wireshark capture filter for general network traffic

Your iPhone, iPad, or iPod touch will be available to capture packet traces in Airtool 2 only if you choose to accept the device to trust the Mac when you connect it to the computer for the first time.

I’ve connected my device, but I can’t see it listed in the Airtool 2 menu. However, here we describe two problems that may prevent you from capturing from your device successfully and how to resolve them: Making sure RVI is installed and functional can be challenging, especially on a Mac with Apple silicon, but once RVI’s working, capturing from your iPhone, iPad, or iPod touch should work without any issues. For example, if you only want to display traffic from the AWDL interface, use the filter expression frame.interface_name = 'awdl0' You can also filter the trace based on that interface. You can add a column to display the interface name in Wireshark. You may verify that rvictl is correctly installed by opening Terminal and typing: When you first launch Xcode and install the additional required components, it installs the rvictl tool. If you haven’t already, install Xcode from the Mac App Store. Airtool 2 automates this process and makes capturing traffic from your iPhone, iPad, or iPod touch a 1-click operation.

You connect your device to your Mac, find out the UUID of the device, use the UUID and a command-line interface tool to create the RVI for the device, and then do the capture using tcpdump by passing the name of the RVI interface and the desired tcpdump options. The process outlined by Apple to use RVI is very much manual. RVI is a mechanism that allows you to create a virtual network interface on your Mac and use tools like tcpdump to capture packets from the iOS device attached to that virtual interface. To capture traffic from your iOS device, Airtool 2 uses a tool called Remote Virtual Interface (RVI).

Wireshark capture filter for general network traffic