iOS System network Capture package method

In the development process of iOS, often encounter a variety of network access issues, before the lack of capture tools, a lot of network problems to solve the pain. Now that's finally good, this article provides two ways to do network capture:

1. Network sharing + Visual Grab Kit

• Basic principle

The principle is simple, the iOS device shares the wireless network card which connects the Mac computer through the proxy way, uses the grab Bag tool to grab the bag, then carries on the analysis (we recommend using the Wireshark, also can use the Paros tool on the MAC system).

Now take the MAC system Paros tool as an example, detailed description of the following packet capture process:

• Operation Steps

1) First share the Mac computer's Ethernet to airport, so that the iOS device can connect via WiFi

Open System Preferences, locate the share, select Internet Share, and on the right, select airport by selecting Ethernet, connect to other computers in the following way.

2) Open Paros, set PAROS local agent Paros (http://www.parosproxy.org/)

In Paros's tools-options, select Local Proxy and enter the airport IP address in address. Enter port 8080. Open System Preferences, locate the network, select Airport on the left, and you can see that airport has an address of 169.254.69.225 and fill it in the Address column mentioned above.

3) Connect your Mac to a shared network using your iOS device: on your iOS device, choose Settings-"General-" network-"WiFi, find a shared network, join." Then in the fine content of the network HTTP proxy section, select Manual, enter the proxy IP and port set in Paros.

4) Below you can use PAROS to monitor the network of your iOS devices, we open Safiri, and in Paros we see all requests from the network.

2. tcpdump Command + Visual Grab Kit

• Basic principle

The tcpdump command is a network-grabbing command line that can specify specific devices, and can also develop a specific five-tuple to capture packets on the link. It can be printed on the terminal or the captured data can be written to a file, the format of the file is a binary form, so I opened the file when the tool is UltraEdit.

Of course, you can also save the PCAP format that Wireshark can recognize, and then use Wireshark to view it.

• Operation Steps

1) using SSH to access the iphone, use the top command to get:

The steps are as follows:

A) Get the device IP address (WiFi address):

b) Open the terminal on the PC and enter the SSH [email protected] Address:

Enter Password: Alpine (root user's default password)

2) Save the TCP packet to the root of the iOS device via the "tcpdump-x-s0-w/data.pcap" command.

3) Remove the Pcap file by using a tool such as 91 assistant, and use double-click to open view under Windows using Wireshark.

Of course, you can also not output to a file, tcpdump command format and parameter description:

tcpdump [-ADEFLNNOPQSTVX] [-C Quantity] [-f filename]

[-I Network interface] [-R FileName] [-S Snaplen]

[-T type] [-w file name] [Expression]

Selection Introduction:

-A converts the network address and broadcast address into a name;

-D gives the code of the matching packets in a compiled format that people can understand;

-DD the code of the matching packet is given in the format of the C Language Program section;

-DDD the code for matching packets is given in decimal form;

-e Displays the number of packets captured

-F Print out the external Internet address in digital form;

-L causes the standard output to become the buffer line form;

-N Do not convert the network address into a name;

-T does not print timestamps on each line of the output;

-V outputs a slightly more detailed information, such as the TTL and the type of service that can be included in the IP packet;

-VV output detailed message information;

-C After receiving the specified number of packets, the tcpdump will stop;

-F reads an expression from the specified file, ignoring other expressions;

-i specifies the network interface for listening;

-R reads packets from the specified file (these packages are typically generated via the-w option);

-W writes the package directly to the file and does not parse and print it;

-T directly interprets the heard packet as a specified type of message, common types are RPC (remote Procedure Call) and SNMP (Simple Network Management Protocol;)

The main options I use when using this command are:-I [Interface name]-w [filename]-v-vv-c-x-e

For example:

I was capturing 100 packets from eth0 and writing the data to the Capture.cap file in the following format:

Tcpdump-i eth0-w capture.cap-v-vv-c 100-x-E

Grab a packet between an IP segment:

Tcpdump–s 0–w Socket host 10.1.3.9 and host 10.1.3.84

If you are from eth0 and the communication protocol port is 22, the destination IP is 192.168.1.100 to get the data:

Tcpdump-i eth0 port and SRC host 192.168.1.100

There are other key words: Host, (host), net (Gateway), Port (port), src (source IP), DST (destination IP), regular expression: and, or.