272

How can I capture mobile phone traffic on Wireshark?

Gerald Combs
  • 1,304
  • 10
  • 11
Xara
  • 7,568
  • 14
  • 47
  • 79

13 Answers13

361

Here are some suggestions:

  1. For Android phones, any network: Root your phone, then install tcpdump on it. This app is a tcpdump wrapper that will install tcpdump and enable you to start captures using a GUI. Tip: You will need to make sure you supply the right interface name for the capture and this varies from one device to another, eg -i eth0 or -i tiwlan0 - or use -i any to log all interfaces

  2. For Android 4.0+ phones: Android PCAP from Kismet uses the USB OTG interface to support packet capture without requiring root. I haven't tried this app, and there are some restrictions on the type of devices supported (see their page)

  3. For Android phones: tPacketCapture uses the Android VPN service to intercept packets and capture them. I have used this app successfully, but it also seems to affect the performance with large traffic volumes (eg video streaming)

  4. For IOS 5+ devices, any network: iOS 5 added a remote virtual interface (RVI) facility that lets you use Mac OS X packet trace programs to capture traces from an iOS device. See here for more details

  5. For all phones, wi-fi only: Set up your PC as a wireless access point, then run wireshark on the PC

  6. For all phones, wi-fi only: Get a capture device that can sniff wi-fi. This has the advantage of giving you 802.11x headers as well, but you may miss some of the packets

  7. Capture using a VPN server: Its fairly easy to set-up your own VPN server using OpenVPN. You can then route your traffic through your server by setting up the mobile device as a VPN client and capture the traffic on the server end.

notautogenerated
  • 268
  • 1
  • 7
rupello
  • 7,825
  • 1
  • 33
  • 32
  • how do I figure out the right interface name for the capture for my device (Nexus 7)? Also in the GUI within Shark, what are the right parameters to enter? Thanx – crazy horse Apr 28 '13 at 08:00
  • 1
    If you are interested in setting up a rogue access point on Windows 7 and above and capture packets using Wireshark, have a look at the steps I put together at http://mohit.io/blog/windows-capture-analyze-mobile-device-network-traffic/ This will work for any device that supports WiFi (Android, iOS, Wii, XBox, etc) – mohit May 20 '14 at 22:19
  • 2
    Regarding option 2: that's practically a non-existent option. From their page: "You will need [...] and a RTL8187 based wireless NIC"!!!! – matteo Aug 22 '14 at 22:20
  • @rupello, could you, please, explain abit more option 7? I managed to install openvpn server on interface "tun0" and managed to connect to this server from my phone. However, I cannot capture packets from this interface using scapy with the command `sniff(iface='tun0', count=10)`? – Yury Oct 10 '14 at 18:23
  • @Yury, my OpenVPN installation (the commercial one) creates two adapters for the access server, called as0t0 and as0t1. I capture the user packets using something like "sudo tcpdump -i as0t1 -s 0 -w out.cap" – rupello Oct 22 '14 at 20:25
  • @rupello, I already configured OpenVPN and scapy for sniffing traffic. There is a config parameter in the server `push "redirect-gateway def1"`that needs to be enabled. Additionally, in scapy function `sniff` it is required to use custom filter. In any case, thank you very much! – Yury Oct 23 '14 at 07:12
  • 1
    For me, the option #3 is the easiest to do simple tasks such as check what calls a certain app does. – Nighto Apr 08 '15 at 18:51
  • 1
    Most of those don’t work for packets that never leave the device or if you already use a VPN. So these are useless for solving MTU/fragmentation-related problems. – Evi1M4chine Jul 16 '15 at 11:49
  • There are Android firewall apps that can capture packets without root permissions. For example, [LostNet NoRoot Firewall](https://play.google.com/store/apps/details?id=com.lostnet.fw.free&hl=en&e=-EnableAppDetailsPageRedesign). – Dan Dascalescu Feb 07 '17 at 22:48
  • @DanDascalescu Any idea about what approach does Lostnet uses for its working? – Vishal Maral Feb 13 '17 at 12:50
  • 1
    What if I want to do the opposite? Use my usb-connected smartphone to capture my PC's packets? Basically run a wireshark-like software on my Android phone – dominicbri7 Oct 17 '17 at 08:37
  • #2 has a dead link. – Fund Monica's Lawsuit Mar 08 '19 at 00:59
43

In addition to rupello's excellent answer, a "dirty" but very effective trick:

For all phones, any (local) network: Set up your PC to Man-In-The-Middle your mobile device.

Use Ettercap to do ARP spoofing between your mobile device and your router, and all your mobile's traffic will appear in Wireshark. See this tutorial for set-up details

skrrgwasme
  • 8,245
  • 11
  • 47
  • 71
minipif
  • 4,446
  • 3
  • 26
  • 37
  • 3
    You can also use [Charles proxy](http://charlesproxy.com/) on Mac OS, for capturing HTTP traffic, it has a very nice interface and functionalities. You'll need to set up your computer's local IP has a proxy on your phone. It can sniff TLS traffic too, and do it without a warning if you install Charles' certificate on the phone. – minipif Nov 02 '15 at 00:49
33

Another option which has not been suggested here is to run the app you want to monitor in the Android emulator from the Android SDK. You can then easily capture the traffic with wireshark on the same machine.

This was the easiest option for me.

MazeChaZer
  • 1,148
  • 13
  • 7
  • 1
    That's interesting option. Can it handle ssl packets ? – ransh Nov 21 '17 at 06:50
  • The best and the easiest option is this one. Why messing with the phone? rooting, compiling tcpdump to be compatible with ARM CPUs, arpspoofing local network to direct traffic toward ethernet BLAH BLAH BLAH and eventually run wireshark and capture the packets??. Just install the app in an emulator and capture ethernet. easy-peasy – pouya Jan 06 '21 at 18:59
25

Wireshark + OSX + iOS:

Great overview so far, but if you want specifics for Wireshark + OSX + iOS:

  • install Wireshark on your computer
  • connect iOS device to computer via USB cable
  • connect iOS device and computer to the same WiFi network
  • run this command in a OSX terminal window: rvictl -s x where x is the UDID of your iOS device. You can find the UDID of your iOS device via iTunes (make sure you are using the UDID and not the serial number).
  • goto Wireshark Capture->Options, a dialog box appears, click on the line rvi0 then press the Start button.

Wireshark Capture Options Dialog Box

Now you will see all network traffic on the iOS device. It can be pretty overwhelming. A couple of pointers:

  • don't use iOS with a VPN, you don't be able to make sense of the encrypted traffic
  • use simple filters to focus on interesting traffic
  • ip.addr==204.144.14.134 views traffic with a source or destination address of 204.144.14.134
  • http views only http traffic

Here's a sample window depicting TCP traffic for for pdf download from 204.144.14.134:

Wireshark TCP traffic for pdf download from 204.144.14.134

drbobdugan
  • 403
  • 5
  • 12
9

For Android phone I used tPacketCapture: https://play.google.com/store/apps/details?id=jp.co.taosoftware.android.packetcapture&hl=en

This app was a lifesaver I was debugging a problem with failure of SSL/TLS handshake on my Android app. Tried to setup ad hoc networking so I could use wireshark on my laptop. It did not work for me. This app quickly allowed me to capture network traffic, share it on my Google Drive so I could download on my laptop where I could examine it with Wireshark! Awesome and no root required!

Farrukh Najmi
  • 4,418
  • 2
  • 29
  • 45
8

Packet Capture Android app implements a VPN that logs all network traffic on the Android device. You don't need to setup any VPN/proxy server on your PC. Does not needs root. Supports SSL decryption which tPacketCapture does not. It also includes a good log viewer.

Akira Yamamoto
  • 4,196
  • 3
  • 39
  • 41
4

Install Fiddler on your PC and use it as a proxy on your Android device.

Source: http://www.cantoni.org/2013/11/06/capture-android-web-traffic-fiddler

Pieter De Clercq
  • 1,857
  • 1
  • 13
  • 26
4

Similarly to making your PC a wireless access point, but can be much easier, is using reverse tethering. If you happen to have an HTC phone they have a nice reverse-tethering option called "Internet pass-through", under the network/mobile network sharing settings. It routes all your traffic through your PC and you can just run Wireshark there.

Peter Jeffe
  • 171
  • 6
3

Make your laptop a wifi hotspot for your phone (any) and connect it to internet. Sniff Traffic on your wifi interface using wireshark.

you will get to know a lot of anti privacy stuff!

FireCruZ
  • 47
  • 1
3

Preconditions: adb and wireshark is installed on your computer and you have a rooted android device.

  1. Download tcpdump to ~/Downloads
  2. adb push ~/Downloads/tcpdump /sdcard/
  3. adb shell
  4. su root
  5. mv /sdcard/tcpdump /data/local/
  6. cd /data/local/
  7. chmod +x tcpdump
  8. ./tcpdump -vv -i any -s 0 -w /sdcard/dump.pcap
  9. CTRL+C after you've captured enough packets.
  10. exit
  11. exit
  12. adb pull /sdcard/dump.pcap ~/Downloads/

Now you can open the pcap file using Wireshark.

AtomicBoolean
  • 990
  • 11
  • 19
1

For Android, I previously used tPacketCapture but it didn't work well for an app streaming some video. I'm now using Shark. You need to be root to use it though.

It uses TCPDump (check the arguments you can pass) and creates a pcap file that can be read by Wireshark. The default arguments are usually good enough for me.

user276648
  • 5,199
  • 5
  • 51
  • 79
0

I had a similar problem that inspired me to develop an app that could help to capture traffic from an Android device. The app features SSH server that allows you to have traffic in Wireshark on the fly (sshdump wireshark component). As the app uses an OS feature called VPNService to capture traffic, it does not require the root access.

The app is in early Beta. If you have any issues/suggestions, do not hesitate to let me know.

Download From Play

Tutorial in which you could read additional details

Andrey Egorov
  • 253
  • 3
  • 10
0

For iOS Devices:

⦿ Open Terminal and simply write:

rvictl -s udid

it'll open an interface on Wireshark with a name, In my case its rvi0.

enter image description here

udid is iPhone's unique device id.

(How to find my iOS Device UDID)

Haseeb Javed
  • 856
  • 8
  • 10