In the main window, one can find the capture filter just above the interfaces list and in the interfaces dialog. Display filters on the other hand do not have this limitation and you can change them on the fly. The latter are used to hide some packets from the packet list.Ĭapture filters are set before starting a packet capture and cannot be modified during the capture. The former are much more limited and are used to reduce the size of a raw packet capture.

For other options, see Technical Q&A QA1176 Getting a Packet Trace.Capture filters (like tcp port 80) are not to be confused with display filters (like tcp.port = 80). TCPDump is included with all versions of OS X.

Now all Internet traffic from your iPhone will be recorded.

The log generated can also be imported by WireShark (which is a GUI version of tcpdump). Use ifconfig if you have a network interface other than en1.

In your Mac type sudo tcpdump -s 0 -A -i en1 port 443 > log.txt.

Disconnect 3G on your iPhone from Settings > General > Network and check your Internet with Safari.

Enable Internet Sharing, and connect to this new Wi-Fi network from your iPhone.

In Share your connection from:, choose the interface you are getting Internet from, usually Ethernet.

In System Preferences > Sharing set To computers using: Wi-Fi.

Give it a random name, select security, and set a password.

In the Wi-Fi icon of your toolbar, click Create Network.

Or skip this step if you only want to sniff traffic from the app to your own computer.

Connect your Mac to your router using an Ethernet cable (the Wi-Fi card will be busy working as access point).

An alternative is using your Mac as a Wi-Fi access point and sniffing the traffic with TCPDump.

Https filter wireshark