Using Wireshark to collect packet capture data from iOS or iPadOS devices

Products

• Endpoint Protection Mobile
• Endpoint Security
• Endpoint Security Complete

Issue/Introduction

When troubleshooting an issue with the SEP Mobile app on an iOS device, it becomes necessary to collect packet capture data for technical support analysis.  This document will provide steps which can be used to collect this data, however please note this procedure requires the mobile device to be docked to a Mac desktop or Macbook laptop.

Environment

SEP Mobile on iOS or iPadOS, with access to a Mac desktop or Macbook laptop for docking and collecting the pcap data from the mobile device. 

Cause

Typical troubleshooting scenarios where such data is helpful:

• Issues with WSS VPN tunneling
• Unexpected network detection (e.g MITM) 

Resolution

1. Ensure the Mac / Macbook which the iOS or iPadOS device will be docked with has the latest Xcode version installed.  
2. Connect the mobile device to the Mac using a lightning cable.
3. From the Mac, open the Xcode app.
4. From the top menu in Xcode, select Window > Devices and Simulators.
5. From the left pane in Xcode, select the mobile device.
6. In the right pane, still working in Xcode, find the identifier of the mobile device and copy this string to the clipboard.
7. Open a terminal window on the Mac, and navigate to /Library/Apple/usr/bin.
8. Execute the following command:
   

   ./rvictl -s <identifier of mobile device retrieved in Step 6>
   
   The following feedback would be expected after issuing this command:

   Starting device <identifier of mobile device> [SUCCEEDED] with interface rvi0

9. Open the Wireshark app on the Mac.
10. Under Capture menu, locate and double click the rvi interface. In this example, it is rvi0.  
11. Start the packet capture and reproduce the behavior in question, collecting any additional data concurrently if requested by Support.  

Additional Information

Please note that pcap data is extremely verbose and will quickly grow in size once collection is launched; it is recommended therefore to please adhere to the following guidelines: 

• Ensure everything needed for issue reproduction is ready before beginning the pcap; the ideal pcap should cover the smallest timeframe possible, only included what is necessary to show reproduction of the network issue in question.  
• Please compress the pcap data before uploading it to a Broadcom Support case.