--- title: "Inspect an iOS app's network requests on a real device | Mobster" description: "Inspect your app's requests on an iPhone with Instruments. Mobster shows domains and companies. It never shows request paths, headers or bodies." canonical: "https://mobster.dev/blog/inspect-ios-app-network-requests-real-device" last-updated: "2026-11-13" --- Inspect your app's requests on an iPhone with Instruments. Mobster shows domains and companies. It never shows request paths, headers or bodies. # How to inspect network requests of an iOS app on a real device To inspect your own app’s requests on an iPhone, profile the app from Xcode with Instruments and choose the Network template. Its HTTP Traffic instrument records headers, bodies and timing for traffic through Apple’s URL Loading System. To capture the phone’s packet traffic, connect it by USB. Start a Remote Virtual Interface with `rvictl -s `. Record `rvi0` with `tcpdump`. TLS contents stay encrypted in that capture. To see which servers each app on the phone talks to, run `mobster xray network --device "Test iPhone"`. It records traffic over the cable and lists app domains by company. Mobster never shows request paths, headers or bodies on a real iPhone. 11 November 2026 ## See your app’s requests with Instruments 1. Choose your iPhone as the run destination, then choose Product › Profile in Xcode. 2. In Instruments, choose the **Network** template. 3. Press **Record**. A dialog explains that Instruments stores captured HTTP traffic unencrypted. Choose **Record Anyway**, and your app launches. The HTTP Traffic track groups requests by process, then by `URLSession`, then by domain. Switch a domain to **HTTP Transactions by Connection**, and the inspector shows the selected transaction’s request headers, response headers, and request and response bodies. Apple’s session on the instrument says it works on all Apple devices. Name your sessions so you can find them in the trace: ``` let session = URLSession(configuration: .default)session.sessionDescription = "Main Session" ``` To share a recording, export it as an HTTP Archive: ``` xcrun xctrace export --input App.trace --har --output App.har ``` Instruments stores the traffic unencrypted, and it can hold credentials. Treat the trace and its HAR export as secrets. ## Record every packet with rvictl iOS doesn’t record a packet trace itself. Your Mac records one through a Remote Virtual Interface (RVI) while the iPhone is on a USB cable: ``` rvictl -s sudo tcpdump -i rvi0 -w trace.pcap ``` `rvictl -s` prints the interface it made: `Starting device [SUCCEEDED] with interface rvi0`. Press `ctrl+c` to stop `tcpdump`, then run `rvictl -x ` to stop the interface. The trace holds all of the phone’s traffic, not only your app’s. Traffic sent over TLS stays encrypted in it. Mobster runs the same tools with limits: ``` mobster phone network capture --device "Test iPhone" --output trace.pcap --seconds 60 ``` Set the capture duration with `--seconds` and its packet limit with `--packets`. Use `--snaplen` to set how much of each packet it keeps. It writes a file with permissions restricted to your user. `tcpdump` needs capture permission on your Mac. If a capture was killed, the next one removes the interface it left. Mobster exposes no task action or MCP tool for this capture. ## See who each app talks to with Network X-ray [Network X-ray](https://mobster.dev/guides/iphone-network-xray) records the phone’s traffic over USB and turns it into a report per app: ``` mobster xray network --device "Test iPhone" --seconds 60 ``` A recording first prints `Recording Test iPhone over the cable for 60 s. Use the apps you want to look at. ctrl+c stops early.` Then it prints one line per app and where the report is. - **What it shows.** Each app’s domains, the company that runs each, whether it does ads, analytics or attribution, and bytes sent and received, in `report.html`, `report.md` and `netxray.json`. - **How it names apps.** It matches each process to an app on your phone by its executable name. Parts of iOS, such as `nsurlsessiond`, show as **iOS**. Traffic with no process name goes under **Unattributed**, and Mobster doesn’t guess. - **What it doesn’t show.** It decrypts nothing, so you see who an app contacted and how much, never what it sent. Encrypted DNS, iCloud Private Relay and Encrypted Client Hello hide some server names. - **Where it runs.** On a real iPhone on a cable. It refuses simulators. `--keep-capture` keeps the `.pcapng`, and `--from FILE.pcapng` reads one you already have, with no phone. - **Where the data goes.** The capture and report stay on your Mac. Mobster does not expose the report through MCP or Mobster Remote. ## Which tool to use | Tool | What it shows | |---|---| | Instruments, HTTP Traffic | Your app’s requests through Apple’s URL Loading System, with headers, bodies and timing | | `rvictl` and `tcpdump` | Every packet on the phone. TLS contents stay encrypted | | `mobster xray network` | Each app’s domains, companies and bytes, from one recording | Recording a phone with Network X-ray needs Mobster for Mac, which is free. Reading a capture with `--from` needs no phone. ## Questions - ### Can I see request bodies from an iOS app on a real iPhone? For your own app, yes. Instruments' HTTP Traffic instrument records header and body content from the URL Loading System, and its inspector shows the request and response bodies of a transaction. - ### Does Network X-ray decrypt HTTPS? No. It shows which domains an app contacted, the company behind each, and how much it sent and received. It never shows what the app sent. - ### Does Network X-ray work on a simulator? No. It refuses simulators, because only a real iPhone has the capture service. It records the iPhone over its USB cable. ## Sources - [Apple: analyzing HTTP traffic with Instruments](https://developer.apple.com/documentation/foundation/analyzing-http-traffic-with-instruments) - [Apple WWDC21: analyze HTTP traffic in Instruments](https://developer.apple.com/videos/play/wwdc2021/10212/) - [Apple: recording a packet trace](https://developer.apple.com/documentation/network/recording-a-packet-trace) - [Mobster docs: X-ray](https://docs.mobster.dev/xray) - [Mobster docs: capabilities, files, media and the network](https://docs.mobster.dev/capabilities) ## Try it on your own iPhone Download Mobster for Mac ## More from the blog ### [What iPhone App X-ray and Network X-ray show](https://mobster.dev/blog/iphone-xray-app-network-xray) 28 Oct 2026 ### [Test an iOS app on a real iPhone from your Mac](https://mobster.dev/blog/test-ios-app-on-real-iphone) 17 Oct 2026 ### [Reproduce an iOS crash with logs and video](https://mobster.dev/blog/reproduce-ios-crash-logs-video) 30 Oct 2026