In Mac OS X, Get Network Packet Data and TCP Dump Data of Attached iOS Device.

Wireshark data and TCP Dump data collection methods:

One can get network packet data and tcp dump from iOS App using attach iOS device using USB to any mac device.

Requirement: UDID of connected iOS device.


1. Open terminal and fire below commands to add attached iOS device into rvictl list:

• command:         rvictl -s
• e.g.         rvictl -s xxc30xxxx6dxfe1xfb99xxx7546xxx777xxxxeax
• result: Starting device                xxc30xxxx6dxfe1xfb99xxx7546xxx777xxxxeax [SUCCEEDED] with interface rvi0

This saves device into rvictl list and will be able to get tcp dump data for same. 


2. Now, to check if device is successfully added into list use command:

• command:         rvictl -l
• result: Current Active Devices:

                          [1] xxc30xxxx6dxfe1xfb99xxx7546xxx777xxxxeaxwith interface rvi0

Here, device's udid is listed with interface id (rvi0). This interface id (rvi0) is useful when getting data from wireshark.


3. To get tcp dump data on console use command:

• command:  tcpdump -n  -i rvi0  -x tcp OR tcpdump -n -t -i rvi0 -q -A tcp
• result:

4. Use wireshark to get network packet data:

Download and open Wireshark:

On home screen see for Capture heading. Under Capture, various interface ids will be listed. Choose interface id which was found when adding UDID into rvictl list.
For above example, it is: rvi0
Double click on "rvi0" and it opens window that started capturing network packet data.



This is it. Now you are able to get network packets and tcp dump data send/received to/from iOS device.



Ref: https://useyourloaf.com/blog/remote-packet-capture-for-ios-devices/

Download Wireshark from: https://www.wireshark.org/#download