Article from: Listen to Cloud Blog
In many cases, network packet capture and analysis are required. The packet capture on the iPhone is slightly different. The following three commonly used methods are introduced. The analysis tool takes wireshark as an example.
1. The easiest way: use the PC as a hotspot and capture packets on the PC
Pros: Simple
Disadvantage: can not capture real machine 2g/3g/4g network data
Proceed as follows:
1. Connect the PC to the cable
2. The PC uses wifi to share the network, that is, the PC is used as a hotspot.
3. Set the network on the mobile phone and select the PC hotspot
4. Open wireshark on the PC, select the interface to be monitored, specify the wifi port, and start capturing.
2. tcpdump command
Advantages: There are many advantages, you can do very advanced customization and selection, and you can programmatically control
Disadvantages: two, one is that the phone must be jailbroken, and the other is that it is more troublesome to use.
Proceed as follows:
1. Download tcpdump
Search and install tcpdump from cydia, if not found, please add the source http://apt.saurik.com
2. Install openssh
Search and install openssh from cydia, if not found, please add the source first http://apt.saurik.com
3. Exit cydia, this will restart the machine or restart springboard
4. Access the mobile phone through ssh command on the PC, as root, the initial password of root is alpine, for example:
After entering the password as prompted, you can log in to the phone remotely (it is recommended that the first thing is to use pwd to immediately change the default password). At this time, you can execute the tcpdump command to record network data.
5. Simple usage of tcpdump
tcpdump -h displays help information:
Usage: tcpdump [-aAdDeflLnNOpqRStuUvxX] [-c count] [ -C file_size ]
[ -E algo:secret ] [ -F file ] [ -i interface ] [ -M secret ]
[ -r file ] [ -s snaplen ] [ -T type ] [ -w file ]
[ -W filecount ] [ -y datalinktype ] [ -Z user ]
[ expression ]
Regarding the use of tcpdump, there are many online, for example: http://blog.chinaunix.net/uid-20237628-id-3946009.html
Since tcpdump only captures data, we need to get the captured data on the PC and analyze it with wireshark or similar tools, so the -w switch is necessary, it is used to specify a file that saves the captured data, and then we will Copy this file to a computer for analysis.
The -i switch is the most important, it specifies the network interface to intercept, for wifi, the interface is en0, for mobile digital networks, the network interface is pdp_ip0
E.g:
tcpdump -s 0 -i pdp_ip0 -w ~/1.PCap
The command requires to capture the data of the mobile network interface, to complete the data packet, and to save it to the ~/1.PCap file.
When it needs to end, use ctrl+z to end the tcpdump command. After the end, the data cached in the memory will be completely written to the file.
6. Copy the file to the PC
Copy the file to the PC with the scp command:
scp [email protected]:~/1.PCap ./
(Or a tool like ifunbox is easier to drag and drop)
7、现在，可以用wireshark打开1.PCap分析数据了。
总之，tcpdump很强大，也很复杂。以上我故意没有贴图，贴图会让篇幅很大，有点吓人。
三、最佳方式：rvictl命令
优点：简单，而且可以抓所有网络接口的数据
缺点：似乎没有，要求手机iOS5以上不算要求吧？如果说缺点，就是这个命令是xcode的Command Line Tools 中的。
步骤：
1、手机通过usb线连接到PC
2、查看手机的UDID，因为rvictl需要使用它。
可以从iTunes看：
红色区域如果不是UDID，点击它。
用xcode看更方便，window—>devices，然后选择手机，如图：
3、建立连接
格式：rvictl -s <UDID>
例如：
这样，PC上就多了一个虚拟的端口rvi0。可以用 -l参数查看有哪些虚拟端口：
好了，现在可以用wireshark捕捉这个端口的数据了。启动wireshark，并选择网络接口， 如图：
无论手机使用的是wifi还是2g、3个、4g，现在你在wireshark里都能实时看到数据了：
是不是非常方便？
4、最后，好习惯是用完关闭：
rvictl -x <UDID>
如：
