Skip to content

pymobiledevice3 pcap

Capture the device's network traffic, print it, and optionally save it to a pcapng file.

pymobiledevice3 pcap [OPTIONS]

Options:

Option Description
--native macOS only: reach the iOS 17+ tunnel by piggybacking Apple's own remoted tunnel via the remotepairingd service. NO root, no entitlement, no Xcode. Rides Apple's kernel-routable tunnel, so throughput matches the kernel tunnel, but the device keeps a single RSD connection on it: remoted and this process evict each other's, which can reset connections and leave Xcode/devicectl without the device until remoted reconnects. Mutually exclusive with --rsd/--tunnel/--userspace. [env var: PYMOBILEDEVICE3_NATIVE]
--out <path> Also save the packets to this file, in pcapng format (e.g. for Wireshark).
-c, --count <int> Stop after this many packets. Omit to capture until Ctrl+C. [default: -1]
--process <str> Only packets of this process (name or PID). Omit for all.
-i, --interface <str> Only packets on this interface: a full name such as en0 or pdp_ip0, or a name without its unit (en) for all its units. Omit for all.
--install-completion Install completion for the current shell.
--show-completion Show completion for the current shell, to copy it or customize the installation.

Accepts the connection options: --rsd, --tunnel, --userspace, --mobdev2, --usbmux, --udid.