The phrase “can’t capture packets” is too vague; in actual debugging, it corresponds to at least four completely different scenarios:

  1. No requests at all
  2. Only browser requests can be captured
  3. Requests are captured but HTTPS cannot be decrypted
  4. Requests are captured but data is incomplete

Without first identifying which scenario it is, you’ll keep reinstalling certificates or adjusting proxy configurations.

1. First, perform a verification test using only Safari

Do not open the app yet.

On the iPhone, execute:

  1. Connect to Wi-Fi
  2. Configure the proxy (pointing to Charles / Proxyman / SniffMaster on your computer)
  3. Install and trust the certificate
  4. Open Safari
  5. Visit an HTTPS website

Observe two outcomes

Outcome A: Safari shows no requests

This indicates the proxy was not successfully established.

Prioritize checking:

  • Is the IP address entered incorrectly?
  • Are the ports consistent?
  • Is the computer on the same network segment?
  • Is the packet capture tool running?

Only proceed if Safari can capture packets.

Outcome B: Safari can capture HTTPS packets

This confirms the proxy and certificate are functioning normally, allowing you to move to the next step.

2. Open only the app and check for requests

Now open the target app, trigger an action (e.g., login, request a list), and observe the packet capture tool.

Branch judgment

Scenario 1: No requests at all

This confirms the app is not using the system proxy.

This phenomenon can be directly observed:

  • Safari has requests
  • The app has no requests

Do not speculate about certificate or HTTPS issues.

3. Handling the case where the app does not use the proxy

Further adjusting the proxy at this point is ineffective; you need to switch the packet capture method.

Use SniffMaster to directly capture device traffic

Operation steps:

  1. Connect the iPhone to the computer via USB
  2. Keep the screen lit
  3. Click “Trust This Computer”
  4. Launch SniffMaster
  5. Select the iPhone from the device list
  6. Install the profile as prompted
  7. Enter HTTPS Brute Force Capture Mode
  8. Click Start
    Description

Then trigger the app request again.

Observe the results

Request records will now appear:

  • URL
  • Domain
  • Header

This confirms the requests exist but were previously not routed through the proxy.
HTTPS Brute Force

4. Second failure: HTTPS packets are captured but cannot be decrypted

Another scenario is where requests are visible but the content is encrypted. This manifests as Response being unviewable, with Body appearing as garbled or empty.

First, revert to Safari for verification

Use Safari to visit an HTTPS website again:

  • If Safari also cannot decrypt → Certificate issue
  • If Safari works normally → App internal validation

App internal certificate validation

At this point, the proxy certificate is already trusted by the system, but the app itself does not accept it.

In this case, proxy packet capture will not be effective, and reinstalling the certificate will not change the outcome.

You can continue using SniffMaster for brute force capture.

5. Third failure: Incomplete data

In SniffMaster, you might see:

  • URL normal
  • Header normal
  • Body empty

This phenomenon indicates HTTPS packets are captured, but the data cannot be fully decrypted.

Handling method: Re-sign the app

Operation steps:

  1. Obtain the app’s IPA file
  2. Sign it using an iOS development certificate
  3. Reinstall it on the device
  4. Capture packets again

After completion, you should see:

  • Request body
  • Response body

Fourth failure: Too much data to identify the target request

Another issue that may arise during device packet capture is an overwhelming number of requests, making it difficult to identify the target interface.

Directly filter by app

In SniffMaster:

  1. Click Select App
  2. Check the target application
  3. Trigger the operation again

The capture list will only retain traffic from the target app.
Select App

Perform the trigger again

To reduce interference:

  1. Clear the capture records
  2. Click “Start”
  3. Immediately execute the target operation

This narrows the request range to within a few dozen entries.

When to return to proxy packet capture

Direct device packet capture allows you to see data but not modify requests.

If you need to:

  • Modify parameters
  • Replay requests
  • Simulate interface responses

You need to return to Charles or Proxyman.

About the interceptor

SniffMaster supports an interceptor, but note that the interceptor is only available in proxy mode