---
title: "What iPhone App X-ray and Network X-ray show | Mobster"
description: "App X-ray maps an app's screens, links and paywalls with no model. Network X-ray records an iPhone's network traffic and names the companies each app contacts."
canonical: "https://mobster.dev/blog/iphone-xray-app-network-xray"
last-updated: "2026-11-14"
---

App X-ray maps an app's screens, links and paywalls with no model. Network X-ray records an iPhone's network traffic and names the companies each app contacts.

# What iPhone App X-ray and Network X-ray show

28 October 2026

Mobster has two X-ray tools. App X-ray maps screens, links and paywalls using fixed rules. Network X-ray records the iPhone’s network traffic and identifies apps, domains and companies where it can. Both process their reports on your Mac without a model call. This post covers their reports and limits.

## App X-ray: a map of the screens

App X-ray opens an app on your iPhone, follows the navigation controls its rules allow, and returns a map: the screens it reached, how they connect, the paywalls it found with their plans and prices, and the numbers for the run. It is a task like any other, so it queues when the phone is busy, shows each tap in the run view, and ends when you press Stop.

```
mobster xray app com.apple.Preferences
```

This is the answer from the [X-ray docs](https://docs.mobster.dev/xray), run on Settings on an iPhone 17 Pro simulator (iOS 26.4). It stopped at the default cap of 30 screens:

```
Mapped 30 screens of Settings, 2 taps deep, in 3 min 50 s, with no model. It left 153 controls alone because they could act.Map: ~/Library/Application Support/app.mobster.desktop/xray/apps/com.apple.Preferences/20261015-225012/map.jsonReport: ~/Library/Application Support/app.mobster.desktop/xray/apps/com.apple.Preferences/20261015-225012/report.html
```

The output folder contains:

| File | What it holds |
|---|---|
| `map.json` | Each screen’s title and text, the taps that reach it, a wireframe of its layout, the links between screens, what it left alone, the paywalls and the stats |
| `report.html` | The same map as one self-contained page with a thumbnail of each screen |
| `frames/` | One thumbnail per screen |

The paywall card is the part a product team reads first. For every plan App X-ray read on a paywall it lists the screen, the plan, the price, the period and the trial. It reads the plans and backs out: it never starts a trial.

### What it taps and what it leaves alone

App X-ray fails closed. It taps a control only when the control’s shape says it opens a screen, such as a row in a list, a tab, a link with a chevron or a tall card, and its words name no act. It leaves alone:

- anything that names an act: delete, sign out, send, post, buy, subscribe, start a trial, allow. Words that are also what an app shows count only as a label’s first word, so “Feels like 67°” and “Software Update” are tapped and “Like” and “Update Now” aren’t;
- a row with its own info button, like a Wi-Fi network in Settings, because tapping the row joins it;
- switches, sliders, pickers, text fields and a row that holds a switch;
- everything on a paywall;
- a system dialog, except one it can close with “Not Now”, “Cancel” or “Close”;
- the rest of a screen where one tap changed the screen in place, in case it set something.

It never types, so a screen behind a sign-in is mapped up to that point. Some apps act on a plain tap that no label shows: a row in Phone places a call, a tile in Shortcuts runs a shortcut. App X-ray doesn’t map Phone, FaceTime, Shortcuts or Home, says so in one sentence and taps nothing.

Every tap is journaled before it is sent, the way the agent’s taps are. If the phone stops answering after a tap was sent, App X-ray doesn’t send it again. It ends with the map so far and says an action may have run. Text on a screen is data: a screen that says “tap here” changes nothing. The same rules are in [the safety docs](https://docs.mobster.dev/safety).

### Compare two maps

Map an app, update it, map it again, and diff the two. The diff needs no phone:

```
mobster xray diff before/map.json after/map.json
```

```
Yearly price went $59.99 → $69.99 on ProNew paywall screen: Upgrade (Settings › Upgrade), $4.993 new screens under SettingsGone: Old
```

That is the output format from the docs. Run it against your own app before a release and you see which screens and prices the build changed. Run it against a competitor’s app and you see theirs. `--json` prints the comparison as JSON.

## Network X-ray: who the app talks to

Network X-ray records one iPhone’s traffic over the USB cable for 5 to 3600 seconds, then reports it by app. Open Devices in Mobster for Mac and press **Network X-ray** on a phone’s card, or use the terminal:

```
mobster xray network --device "Test iPhone" --seconds 60
```

While it records, use the apps you want to look at. Mobster matches each process in the capture to an app on your phone by its executable name, groups the domains it saw by the company that runs them, and counts the ones on its own list of ad, analytics and attribution services.

### A real report from a made-up app

A real recording would name real apps, so this report comes from the synthetic capture used to test Mobster: a 60 s recording of a made-up app, Flashlight Pro, with documentation-range IP addresses. Nothing in it came from a real phone. We ran the report command on it on 17 October 2026:

```
mobster xray network --from flashlight.pcapng
```

```
In 59 s Flashlight Pro contacted 14 domains at 10 companies; 6 of them are ads, analytics or attribution.In 59 s iOS contacted 1 domain at 1 company.Report: <data folder>/xray/network/20261017-223055/report.html
```

The Markdown report lists every domain with its company and category, sorted by bytes received:

| Host | Company | Category | Sent | Received | Connections |
|---|---|---|---|---|---|
| `cdn.flashlightpro.example` | flashlightpro.example | Unknown | 11.4 KB | 318.3 KB | 1 |
| `ms4.applovin.com` | AppLovin | Ads | 9.5 KB | 187.3 KB | 1 |
| `googleads.g.doubleclick.net` | Google | Ads | 1.3 KB | 98.2 KB | 1 |
| `d3k81ch9hvuctc.cloudfront.net` | Amazon | Hosting | 3.2 KB | 54.8 KB | 1 |
| `app-measurement.com` | Google | Analytics | 7.7 KB | 5.4 KB | 2 |
| `api2.appsflyer.com` | AppsFlyer | Attribution | 3.4 KB | 2.8 KB | 1 |
| `o4507.ingest.sentry.io` | Sentry | Crash reports | 3.4 KB | 1.1 KB | 1 |

The full report has 14 rows for the app. The seven above are the largest and the most telling: the app downloads most of its bytes from its own CDN, then from an ad network, then from Google’s ad servers. The synthetic fixture gives one analytics host two connections to represent a paywall-closing event. Network X-ray does not infer that event from the traffic metadata. The `.example` domains are the made-up app’s own servers, so they have no category.

One host in that capture, `geo.locate-api.example`, is contacted over plain HTTP with a token in the URL path. The report shows the host, the bytes and the connection, and nothing of the path. The report includes hostnames, sizes and times, and omits URL paths. The raw capture contains the unencrypted path in this example.

The second line, “iOS contacted 1 domain”, is `courier.push.apple.com`. Processes that are parts of iOS, such as `apsd`, are labelled **iOS** and keep their process name in the details.

### How it names an app and a server

A packet’s app comes from the process name the capture records for it. When a packet has no process name, Mobster doesn’t guess: that traffic goes to a line called **Unattributed**, with its bytes and a sentence saying it isn’t counted for any app. A server’s name comes from the connection itself: the TLS handshake, the QUIC initial packet, a DNS answer, or an HTTP host header. Domains on no list get their own name as the company and no category.

### Why the cable

On an iPhone 15 Pro with iOS 26.0.1, the packet capture service refused Wi-Fi. Mobster requires USB for Network X-ray. If your phone is on Wi-Fi only, Mobster says so and asks you to plug it in. The capture travels over the cable, so it adds nothing to the phone’s own network traffic.

What a recording costs, measured on an Apple M5 Max with an iPhone 15 Pro on its cable, over two 90-second recordings of six and four apps:

| Measure | Value |
|---|---|
| `mobster-pcap` CPU time on the Mac | 0.58 to 0.63 s per 90 s, under 1% of one core |
| `mobster-pcap` memory | 6.5 to 8.8 MB |
| Traffic recorded | 58 MB and 50 MB (59,073 and 52,699 packets) |
| Packets with a process name | 98.3% and 98.7% |
| Traffic Mobster couldn’t tie to an app | 1 and 2 connections |

## How well it labels trackers

The tracker list is short and written by hand, from SDK vendors’ own documentation and from hostnames real recordings left unnamed. Here is how it did on two 90-second recordings on an iPhone 15 Pro (iOS 26.0.1): 10 apps opened one after another, 211 hostnames, labelled by hand afterwards.

- **Apps.** All 10 apps were named as they are on the phone, even where the process has another name.
- **Ads, analytics and attribution, before the list learned those recordings.** Per app, 26 of 31 flags were right (84%), and it caught 26 of 33 trackers (79%). It missed Nielsen, Kevel, Zefr, Tealium, Mapbox’s telemetry and Apple’s Search Ads attribution. It flagged Firebase Installations and Remote Config, which are plumbing, not measurement.
- **After adding those to the list,** the same recordings score 33 of 34 flags right and all 33 trackers caught. That is not an independent test, because the additions came from those recordings. The one wrong flag is `graph.facebook.com` inside an app that Meta makes.
- **Companies.** Every hostname the list names had the right company. The list names 160 of the 211 hostnames, and the rest show their own domain as the company.

## What it can’t see

- Names sent through encrypted DNS appear only when the connection itself names the server.
- iCloud Private Relay hides the real servers behind Apple’s relay.
- Encrypted Client Hello hides the server’s name in the handshake. Mobster counts those connections without a name.
- The report shows hostnames and traffic volume. Network X-ray does not decrypt traffic.

## What leaves your Mac

Network X-ray keeps its capture, report and task data on your Mac. Mobster makes no share link of the report, sends it to no destination and leaves it out of a feedback report. An API token alone can’t start a capture, and Network X-ray is not an agent or MCP tool, so a coding agent can’t record your phone’s traffic.

The open-source Mobster engine, the loop and safety core under App X-ray’s journaled taps, is MIT-licensed on [GitHub](https://github.com/RadishSoftware/mobster). X-ray itself ships inside Mobster for Mac, not in that repository, and the numbers above come from the [X-ray docs](https://docs.mobster.dev/xray) and our own run of the report command.

## Run it

You need [Mobster for Mac](https://mobster.dev/download) and an iPhone on a cable. [Several phones](https://docs.mobster.dev/devices) explains `--device`.

```
mobster xray app com.apple.Preferences --screens 30 --minutes 5mobster xray network --device "Test iPhone" --seconds 60 --app Weathermobster xray diff before/map.json after/map.json
```

Related: [Automate your own iPhone from a Mac](https://mobster.dev/blog/automate-iphone-from-mac) covers the tasks Mobster runs on the same phone.

## Questions

- ### How do I see which servers an iPhone app talks to?
  Plug the iPhone into your Mac and run mobster xray network --seconds 60, then use the apps you want to look at. Mobster records the traffic over the cable, groups the domains by app and by the company that runs them, and marks the ones that do ads, analytics or attribution.
- ### Does Network X-ray read what an app sends?
  Network X-ray captures traffic but does not decrypt it. Its report shows hostnames, sizes and times, without URL paths or IP addresses. The raw capture can contain unencrypted content, including URL paths. Mobster deletes the capture after analysis unless you pass --keep-capture.
- ### Does App X-ray use a model?
  No. App X-ray taps through an app with fixed rules and no model, so it costs nothing in model spend and needs no key. It taps only controls whose shape says they open a screen and whose words name no act, and it never types.
- ### Can I compare two versions of an app?
  Yes. Run App X-ray before and after an update, then run mobster xray diff before/map.json after/map.json. It needs no phone and prints what changed, such as a price, a new paywall or new screens.

## Sources

- [Mobster docs: X-ray](https://docs.mobster.dev/xray)
- [Mobster docs: approvals and safety](https://docs.mobster.dev/safety)
- [Mobster docs: devices](https://docs.mobster.dev/devices)
- [Mobster on GitHub: the engine and its research (MIT)](https://github.com/RadishSoftware/mobster)

## Try it on your own iPhone

Download Mobster for Mac

## More from the blog

### [Automate iPhone tasks from your Mac, with approvals](https://mobster.dev/blog/automate-iphone-from-mac)

7 Oct 2026

### [Why the Mobster engine is open source](https://mobster.dev/blog/why-mobster-is-open-source)

15 Oct 2026

### [Can ChatGPT control my iPhone?](https://mobster.dev/blog/can-chatgpt-control-my-iphone)

13 Nov 2026