In mobile application debugging and online troubleshooting, app HTTPS packet capture is a fundamental skill for identifying network, authentication, and encryption issues. When encountering problems such as “unable to capture packets,” “HTTPS handshake failure,” or “request inconsistency with the server,” engineers should troubleshoot in the order of network layer → TLS layer → application layer, and flexibly combine proxy tools, low-level packet capture, and data export methods. Below, we provide actionable processes, common commands, tool responsibilities, and an alternative packet capture solution Sniffmaster, explaining how to use tools to complete a full analysis chain with practical feature points.

I. First Define the Goal: What to Capture and Where
Before packet capture, clarify: Are you looking at the TCP three-way handshake (connectivity), TLS handshake (certificate/ALPN/Alert), or the application layer HTTP/2/1.1 request body and headers (signature, Cookie, CORS)? Prioritize capturing at the location closest to the issue occurrence (client proxy or edge/origin server capture), and record the reproduction time, device IP, and request-id to align with logs.

II. Tool Responsibilities and Combined Usage (Packet Capture Tool Matrix)

  • Proxy tools (Charles / Fiddler / Proxyman / mitmproxy): Used for decrypting HTTPS, breaking and modifying requests, and quickly verifying headers/body. Suitable for development environments or test devices where CA can be installed.
  • Low-level packet capture (tcpdump / tshark / Wireshark): Capture -s 0 pcap files at the gateway or backend for analyzing the three-way handshake, retransmissions, and TLS ClientHello/ServerHello. This provides authoritative evidence to determine if requests reach the backend.
  • Scriptable tools (pyshark / scapy / mitmproxy scripts): Suitable for batch statistics on TLS Alerts, automated replay, and continuous monitoring.
  • Alternative packet capture solution, Sniffmaster: When proxies are unavailable, apps use certificate pinning, or specific network policies block capture, it can filter traffic by App/domain and export pcap and single-packet binary files, supporting HTTPS decryption and mTLS/pinning analysis assistance, facilitating frame-by-frame comparison with backend pcap files.

III. Reproducible Troubleshooting Process (TCP → TLS → HTTP)

  1. TCP layer: Confirm connectivity and port listening. Common commands:
1nc -vz api.example.com 443
2sudo tcpdump -i any host <client_ip> and port 443 -s 0 -w /tmp/cap.pcap

Check for excessive SYN, RST, or retransmissions.
\2. TLS layer: Check ClientHello (SNI, cipher), ServerHello, certificate chain, and TLS Alert:

1openssl s_client -connect api.example.com:443 -servername api.example.com -showcerts

Filter for tls.handshake.type==1 and tls.alert_message in Wireshark. If incomplete chains, OCSP issues, or ALPN mismatches are found, prioritize fixing the certificate chain and stapling.
\3. Application layer: Use proxies to view HTTP/2 frames or HTTP/1.1 requests when decryption is possible, verifying signatures, timestamps, request body order, and header differences.

IV. Common Challenges and Solutions (App HTTPS Packet Capture Scenarios)

  • Certificate pinning / Custom TLS: Browsers can capture, but apps cannot; temporarily disable pinning in test builds or use alternative solutions that export pcap to export app traffic and compare with backend pcap files.
  • HTTP/3 (QUIC): QUIC is UDP-based and bypasses TCP proxies. When encountered, force fallback to TCP+HTTP/2 on the client or server for reproduction and capture.
  • Partial network/ISP issues: Collect affected users’ ASN and region, capture edge pcap files, and compare certificate Issuers with app-exported pcap to determine if intermediate substitution or transparent proxies exist.

V. Alternative Packet Capture Process When Proxies Are Not Feasible
When proxies cannot decrypt or be configured, capture packets at the backend and simultaneously export app traffic as pcap, then analyze side-by-side in Wireshark: align timelines, compare ClientHello SNI, ServerHello and certificate chains, and check tls.alert.
Sniffmaster provides the ability to filter by App/domain, export Wireshark-compatible pcap and single-packet binary files, and supports interceptors and JavaScript scripts to modify requests/responses, significantly improving analysis efficiency in complex scenarios (use within compliance boundaries).

VI. Interception and Automated Modification (Advanced Debugging)
During development debugging, interceptors can temporarily modify request parameters or response bodies to verify fixes. Packet capture tools supporting JavaScript scripts can run custom logic at breakpoints, enabling automated test scenarios such as batch replacement of signature fields or simulating failure responses, facilitating quick identification of root causes.

Packet capture files often contain sensitive data (Tokens, personal information). In production environments, packet capture must have approval, limited time windows, and exported files should be encrypted, anonymized, and regularly destroyed. When delivering analysis conclusions, include: reproduction time window (second-level), relevant pcap files, Wireshark key frame screenshots, conclusions, and actionable repair suggestions (e.g., patch fullchain, adjust proxy/firewall, update client pin configurations).