ARP Packet Capture in iOS

Hi,

  1. I was trying to capture ARP traffic from my iphone, I created a virtual interface using rvictl tool - rvi0. However, the packet captures on Wireshark tool for rvi0 interface do not show any ARP packets. Why is this happening?
  2. I used the tcpdump command - tcpdump -n -t -i rvi0 -q arp, while I was able to see some request packets, the response packets were not visible, why is this happening?
  3. Is there some other mechanism to capture ARP traffic from iphone?
  4. Can third-party apps capture arp traffic/arp table using any Apple API?

Can someone pls reply to this queries?

However, the packet captures on Wireshark tool for rvi0 interface do not show any ARP packets. Why is this happening?

Yesterday I ran your question past the RVI engineers to make sure there wasn’t some problem I was unaware of. To the best of our knowledge RVI should be able to capture ARP packets. The only obvious gotchas is that ARP is not used on some interfaces, most notably WWAN. However, if RVI is not seeing ARP traffic on an Ethernet-like interface, that’s something that warrants further investigation.

Some questions:

  • What version of iOS are you testing this on?

  • What version of macOS?

  • What version of Xcode do you have installed?

  • Are you looking for ARP traffic on the Wi-Fi interface? Or some other Ethernet-like interface?

I used the tcpdump command … while I was able to see some request packets, the response packets were not visible, why is this happening?

That’s definitely weird. I would not expect to see a difference between Wireshark and tcpdump.

Is there some other mechanism to capture ARP traffic from iphone?

No.

Can third-party apps capture arp traffic/arp table using any Apple API?

On the iPhone, itself? No.

On the Mac? Assuming RVI is set up, you can use standard packet capture APIs against the RVI interface, so BPF and libpcap.


Can someone pls reply to this queries?

Please see tip 3.

Share and Enjoy

Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Hi,

Thank you for the reply, here are the details -

  1. What version of iOS are you testing this on?

15.5

  1. What version of macOS?

12.4

  1. What version of Xcode do you have installed?

13.4.1

  1. Are you looking for ARP traffic on the Wi-Fi interface? Or some other Ethernet-like interface?

On Wi-Fi interface, the device is connected to wifi, we are capturing ARP traffic on rvi0 interface created from rvictl.

Interesting. I just ran a test using rvictl with macOS 12.4 on Xcode 13.4 with iOS 15.2 associated with a Wi-Fi network was able to see ARP packets...

ARP, Reply xx.***.***.1 is-at xx:xx:xx:xx:xx:xx, length 46

Now, when I ran the capture I used a macOS application to send these ARP packets over the network so you should be able to see them? If you continue to have issues here I would open up a bug report.

ARP Packet Capture in iOS
 
 
Q