See which companies an iPhone app talks to

Every app on your phone talks to servers you never chose. Some are the app’s own. Many belong to analytics, attribution and ad companies bundled into it. Network X-ray puts a number and a company name on each, for your own app before you ship it, or for any app you want to understand.

Run it

Plug the iPhone into your Mac, use the command above and open the apps you care about while it records. Or in Mobster for Mac, open Devices, press Network X-ray on the phone’s card, choose 30 s, 60 s or 2 min and press Record. The apps and the companies they talk to fill in as they appear.

The command first prints Recording <phone> over the cable for 60 s. Use the apps you want to look at. ctrl+c stops early. and then one line for each app that used the network. This is the shape of those lines, from the synthetic capture Mobster’s tests use, whose Flashlight Pro is a made-up app:

In 59 s Flashlight Pro contacted 14 domains at 10 companies; 6 of them are ads, analytics or attribution.In 59 s iOS contacted 1 domain at 1 company.Report: ~/Library/Application Support/app.mobster.desktop/xray/network/20261015-225906/report.html

Each line counts the domains Mobster saw in that app’s traffic, groups them by the company that runs them and counts the ones on Mobster’s own list of ad, analytics and attribution services. That list is short. Mobster wrote it from the SDK vendors’ own documentation and from hostnames real recordings left unnamed. A domain on no list gets its own name as its company and no category.

What you get

In the Mac app the result also shows as a task with two tables, Who your apps talked to and Every domain. You can sort, filter and export them like any result. --app NAME reports one app only, and --from FILE.pcapng reads a capture you already have, with no phone and no plan.

How well it ties traffic to apps

Mobster matches each process in the capture to an app on your phone by its executable name. Parts of iOS itself, such as nsurlsessiond, are labelled iOS. On 15 Oct 2026, on an Apple M5 Max with an iPhone 15 Pro on its cable, two 90-second recordings of six and four apps measured:

The capture travels over the cable, so it adds nothing to the phone’s own network traffic.

Where it stops

• It records one phone at a time, the one you name with --device.
• It needs a plan, like any task that uses your phone. --from doesn’t.
• Traffic it can’t tie to an app is never guessed. It goes to Unattributed, with its size and a sentence that says Mobster couldn’t tell.
• The network capture is not an agent or MCP tool, and an API token alone can’t start one. Only the Mac app’s own session can.