Probably.
They will both be communicating over Wi-Fi, so you will need to run Wireshark on a machine capable of capturing in monitor mode (Wi-Fi adapter, driver that supports monitor mode, OS that supports putting adapters into monitor mode, Npcap if the OS is Windows), and, if the network is "protected" (encrypted using WEP, WPA, or WPA2), you will need to provide the password to Wireshark and, for WPA/WPA2, you'll need to capture the initial connection of both hosts to the network. See the Wireshark Wiki articles for 802.11 capture setup and 802.11 decryption for details. If it's protected using WPA3, you're out of luck.
Asked: 2019-12-09 15:37:25 +0000
Seen: 331 times
Last updated: Dec 10 '19
Copyright Wireshark Foundation, 2017-2023 Content on this site is licensed under a Creative Commons Attribution Share Alike 3.0 license.
I never looked at this behavior from an engineering point of view, only used the feature. Per a support case at Apple, one of the requirements is that wifi be turned on both devices - https://support.apple.com/en-gb/HT209456. Another requirement is connected to same network but this is a little vague - same L2 broadcast domain? Is same vlan good enough? Do I need multicast/broadcast/unicast flow between them?. I would then suggest it is likely, though not certain, that the communications profile is via 802.11. If so, Wireshark could be used to collect this traffic.