I had to do something very similar to find out why my iPhone was bleeding cellular network data, eating 80% of my 500Mb allowance in a couple of days.
Unfortunately I had to packet sniff whilst on 3G/4G and couldn't rely on being on wireless. So if you need an "industrial" solution then this is how you sniff all traffic (not just http) on any network.
Basic recipe:
- Install VPN server
- Run packet sniffer on VPN server
- Connect iPhone to VPN server and perform operations
- Download .pcap from VPN server and use your favourite .pcap analyser on it.
Detailed'ish instructions:
- Get yourself a linux server, I used Fedora 20 64bit from Digirtal Ocean on a $5/month box
- Configure OpenVPN on it. OpenVPN has comprehensive instructions
- Ensure you configure the Routing all traffic through the VPN section
- Be aware the instructions for (3) are all iptables which has been superseded, at time of writing, by firewall-cmd. This website explains the firewall-cmd to use
- Check that you can connect your iPhone to the VPN. I did this by downloading the free OpenVPN software. I then set up a OpenVPN certificate. You can embed your ca, crt & key files by opening up and embedding the --- BEGIN CERTIFACTE --- ---- END CERTIFICATE --- in < ca > < /ca > < crt >< /crt>< key > < /key > blocks. Note that I had to do this in Mac with text editor, when I used notepad.exe on Win it didn't work. I then emailed this to my iphone and picked installed it.
- Check the iPhone connects to VPN and routes it's traffic through (google what's my IP should return the VPN server IP when you run it on iPhone)
- Now that you can connect go to your linux server & install wireshark (yum install wireshark)
- This installs tshark, which is a command line packet sniffer. Run this in the background with screen tshark -i tun0 -x -w capture.pcap -F pcap (assuming vpn device is tun0)
- Now when you want to capture traffic simply start the VPN on your machine
- When complete switch off the VPN
- Download the .pcap file from your server, and run analysis as you normally would. It's been decrypted on the server when it arrives so the traffic is viewable in plain text (obviously https still encrypted)
Note that the above implementation is not security focussed it's simply about getting a detailed packet capture of all of your iPhone's traffic on 3G/4G/Wireless networks
