Once you’re done capturing packets, you can use the same buttons/shortcuts to stop capturing. While capturing, Wireshark will display all the captured packets in real-time. The second one is tapping “Capture” and then tapping “Start.” The third way to start capturing is by tapping “Ctrl + E.” You can do this in several ways: The first one is by tapping the shark fin icon at the top-left corner. If you want, you can analyze multiple network connections at once by pressing “Shift + Left-click.”

You’ll see a list of available network connections you can examine.

For other options, see Technical Q&A QA1176 Getting a Packet Trace. TCPDump is included with all versions of OS X.

Now all Internet traffic from your iPhone will be recorded.The log generated can also be imported by WireShark (which is a GUI version of tcpdump). Use ifconfig if you have a network interface other than en1. In your Mac type sudo tcpdump -s 0 -A -i en1 port 443 > log.txt.Disconnect 3G on your iPhone from Settings > General > Network and check your Internet with Safari.Enable Internet Sharing, and connect to this new Wi-Fi network from your iPhone.In Share your connection from:, choose the interface you are getting Internet from, usually Ethernet.

In System Preferences > Sharing set To computers using: Wi-Fi.

Give it a random name, select security, and set a password.

In the Wi-Fi icon of your toolbar, click Create Network.

Or skip this step if you only want to sniff traffic from the app to your own computer.

Connect your Mac to your router using an Ethernet cable (the Wi-Fi card will be busy working as access point).

An alternative is using your Mac as a Wi-Fi access point and sniffing the traffic with TCPDump.

Wireshark https get filter