iOS命令行抓包

本文阐述了一种不使用任何工具就可网络抓包的方法。相比Charles，各有优点吧。音视频和文件传输的包亦可捕获到（Wireshark查看）。

iOS 5 added a remote virtual interface (RVI) facility that lets you use OS X packet trace programs to capture traces from an iOS device. The basic strategy is:

本人实测，iOS9，iOS10上可行。

$ ifconfig -l

查看当前端口号。

lo0 gif0 stf0 en0 en1 en2 p2p0 awdl0 bridge0 utun0

$ rvictl -s 74bd53c647548234ddcef0ee3abee616005051ed

添加你的设备的端口

Starting device 74bd53c647548234ddcef0ee3abee616005051ed [SUCCEEDED] with interface rvi0

再次执行  $ ifconfig -l 可以看到 添加成功了

lo0 gif0 stf0 en0 en1 en2 p2p0 awdl0 bridge0 utun0 rvi0

$ sudo tcpdump -i rvi0 -w 00.pacp

输入密码后，执行此命令。开始监听端口网络。

tcpdump: WARNING: rvi0: That device doesn't support promiscuous mode

(BIOCPROMISC: Operation not supported on socket)

tcpdump: listening on rvi0, link-type PKTAP (Apple DLT_PKTAP), capture size 262144 bytes

停止抓吧， 先使用control + C，结束当前编辑行模式。在执行如下命令

$ rvictl -x 74bd53c647548234ddcef0ee3abee616005051ed

Stopping device 74bd53c647548234ddcef0ee3abee616005051ed [SUCCEEDED]

Important: The RVI represents the entire networking stack of the iOS device; there's no way to trace a specific interface on the device, or even learn which packets were transferred on which interface.