipod, go to your wireless settings, use the proxy server manual, enter the violinist the device IP address and the same port (by default - 8888).
+16
Apr 15 2018-11-21T00:
source share

The following worked for iPhone 4S (iOS 5) and Macbook Pro (10.8.2)

  • On your Mac, go to System Preferences> Sharing> Internet Access internetSharing

  • On your iPhone, go to Settings> Wi-Fi and select your Mac as your Wi-Fi hotspot. Click on the blue detailed information next to it and write down the IP address (192.168.2.2 in my case). At this point, the Wi-Fi icon on your taskbar's Mac should change to the following: wifi

  • Open wiring. Click on the initial capture and use the new bridge interface, which should now be available among the parameters. wshark

  • ???

  • Profit!

As with all things related to the network, you may have to restart wifi, etc., and repeat the steps and call your favorite deity to make this spell work :)

+7
Dec 14
source share

The tcpdump tool is available under gnu.

You can use it instead of wireshark .

+4
Aug 19 2018-11-11T00:
source share

I needed to do something very similar to find out why my iPhone is bleeding over cellular data, and after a couple of days it receives 80% of my 500 MB allowance.

Unfortunately, I had to shift sniff while on 3G / 4G and could not rely on wireless connectivity. Therefore, if you need an “industrial” solution, then this is how you sniff all the traffic (not just http) on any network.

Basic recipe:

  • Install VPN Server
  • Run packet sniffer on VPN server
  • Connect iPhone to VPN server and perform operations
  • Download .pcap from the VPN server and use your favorite .pcap analyzer on it.

Detailed instructions:

  • Get yourself a linux server, I used Digirtal Ocean's Fedora 20 64bit on a box for $ 5 a month
  • Configure OpenVPN on it. OpenVPN has comprehensive instructions
  • Make sure you configure Routing all traffic through the VPN section.
  • Keep in mind that the instructions for (3) are all the iptables that were replaced at the time of writing by the cmd firewall. This site explains the use of the cmd firewall
  • Make sure you can connect your iPhone to the VPN. I did this by downloading the free OpenVPN software. Then I installed the OpenVPN certificate. You can embed your ca, crt and key files by opening and pasting --- BEGIN CERTIFACTE --- ---- END CERTIFICATE --- in <ca> </ca> <crt> </ crt> <key> < / key>. Please note that I had to do this on a Mac with a text editor, when I used notepad.exe for Win, this did not work. Then I emailed it to my iphone and selected it.
  • Verify that the iPhone connects to the VPN and routes it through (google that my IP should return the VPN IP server when you launch it on the iPhone)
  • Now you can connect to the linux server and install wirehark (yum install wireshark).
  • This installs tshark, which is a command line package sniffer. Run this in the background from the screen tshark -i tun0 -x -w capture.pcap -F pcap (assuming the vpn device is tun0)
  • Now that you want to capture traffic, just start a VPN on your computer.
  • When VPN is completely disconnected
  • Download the .pcap file from your server and perform the analysis as usual. It was decrypted on the server when it arrived so that the traffic could be viewed in plain text (obviously, https is still encrypted).

Please note that the above implementation is not related to security, but simply to get a detailed batch capture of all your iPhone traffic on 3G / 4G / Wireless networks.

+4
Oct 27 '14 at 11:11
source share

I recommend Carl Web Proxy

Charles is an HTTP proxy server / HTTP monitor / reverse proxy server that allows a developer to view all HTTP and SSL / HTTPS traffic between their machine and the Internet. This includes requests, responses, and HTTP headers (which contain cookies and caches).

  • SSL Proxying - View SSL requests and responses in plain text
  • Bandwidth throttling to simulate slow Internet connections, including latency
  • AJAX Debugging - View XML and JSON requests and responses as a tree or text
  • AMF - View Flash Remoting / Flex Remoting message contents as a tree
  • Repeat queries to check internal changes; Edit queries to test various inputs
  • Breakpoints for intercepting and editing requests or responses
  • Validate recorded HTML, CSS, and RSS / atom responses using the W3C validator

It is cross-platform, written in JAVA, and pretty good. Not as much as Wireshark, and does a lot of unpleasant things, such as creating a proxy, etc. For you. The only bad part is that it costs money, $ 50. Not a cheap but useful tool.

Learn more about Charles’s features.

+3
Aug 11 '11 at 6:14
source share

The easiest way to do this is to use wifi, of course. You will need to determine if your wifi base acts like a hub or switch . If it acts as a hub, then just connect a Windows PC to it, and wirehark should be able to see all the traffic from the iPhone. If this is a switch, then your easiest bet will be to buy a cheap hub and connect the side of your Wi-Fi base to the hub, and then connect your computer via wires to the hub. At this point, wirehark will be able to see all the traffic passing through the hub.

+2
Oct 21 '09 at 2:50
source share

I like to use Pirni (available for free on Cydia on a jailbreak device), or there also Pirni Pro now for a few dollars ( http://en.wikipedia.org/wiki/Pirni ). I used the pirni-derv script for free in Google code ( http://code.google.com/p/pirni-derv/ ), mixed with Pirni, and it worked very well. I recommend it.

+2
May 30 '12 at 18:54
source share

You can proceed as follows:

  • Install Karl Web Proxy .
  • Disable SSL proxy (uncheck the box in the Proxy-> Proxy server ...-> SSL
  • Connect iDevice to Charles proxy as described here
  • Remove packets through Wireshark or Charles
0
Apr 08 '14 at
source share


More articles:


All Articles