iOS Packet Capture
This guide teaches you how to capture packets on iPhone / iPad: connect a data cable to a computer, choose a mode, and start capturing—no jailbreak throughout. From 'zero-config visibility into system requests' to 'full device traffic' to 'complete plaintext for a single app', each of the three modes has its own steps. This guide walks you through them step by step.
1. When to Use It and How to Choose Among the Three Modes
After you select iOS in New Session for iOS packet capture, you will be asked to choose one of three. First pick the one you want from the table below, then follow the corresponding section:
| Your Goal | Which Mode | What You Can See | Certificate / Re-signing Needed? |
|---|---|---|---|
| Quickly see which HTTPS requests this device sends (URL / status / headers) | System-level Capture | Even for regular apps, you can see request URLs and headers (Body not visible) | Only install a device diagnostics profile |
| All traffic from the entire device (including non-HTTP, handshake / SNI) | NIC Capture | Full data, ciphertext by default; can do targeted decryption for a specified app | Not needed to view ciphertext; re-sign only to decrypt plaintext for a specific app |
| Complete plaintext send/receive (including Body) for an app | App-level Capture | Complete plaintext for a single app | Target app must be re-signed with a development certificate |
System-level capture is the easiest: for regular apps and App Store apps, you can also see which HTTPS addresses they request—no CA certificate, no proxy, and no fear of certificate pinning. To quickly investigate 'which endpoints does this app actually connect to', start with it.
In addition to the above three, iPhone / iPad can also use proxy capture: point the device's Wi-Fi proxy to this computer, install a root certificate, and you can capture HTTPS plaintext just like on a computer, with full capabilities such as rewrite and replay. Suitable for debugging apps that use the system proxy.
2. Prerequisites (Common to All Three Modes)
- TraceEagle is installed and started (on first launch, just accept the system permissions).
- Connect iPhone / iPad to the computer with a data cable, and tap Trust when prompted on the device.
- No jailbreak required: all three modes are for non-jailbroken devices.
- Newer systems are also supported: iOS 17 and later can still connect and capture normally.
- Prepare certificates / re-signing according to the mode (no rush if you do not have them; the tool will guide you when needed):
- System-level capture: install a device diagnostics profile (once is enough).
- NIC capture: to view only ciphertext and addresses, no certificate is needed; to decrypt plaintext for an app, you must re-sign that app with a development certificate.
- App-level capture: the target app must be re-signed with a development certificate (App Store and system apps must be re-signed first before they can be targets).
- For detailed steps to install certificates / profiles, see Certificate Installation.
3. Select a Device: The First Common Step for All Three Modes
- Create a new session, and select iOS for Target.
Select your phone in the Device dropdown; if it does not appear right after plugging in, click Refresh. If the same device also appears over the network, identifying the USB entry by USB / Network is the most reliable.
Under Mode, select one of NIC Capture / System-level Capture / App-level Capture, then read the corresponding section below.
4. System-level Capture — Easiest, Works with Regular Apps
If you want to quickly see 'which HTTPS requests this iPhone sends' without installing a CA certificate, setting a proxy, or dealing with certificate pinning, choose this mode.
- Select System-level Capture for Mode.
- If you have not installed the device diagnostics profile, install it once as prompted (see Certificate Installation); skip if already installed.
- Click Create to start, then operate the app you want to observe normally on the phone.
How much you can see depends on the target app:
- Regular apps, App Store apps: usually you can see the request method, full URL (HTTPS addresses are also plaintext), status code, request headers, and response headers.
- Apps signed with a development certificate: even the complete request / response Body is visible.
5. NIC Capture — See Everything on This Device
To view all network traffic of the entire device—unrestricted by app or protocol, including non-HTTP QUIC and custom protocols—choose this mode.
- Select NIC Capture for Mode.
- Click Create to start. By default, what is captured is ciphertext packets + metadata (target address, port, and the SNI hostname in the TLS handshake)—enough to see 'where this device connects and with what protocol'.
- To see plaintext for a specific app: check Decrypt this Program for that app to decrypt its plaintext; the prerequisite is that the app has been re-signed with a development certificate (see Certificate Installation).
6. App-level Capture — Complete Plaintext for a Single App
To obtain the complete plaintext (including Body) sent and received by one specific app—it takes data from inside the app, and certificate pinning cannot block it—choose this mode.
- Select App-level Capture for Mode.
- Select the target app from the app list. Only apps that have been re-signed with a development certificate are selectable; the rest are grayed out—if the app you want to capture is gray, re-sign it first (see Certificate Installation).
- If you also want to capture early startup traffic, you can first close the target app, then click Create and reopen it.
- Click Create to start, then operate the app on the phone.
- If plaintext cannot be decrypted: turn on the socket traffic switch as a fallback—for apps whose plaintext cannot be obtained through the regular method, use a lower-level path to get data.
7. Verify: Confirm You Have Captured Traffic
After creation, a session tab opens. Operate the corresponding app on the phone, and requests will appear in the left list in real time. Click any entry to view details:
- System-level Capture: you can see the request method, full URL, status code, and request / response headers (for apps signed with a development certificate, you can also see the Body).
- NIC Capture: you can see the target address, port, and SNI hostname; for an app with Decrypt this Program checked, the response is readable plaintext.
- App-level Capture: the request line, request headers, and Body are all present, and the response is plaintext rather than garbled ciphertext.
8. Cannot Connect / Cannot Capture? Troubleshoot Item by Item
| Symptom | Likely Cause | What to Do |
|---|---|---|
| Phone not visible in the Device dropdown | Not plugged in properly, not trusted, or just plugged in and not enumerated yet | Try another data cable / USB port, tap Trust on the phone, then click Refresh |
| Two entries for the device; which one to choose | The same device is on both USB and network | Prefer the USB entry; it is the most reliable |
| System-level capture creates no entries | Device diagnostics profile is not installed or not effective | Install the profile as described in Certificate Installation, then create the session again |
| System-level capture shows only addresses and headers, no Body | Target is a regular app / App Store app | This is a limitation of system diagnostic logs; for a complete Body, switch to App-level Capture (the app must be re-signed first) |
| NIC capture is all ciphertext; plaintext is not visible | Targeted decryption was not enabled for the target app | Check Decrypt this Program for the app; if it cannot be checked, the app has not been re-signed with a development certificate—re-sign it first (Certificate Installation) |
| Target app is gray and unselectable in App-level Capture | The app has not been re-signed with a development certificate | Re-sign it first (both App Store / system apps must be re-signed first), see Certificate Installation |
| App-level Capture captures traffic but cannot decrypt plaintext | The app uses a proprietary / statically linked library | Turn on the socket traffic switch as a fallback and use a lower-level path to get data |
| Want to capture requests from the first few seconds after app launch | The session was opened after the app was already running | Close the app first, create the session, then reopen it |
| Certificate / profile is installed but capture still fails | The profile has not been trusted in the phone's Settings | Go to the phone's Settings and trust the corresponding profile / certificate, then retry; see Certificate Installation for details |
Next Steps
- How to read captured data, switch views, and decode: see Data Viewing and Decoding.
- To modify while viewing, edit and resend requests, or intercept and manually modify them: see Rule Rewriting and Breakpoint Interception, Request Construction and Replay.
- For private / proprietary protocols and teaching it how to read them yourself: see Custom Protocol Decoding.
- To capture HTTPS plaintext on a phone like on a computer and use full rewrite/replay capabilities: see Proxy Capture with Certificate Installation.
- To capture Android devices: see Android Capture.
Top comments (0)