--- title: "See which companies an iPhone app contacts | Mobster" description: "Network X-ray records an iPhone's traffic over USB and lists each app's domains by company and by ads, analytics or attribution. It stays on your Mac." canonical: "https://mobster.dev/guides/iphone-network-xray" last-updated: "2026-11-13" --- Network X-ray records an iPhone's traffic over USB and lists each app's domains by company and by ads, analytics or attribution. It stays on your Mac. # See which companies an iPhone app talks to Network X-ray records an iPhone's traffic over USB and lists each app's domains by company and by ads, analytics or attribution. It stays on your Mac. Network X-ray in Mobster for Mac: in 60 seconds, 3 apps contacted 15 domains at 6 companies, listed by app, company and what it does. ``` mobster xray network --device "Test iPhone" --seconds 60 ``` [Download for Mac](https://mobster.dev/download) On this page 1. [Run it](#run-it) 2. [What you get](#what-you-get) 3. [How it ties traffic to apps](#how-it-ties-traffic-to-apps) 4. [Where it stops](#where-it-stops) 5. [Questions](#questions) 6. [Sources](#sources) Every app on your phone talks to servers you never chose. Some are the app’s own. Many belong to analytics, attribution and ad companies bundled into it. Network X-ray puts a number and a company name on each, for your own app before you ship it, or for any app you want to understand. ## Run it Plug the iPhone into your Mac, use the command above and open the apps you care about while it records. Or in Mobster for Mac, open **Devices**, press **Network X-ray** on the phone’s card, choose 30 s, 60 s or 2 min and press **Record**. The apps and the companies they talk to fill in as they appear. The command first prints `Recording over the cable for 60 s. Use the apps you want to look at. ctrl+c stops early.` and then one line for each app that used the network. This is the shape of those lines: ``` In 59 s Flashlight Pro contacted 14 domains at 10 companies; 6 of them are ads, analytics or attribution.In 59 s iOS contacted 1 domain at 1 company.Report: ~/Library/Application Support/app.mobster.desktop/xray/network/20261015-225906/report.html ``` Each line counts the domains Mobster saw in that app’s traffic, groups them by the company that runs them and counts the ones on the Mobster list of ad, analytics and attribution services. That list is short. Mobster wrote it from the SDK vendors’ own documentation and from hostnames real recordings left unnamed. A domain on no list gets its own name as its company and no category. ## What you get | File | What it holds | |---|---| | `report.html` | One page with no script that loads nothing from the web: a section per app, then every domain with its company, category, sizes and connections | | `report.md` | The same in Markdown | | `netxray.json` | The numbers: per app and per domain, the company, the category, bytes up and down, packets and connections | In the Mac app the result also shows as a task with two tables, **Who your apps talked to** and **Every domain**. You can sort, filter and export them like any result. `--app NAME` reports one app only, and `--from FILE.pcapng` reads a capture you already have, with no phone. ## How it ties traffic to apps Mobster matches each process in the capture to an app on your phone by its executable name. Parts of iOS itself, such as `nsurlsessiond`, are labelled **iOS**. The capture travels over the cable, so it adds nothing to the phone’s own network traffic. ## Where it stops - It records one phone at a time, the one you name with `--device`. - Traffic it can’t tie to an app is never guessed. It goes to **Unattributed**, with its size and a sentence that says Mobster couldn’t tell. - The network capture is not an agent or MCP tool, and an API token alone can’t start one. Only the Mac app’s own session can. [What an iPhone X-ray shows about any app](https://mobster.dev/blog/iphone-xray-app-network-xray) puts Network X-ray beside App X-ray. ## Questions - ### Does it need a jailbreak or a proxy? No. It reads the packet capture that iOS offers over the USB cable. The report holds domains, companies, categories, sizes and connections. - ### Why does it need the cable? iOS offers its packet capture service only over USB. Over Wi-Fi it refuses the service. When the phone is on Wi-Fi only, Mobster says so in one sentence and asks you to plug it in. - ### Does the recording leave my Mac? No. The capture, the report and the task stay on your Mac. Mobster makes no share link, sends nothing to a destination and leaves the task out of a feedback report. - ### What can't it see? Names sent through encrypted DNS appear only when the connection itself names the server. iCloud Private Relay hides the real servers behind Apple's relay. Traffic it can't tie to an app is counted on a line called Unattributed, never guessed. - ### Can it record a simulator? No. Only a real iPhone has the capture service, so Mobster refuses simulators. ## Sources - [Mobster docs: X-ray](https://docs.mobster.dev/xray) - [Mobster docs: Privacy, what Network X-ray reads](https://docs.mobster.dev/privacy) ## Read next - [Map an iPhone app's screens and paywalls](https://mobster.dev/guides/map-an-app-with-xray) ## Try it on your own iPhone [Download for Mac](https://mobster.dev/download) [See pricing](https://mobster.dev/pricing)