How to inspect network requests of an iOS app on a real device

See your app’s requests with Instruments

1. Choose your iPhone as the run destination, then choose Product › Profile in Xcode.
2. In Instruments, choose the Network template.
3. Press Record. A dialog explains that Instruments stores captured HTTP traffic unencrypted. Choose Record Anyway, and your app launches.

The HTTP Traffic track groups requests by process, then by URLSession, then by domain. Switch a domain to HTTP Transactions by Connection, and the inspector shows the selected transaction’s request headers, response headers, and request and response bodies. Apple’s session on the instrument says it works on all Apple devices.

Name your sessions so you can find them in the trace:

let session = URLSession(configuration: .default)session.sessionDescription = "Main Session"

To share a recording, export it as an HTTP Archive:

$ xcrun xctrace export --input App.trace --har --output App.har

Instruments stores the traffic unencrypted, and it can hold credentials. Treat the trace and its HAR export as secrets.

Record every packet with rvictl

iOS doesn’t record a packet trace itself. Your Mac records one through a Remote Virtual Interface (RVI) while the iPhone is on a USB cable:

$ rvictl -s <UDID>$ sudo tcpdump -i rvi0 -w trace.pcap

rvictl -s prints the interface it made: Starting device <UDID> [SUCCEEDED] with interface rvi0. Press ctrl+c to stop tcpdump, then run rvictl -x <UDID> to stop the interface. The trace holds all of the phone’s traffic, not only your app’s. Traffic sent over TLS stays encrypted in it.

Mobster runs the same tools with limits:

$ mobster phone network capture --device "Test iPhone" --output trace.pcap --seconds 60

Set the capture duration with --seconds and its packet limit with --packets. Use --snaplen to set how much of each packet it keeps. It writes a file with permissions restricted to your user. tcpdump needs capture permission on your Mac. If a capture was killed, the next one removes the interface it left. Mobster exposes no task action or MCP tool for this capture.

See who each app talks to with Network X-ray

Network X-ray records the phone’s traffic over USB and turns it into a report per app:

$ mobster xray network --device "Test iPhone" --seconds 60

A recording first prints Recording Test iPhone over the cable for 60 s. Use the apps you want to look at. ctrl+c stops early. Then it prints one line per app and where the report is.

• What it shows. Each app’s domains, the company that runs each, whether it does ads, analytics or attribution, and bytes sent and received, in report.html, report.md and netxray.json.
• How it names apps. It matches each process to an app on your phone by its executable name. Parts of iOS, such as nsurlsessiond, show as iOS. Traffic with no process name goes under Unattributed, and Mobster doesn’t guess.
• What it doesn’t show. It decrypts nothing, so you see who an app contacted and how much, never what it sent. Encrypted DNS, iCloud Private Relay and Encrypted Client Hello hide some server names.
• Where it runs. On a real iPhone on a cable. It refuses simulators. --keep-capture keeps the .pcapng, and --from FILE.pcapng reads one you already have, with no phone.
• Where the data goes. The capture and report stay on your Mac. Mobster does not expose the report through MCP or Mobster Remote.

Which tool to use

Recording a phone with Network X-ray needs Mobster for Mac, which is free. Reading a capture with --from needs no phone.