tcpdump on iPhone

[lionet]

The easiest way to run tcpdump or Wireshark of iPhone/iPad/i* data without an Apple developer account or messing with iTunes. Entirely from the command line.

1. Connect your iPhone/iPad/whatever to your Mac using USB cable.
   
2. Determine the the device identifier (UDID):
   system_profiler SPUSBDataType | awk -F: '/ iP/{Found=1} /Serial/{if(Found) print "UDID:" $2; Found=0}'
   
3. Create a system interface (on a Mac) attached to the device:
   rvictl -s UDID
   
4. Use tcpdump -i rvi0 (or rviN, generally).
   

Example:

[vlm@nala:~]> system_profiler SPUSBDataType | awk -F: '/ iP/{Found=1} /Serial/{if(Found) print "UDID:" $2; Found=0}'
UDID: 38d0f91a99c57d189416439ce377ccdcd92639d0
[vlm@nala:~]> rvictl -s 38d0f91a99c57d189416439ce377ccdcd92639d0
Starting device 38d0f91a99c57d189416439ce377ccdcd92639d0 [SUCCEEDED] with interface rvi0
[vlm@nala:~]> tcpdump -i rvi0 -s0 -n port 80
Check here if you want a super-quick crash course to tcpdump: http://lionet.info/pdf/echo-tcpdump.pdf

Enjoy!