How to capture wireless traffic between iPhone app and AV Receiver from Mac
I’m running Wireshark on a Mac (M2 Mini). I have an AV Receiver with a wifi interface, and an iPhone 14. I’m trying to capture the traffic (I understand it is UDP) between an app on the iphone and the receiver, but not getting anything. I assume it is something basic that I don’t understand about how to set up wireshark, or something about my network setup. As far as i know, the traffic is not encrypted.
- I have a TP-Link wifi mesh network with 3 nodes.
- The Mac is connected to the same wifi network as the iphone and receiver.
- The iphone and Mac are on the same node of the mesh network, the receiver is on a different node
- The Mac also has an ethernet connection to the TP-Link router.
- I have the IP addresses of the receiver (10.0.1.19) and iPhone (10.0.1.12).
- i can successfully ping the receiver from the Mac
I selected both the wifi and ethernet interface on the mac and tried the following filter: host 10.0.1.19 && host 10.0.1.12 && udp
However nothing is captured as i use the iPhone app to make changes on the receiver. I tried removing “udp” from the filter, same thing.
Would appreciate any suggestions as to why this is not working…
thanks!
Can you make a packet capture on the router?
No, it is TPlink Deco router, i don’t see any way to capture traffic from the Deco app, assuming that is what you mean.
Yep. Capture there probably would have been easier.
Wireless capture (and on a Mac to boot) not my strength.
Add those to the question title and lets see if someone stronger in wireless helps.
If I were to want to decode application layer traffic, I would always prefer a wired capture of the traffic instead of trying to deal with monitor mode. I use monitor mode to look only at layer 2 WiFi problems if at all possible and leave higher layers for wired side capture.
Your filters are for layer 3, i.e. IP addresses, and another device connected to the same WiFi system will not pass unicast traffic between other hosts up to a capture point on your system. This is why you won't see them when connecting to the AP in managed mode and turning on Wireshark on that interface on the sniffer PC. To see this traffic, you will need to be in monitor mode with your MAC.
Anyway, if you must use monitor mode, this is likely a problem:
(more)