ios_pcap_start
Start a device-wide NATIVE network packet capture on an iOS device. Captures REAL packets at the network layer, mostly TLS-encrypted, so there are NO HTTP bodies — the result is a Wireshark .pcapng for packet-level analysis. One capture per device. Optionally filter by process (process name, e.g. mobilesafari / backboardd) or interfaceName (e.g. en0), and auto-stop after packets frames. End with ios_pcap_stop. (For Safari HTTP traffic with bodies, use ios_safari_capture_network instead.)
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| udid | Yes | iOS device UDID | |
| packets | No | Stop automatically after N packets (optional; default: until ios_pcap_stop) | |
| process | No | Only capture packets for this process name (optional) | |
| interfaceName | No | Only capture this interface, e.g. en0 (optional) |