如果您在 Windows 上嗅探这些数据包后，请使用以太网连接到互联网，共享您的互联网连接，并使用 Windows 计算机作为您的接入点。然后，只需正常运行 Wireshark 并拦截流经的数据包，并按其起点进行过滤。或者，尝试使用网络集线器，因为 Wireshark 可以跟踪流经网络的所有数据包（如果它们使用相同的路由器端点地址（如在集线器中））。
One caveat is that Paras only sniffs HTTP GET/POST requests using the method above, so to sniff all network traffic, try the following:
Just turn on network sharing over WiFi and run a packet sniffer like Cocoa Packet Analyzer (in OSX).
Then connect to the new network from iPhone over WiFi. (SystemPreferences->Sharing->InternetSharing)
If you're after sniffing these packets on Windows, connect to the internet using Ethernet, share your internet connection, and use the Windows computer as your access point. Then, just run Wireshark as normal and intercept the packets flowing through, filtering by their startpoints. Alternatively, try using a network hub as Wireshark can trace all packets flowing through a network if they are using the same router endpoint address (as in a hub).
I have successfully captured HTTP traffic using Fiddler2 as a proxy, which can be installed on any Windows PC on your network.
In Fiddler, Tools -> Fiddler Options
-> Connections -> [x] Allow remote computers to connect.
Make sure your windows firewall is
disabled.
On the iphone/ipod, go to your
wireless settings, use a manual
proxy server, enter the fiddler
machine's ip address and the same
port (defaults to 8888).
The following worked for iPhone 4S (iOS 5) and Macbook Pro (10.8.2)
On your Mac, go to System Preferences > Sharing > Internet Sharing
On your iPhone, go to Settings > Wifi and choose your Mac as the Wifi Access Point. Press the blue detail disclosure next to it to and note down the IP Address (192.168.2.2 in my case). At this point, the wifi icon on Mac's your taskbar should change to the following:
Open wireshark. Click on start capture, and use the new bridge interface that should now be available among the options.
???
Profit!
As with all stuff networking related, you might have to restart wifi etc and repeat steps and invoke your favorite deity to get this incantation working :)
I had to do something very similar to find out why my iPhone was bleeding cellular network data, eating 80% of my 500Mb allowance in a couple of days.
Unfortunately I had to packet sniff whilst on 3G/4G and couldn't rely on being on wireless. So if you need an "industrial" solution then this is how you sniff all traffic (not just http) on any network.
Basic recipe:
Install VPN server
Run packet sniffer on VPN server
Connect iPhone to VPN server and perform operations
Download .pcap from VPN server and use your favourite .pcap analyser on it.
Check that you can connect your iPhone to the VPN. I did this by downloading the free OpenVPN software. I then set up a OpenVPN certificate. You can embed your ca, crt & key files by opening up and embedding the --- BEGIN CERTIFACTE --- ---- END CERTIFICATE --- in < ca > < /ca > < crt >< /crt>< key > < /key > blocks. Note that I had to do this in Mac with text editor, when I used notepad.exe on Win it didn't work. I then emailed this to my iphone and picked installed it.
Check the iPhone connects to VPN and routes it's traffic through (google what's my IP should return the VPN server IP when you run it on iPhone)
Now that you can connect go to your linux server & install wireshark (yum install wireshark)
This installs tshark, which is a command line packet sniffer. Run this in the background with screen tshark -i tun0 -x -w capture.pcap -F pcap (assuming vpn device is tun0)
Now when you want to capture traffic simply start the VPN on your machine
When complete switch off the VPN
Download the .pcap file from your server, and run analysis as you normally would. It's been decrypted on the server when it arrives so the traffic is viewable in plain text (obviously https still encrypted)
Note that the above implementation is not security focussed it's simply about getting a detailed packet capture of all of your iPhone's traffic on 3G/4G/Wireless networks
Charles is an HTTP proxy / HTTP monitor / Reverse Proxy that enables a developer to view all of the HTTP and SSL / HTTPS traffic between their machine and the Internet. This includes requests, responses and the HTTP headers (which contain the cookies and caching information).
SSL Proxying – view SSL requests and responses in plain text
Bandwidth Throttling to simulate slower Internet connections including latency
AJAX debugging – view XML and JSON requests and responses as a tree or as text
AMF – view the contents of Flash Remoting / Flex Remoting messages as a tree
Repeat requests to test back-end changes, Edit requests to test different inputs
Breakpoints to intercept and edit requests or responses
Validate recorded HTML, CSS and RSS/atom responses using the W3C validator
It's cross-platform, written in JAVA, and pretty good. Not nearly as overwhelming as Wireshark, and does a lot of the annoying stuff like setting up the proxies, etc. for you. The only bad part is that it costs money, $50 at that. Not cheap, but a useful tool.
最简单的方法当然是使用 wifi。您需要确定您的 wifi 底座是充当 集线器 还是 开关。如果它充当集线器，那么只需将您的 Windows 电脑连接到它，wireshark 就应该能够看到来自 iPhone 的所有流量。如果它是一个交换机，那么您最简单的选择是购买一个便宜的集线器，并将 wifi 底座的 wan 侧连接到集线器，然后将运行wireshark的 Windows 电脑也连接到集线器。此时，wireshark 将能够看到通过集线器的所有流量。
The easiest way of doing this will be to use wifi of course. You will need to determine if your wifi base acts as a hub or a switch. If it acts as a hub then just connect your windows pc to it and wireshark should be able to see all the traffic from the iPhone. If it is a switch then your easiest bet will be to buy a cheap hub and connect the wan side of your wifi base to the hub and then connect your windows pc running wireshark to the hub as well. At that point wireshark will be able to see all the traffic as it passes over the hub.
I like to use Pirni (availble for free in Cydia on a jailbroken device), or there's also Pirni Pro now for a few bucks (http://en.wikipedia.org/wiki/Pirni). I've been using the pirni-derv script available for free on Google Code (http://code.google.com/p/pirni-derv/) mixed with Pirni and it's been working very well. I recommend it.
发布评论
评论（10）
更新 (2021-04-01)： Paros 不再能够在许多操作系统上轻松安装和运行 由于使用了非常旧的 Java 版本。
然而，现在有 OWASP ZAP，它是 Paros 的一个分支，可用于实现相同的目的。
基本步骤是：
这是 Omer Levi Hevroni 关于 iOS 版 OWASP ZAP 的博文，其中更详细地介绍了如何执行这些步骤。
您可以使用 Paros 嗅探 iPhone 的网络流量。有关更多信息，请参阅这篇优秀的分步文章：http: //blog.jerodsanto.net/2009/06/sniff-your-iphones-network-traffic/。另外，请在评论中查看有关使用其他代理完成相同工作的一些建议。
需要注意的是，Paras 仅使用上述方法嗅探 HTTP GET/POST 请求，因此要嗅探所有网络流量，请尝试以下操作：
如果您在 Windows 上嗅探这些数据包后，请使用以太网连接到互联网，共享您的互联网连接，并使用 Windows 计算机作为您的接入点。然后，只需正常运行 Wireshark 并拦截流经的数据包，并按其起点进行过滤。或者，尝试使用网络集线器，因为 Wireshark 可以跟踪流经网络的所有数据包（如果它们使用相同的路由器端点地址（如在集线器中））。
Update (2021-04-01): Paros no longer can be easily installed and run on many OS's due to using an extremely old version of Java.
However there is now OWASP ZAP which is a fork of Paros and can be used to achieve the same ends.
Basic steps are:
Thre is a blogpost by Omer Levi Hevroni on OWASP ZAP with iOS which goes into significantly more detail on how to do these steps.
You can use Paros to sniff the network traffic from your iPhone. See this excellent step by step post for more information: http://blog.jerodsanto.net/2009/06/sniff-your-iphones-network-traffic/. Also, look in the comments for some advice for using other proxies to get the same job done.
One caveat is that Paras only sniffs HTTP GET/POST requests using the method above, so to sniff all network traffic, try the following:
If you're after sniffing these packets on Windows, connect to the internet using Ethernet, share your internet connection, and use the Windows computer as your access point. Then, just run Wireshark as normal and intercept the packets flowing through, filtering by their startpoints. Alternatively, try using a network hub as Wireshark can trace all packets flowing through a network if they are using the same router endpoint address (as in a hub).
这对我有用：
通过 USB 连接您的 iOS 设备
$ rvictl -s UDID其中UDID是您设备的 UDID（位于 XCode 中的“设备”下，快捷方式为 ⇧⌘2）$ sudo launchctl list com.apple.rpmuxd$ sudo tcpdump -n -t -i rvi0 -q tcp或$ sudo tcpdump -i rvi0 -n如果 victl 不起作用，请安装 Xcode 和开发人员工具。
有关详细信息，请参阅 远程虚拟接口，对于原始教程，这里是使用你的 Loaf 博客文章
This worked for me:
Connect your iOS device by USB
$ rvictl -s UDIDwhereUDIDis the UDID of your device (located in XCode under Devices, shortcut to with ⇧⌘2)$ sudo launchctl list com.apple.rpmuxd$ sudo tcpdump -n -t -i rvi0 -q tcpor$ sudo tcpdump -i rvi0 -nIf victl is not working install Xcode and the developer tools.
For more info see Remote Virtual Interface and for the original tutorial here's the Use Your Loaf blog post
我已经使用 Fiddler2 作为代理成功捕获了 HTTP 流量，该代理可以安装在您的任何 Windows PC 上网络。
->连接-> [x] 允许远程计算机连接。
禁用。
无线设置，使用手册
代理服务器，输入fiddler
机器的ip地址和相同
端口（默认为 8888）。
I have successfully captured HTTP traffic using Fiddler2 as a proxy, which can be installed on any Windows PC on your network.
-> Connections -> [x] Allow remote computers to connect.
disabled.
wireless settings, use a manual
proxy server, enter the fiddler
machine's ip address and the same
port (defaults to 8888).
以下内容适用于 iPhone 4S (iOS 5) 和 Macbook Pro (10.8.2)
在 Mac 上，转到系统偏好设置 >分享>互联网共享
在 iPhone 上，前往“设置”>“ Wifi 并选择您的 Mac 作为 Wifi 接入点。按旁边的蓝色详细信息显示并记下 IP 地址（在我的例子中为 192.168.2.2）。此时，Mac 任务栏上的 wifi 图标应更改为以下内容：
打开wireshark。单击“开始捕获”，然后使用选项中现在应该可用的新桥接界面。
???
利润！
与所有与网络相关的东西一样，您可能必须重新启动 wifi 等并重复步骤并调用您最喜欢的神灵才能使此咒语发挥作用:)
The following worked for iPhone 4S (iOS 5) and Macbook Pro (10.8.2)
On your Mac, go to System Preferences > Sharing > Internet Sharing
On your iPhone, go to Settings > Wifi and choose your Mac as the Wifi Access Point. Press the blue detail disclosure next to it to and note down the IP Address (192.168.2.2 in my case). At this point, the wifi icon on Mac's your taskbar should change to the following:
Open wireshark. Click on start capture, and use the new bridge interface that should now be available among the options.
???
Profit!
As with all stuff networking related, you might have to restart wifi etc and repeat steps and invoke your favorite deity to get this incantation working :)
我必须做一些非常类似的事情来找出为什么我的 iPhone 会耗尽蜂窝网络数据，几天之内就耗尽了我 500Mb 流量的 80%。
不幸的是，我不得不在 3G/4G 上嗅探数据包，并且不能依赖无线。因此，如果您需要“工业”解决方案，那么这就是您嗅探任何网络上所有流量（不仅仅是http）的方法。
基本秘诀：
详细的说明：
请注意，上述实现并非以安全为重点，它只是获取 iPhone 在 3G/4G 上所有流量的详细数据包捕获/无线网络
I had to do something very similar to find out why my iPhone was bleeding cellular network data, eating 80% of my 500Mb allowance in a couple of days.
Unfortunately I had to packet sniff whilst on 3G/4G and couldn't rely on being on wireless. So if you need an "industrial" solution then this is how you sniff all traffic (not just http) on any network.
Basic recipe:
Detailed'ish instructions:
Note that the above implementation is not security focussed it's simply about getting a detailed packet capture of all of your iPhone's traffic on 3G/4G/Wireless networks
tcpdump工具在 gnu 下可用。您可以使用它来代替
wireshark。The
tcpdumptool is available under gnu.You can use it instead of
wireshark.我推荐 Charles Web 代理
它是跨平台的，用 JAVA 编写，非常好。不像 Wireshark 那样势不可挡，并且可以为您做很多烦人的事情，例如设置代理等。唯一不好的是它要花钱，50 美元。不便宜，但却是一个有用的工具。
了解有关 Charles 功能的更多信息。
I recommend Charles Web Proxy
It's cross-platform, written in JAVA, and pretty good. Not nearly as overwhelming as Wireshark, and does a lot of the annoying stuff like setting up the proxies, etc. for you. The only bad part is that it costs money, $50 at that. Not cheap, but a useful tool.
Read more about Charles's features.
最简单的方法当然是使用 wifi。您需要确定您的 wifi 底座是充当 集线器 还是 开关。如果它充当集线器，那么只需将您的 Windows 电脑连接到它，wireshark 就应该能够看到来自 iPhone 的所有流量。如果它是一个交换机，那么您最简单的选择是购买一个便宜的集线器，并将 wifi 底座的 wan 侧连接到集线器，然后将运行wireshark的 Windows 电脑也连接到集线器。此时，wireshark 将能够看到通过集线器的所有流量。
The easiest way of doing this will be to use wifi of course. You will need to determine if your wifi base acts as a hub or a switch. If it acts as a hub then just connect your windows pc to it and wireshark should be able to see all the traffic from the iPhone. If it is a switch then your easiest bet will be to buy a cheap hub and connect the wan side of your wifi base to the hub and then connect your windows pc running wireshark to the hub as well. At that point wireshark will be able to see all the traffic as it passes over the hub.
我喜欢使用 Pirni（在越狱设备上的 Cydia 中免费提供），或者现在也有 Pirni Pro，只需几美元（http://en.wikipedia.org/wiki/Pirni）。我一直在使用 Google Code 上免费提供的 pirni-derv 脚本 (http://code .google.com/p/pirni-derv/）与 Pirni 混合，效果非常好。我推荐它。
I like to use Pirni (availble for free in Cydia on a jailbroken device), or there's also Pirni Pro now for a few bucks (http://en.wikipedia.org/wiki/Pirni). I've been using the pirni-derv script available for free on Google Code (http://code.google.com/p/pirni-derv/) mixed with Pirni and it's been working very well. I recommend it.
您可以按照以下步骤操作：
You can proceed as follow: