When capturing packets on an iPhone for the first time, it’s common to encounter situations where the tool is open, the certificate is installed, the app is making network requests, but no data appears in the capture interface.
This issue is not rare and can have multiple causes. Below, we’ll walk through an operational process step by step to set up the capture environment and explain what results to expect at each stage.
First, Verify the Capture Environment with a Browser
Before directly capturing app traffic on an iPhone, you can first verify the environment using a browser.
Tools required:
- Mac or Windows computer
- Charles, SniffMaster, or Proxyman
Configure the Proxy
Start Charles or SniffMaster on your computer, then proceed as follows:
- Check the proxy port (e.g., 8888)
- Confirm the computer’s IP address
- Connect the iPhone to the same Wi-Fi network
- Open iPhone Settings → Wi-Fi
- Tap on the current network
- Under HTTP Proxy, select “Manual”
- Enter the IP address and port
Save and return to the home screen.
Install the HTTPS Certificate
On the iPhone:
- Use Safari to open the certificate download URL
- Download the profile
- Install the certificate
- Enable trust in “Certificate Trust Settings”
Verify the Results
Open Safari and visit an HTTPS website.
Observe Charles or SniffMaster:
- Request records should appear
- You can view response content
This indicates that the proxy and certificate are working.
Start Capturing App Requests
In the same environment, open the target app.
Trigger an action, such as:
- Logging in
- Fetching data
Then observe the capture tool.
Two Possible Scenarios
Scenario 1: Requests Are Visible
Explanation:
- The app uses the system proxy
- You can directly analyze the requests
At this point, you can view:
- Request parameters
- Headers
- Response data
Scenario 2: No Requests Appear
This indicates that the app does not use the system proxy.
In this case, switch to a different capture method.
Switch to Direct Device-Level Packet Capture
When proxy-based capture fails to capture data, you can use a low-level device capture tool, such as SniffMaster.
This method does not rely on Wi-Fi proxy.
Using SniffMaster for Capture
Steps:
- Connect the iPhone to the computer via USB
- Keep the device unlocked
- Tap “Trust This Computer” on the iPhone
- Launch SniffMaster
- Select the iPhone from the device list
- Install the profile as prompted
- Enter HTTPS Brute Force Capture Mode
- Click Start
Then trigger requests on the iPhone.
Observe the Results
In the capture interface, you can see:
- Request domains
- Request paths
- Header information
If app requests exist, data will definitely appear here.
Capture Traffic for a Specific App Only
Device-level capture includes system traffic, such as:
- DNS
- Apple services
To reduce interference, you can filter by app.
Steps:
- Click Select App
- Check the target application
- Trigger requests again
The capture list will only display data from that app.
When HTTPS Data Is Incomplete
If in the capture results:
- URLs are visible
- But the body is empty
Explanation:
- HTTPS has been captured
- But the app is not signed with a development certificate
Handling method:
- Obtain the app’s IPA file
- Re-sign it with a development certificate
- Reinstall the app
- Capture packets again
After completion, you can see complete requests and responses.
How to Modify Requests
If during debugging you need to:
- Modify request parameters
- Simulate interface returns
Use a proxy-based capture tool.
For example, in Charles or Proxyman:
- Enable Breakpoints
- Modify request content
- Then send the request
About Interceptors
SniffMaster also supports interceptors, but note that interceptor functionality is only available in proxy mode
Device-level capture mode does not modify data.
Analyze Network Connection Issues
If the issue is not about data content but connection problems, such as:
- Request timeouts
- Occasional interface failures
You can use stream capture and export to Wireshark.
In Wireshark, you can view:
- TCP connection establishment process
- Data retransmissions
- Reasons for connection disconnections
When capturing packets on an iPhone, follow this approach:
- Use Safari to verify the proxy and certificate
- Attempt proxy-based capture
- If capture fails, switch to low-level device capture
- If data is incomplete, handle signature issues
- If you need to modify requests, use proxy mode