# Coundnt use mitmproxy for sniffing SpeedTest in iOS App

**URL:** <https://discourse.mitmproxy.org/t/coundnt-use-mitmproxy-for-sniffing-speedtest-in-ios-app/355>\
**Category:** help\
**Created:** [February 15, 2017, 12:26pm UTC](https://discourse.mitmproxy.org/t/coundnt-use-mitmproxy-for-sniffing-speedtest-in-ios-app/355 "2017-02-15T12:26:34Z")\
**Posts on this page:** 8\
**Page:** 1

<div class="post-metadata">

**Author:** ![benjo](https://avatars.discourse-cdn.com/v4/letter/b/dec6dc/32.png) [@benjo](https://discourse.mitmproxy.org/u/benjo)\
**Post date:** [February 15, 2017, 12:26pm UTC](https://discourse.mitmproxy.org/t/coundnt-use-mitmproxy-for-sniffing-speedtest-in-ios-app/355/1 "2017-02-15T12:26:34Z")

</div>

Hi, want to change my mitm tools to mitmproxy and find a problem with Sniffing one iOS App.  
It has a Internet SpeedTest Feature that dont works when using Mitmproxy.  
Connection Problems also with any passthru config like ignore domain or tcp-raw.  
Iam running mitmproxy in Transparent Mode and with iptabels redirect traffic to its port.

Tried to log diffrents between traffic but cant see any reason why this dont work in Mitmproxy.  
Maybe something on my side but can someone confirm if he could sniff the Speedtest or at least use Passtru?

> **[‎connect](https://apps.apple.com/de/app/id910960897)**
>
> ‎Alle Tests und News von connect in einer App - inklusive Speed Test!
> connect ist Europas größtes Magazin zur Telekommunikation – hier sind Sie richtig, wenn Sie sich per App für das Neueste in Sachen Smartphones, Tablets, Mobile Computing,...

  
App Name: connect  
Dev: WEKA Media Publishing GmbH, Store: DE, Version 2.0.3

---

<div class="post-metadata">

**Author:** ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)\
**Post date:** [February 17, 2017, 1:22pm UTC](https://discourse.mitmproxy.org/t/coundnt-use-mitmproxy-for-sniffing-speedtest-in-ios-app/355/2 "2017-02-17T13:22:47Z")

</div>

Which tool did you use before that worked?

---

<div class="post-metadata">

**Author:** ![benjo](https://avatars.discourse-cdn.com/v4/letter/b/dec6dc/32.png) [@benjo](https://discourse.mitmproxy.org/u/benjo)\
**Post date:** [February 20, 2017, 8:56am UTC](https://discourse.mitmproxy.org/t/coundnt-use-mitmproxy-for-sniffing-speedtest-in-ios-app/355/3 "2017-02-20T08:56:00Z")

</div>

a version of [https://github.com/intrepidusgroup/mallory](https://github.com/intrepidusgroup/mallory) or [https://bitbucket.org/IntrepidusGroup/mallory/wiki/Home](https://bitbucket.org/IntrepidusGroup/mallory/wiki/Home)

---

<div class="post-metadata">

**Author:** ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)\
**Post date:** [February 21, 2017, 2:04pm UTC](https://discourse.mitmproxy.org/t/coundnt-use-mitmproxy-for-sniffing-speedtest-in-ios-app/355/4 "2017-02-21T14:04:32Z")

</div>

Is this speedtest over UDP or over TCP?

---

<div class="post-metadata">

**Author:** ![benjo](https://avatars.discourse-cdn.com/v4/letter/b/dec6dc/32.png) [@benjo](https://discourse.mitmproxy.org/u/benjo)\
**Post date:** [February 22, 2017, 10:40am UTC](https://discourse.mitmproxy.org/t/coundnt-use-mitmproxy-for-sniffing-speedtest-in-ios-app/355/5 "2017-02-22T10:40:24Z")

</div>

just TCP, no udp.

Data Format is unknown.  
Uses packets with [PSH, ACK] flags in both directions.

One difference i can see is that without mitmproxy there are some ECN + CWR flags

```
direct masq
 TCP	78	49443 → 8083 [SYN, ECN, CWR] Seq=0 Win=65535 Len=0 MSS=1460 WS=32 TSval=474767230 TSecr=0 SACK_PERM=1
 TCP	74	8083 → 49443 [SYN, ACK, ECN] Seq=0 Ack=1 Win=14480 Len=0 MSS=1460 SACK_PERM=1 TSval=260227485 TSecr=474767230 WS=4
 
with mallory
TCP	78	49441 → 8083 [SYN, ECN, CWR] Seq=0 Win=65535 Len=0 MSS=1460 WS=32 TSval=474767230 TSecr=0 SACK_PERM=1
TCP	74	8083 → 49441 [SYN, ACK, ECN] Seq=0 Ack=1 Win=14480 Len=0 MSS=1460 SACK_PERM=1 TSval=260227484 TSecr=474767230 WS=4

 and with mitmproxy
 TCP	80	51925 → 8083 [SYN] Seq=0 Win=65535 Len=0 MSS=1460 WS=16 TSval=534287545 TSecr=0 SACK_PERM=1
 TCP	76	8083 → 51925 [SYN, ACK] Seq=0 Ack=1 Win=28960 Len=0 MSS=1460 SACK_PERM=1 TSval=92179 TSecr=534287545 WS=128
```

---

<div class="post-metadata">

**Author:** ![mhils](https://yyz2.discourse-cdn.com/flex030/user_avatar/discourse.mitmproxy.org/mhils/32/7_2.png) [@mhils](https://discourse.mitmproxy.org/u/mhils)\
**Post date:** [February 22, 2017, 12:45pm UTC](https://discourse.mitmproxy.org/t/coundnt-use-mitmproxy-for-sniffing-speedtest-in-ios-app/355/6 "2017-02-22T12:45:27Z")

</div>

If TCP flags are indeed the problem, there’s not much we can do - sorry. We just operate with plain Python sockets.

---

<div class="post-metadata">

**Author:** ![benjo](https://avatars.discourse-cdn.com/v4/letter/b/dec6dc/32.png) [@benjo](https://discourse.mitmproxy.org/u/benjo)\
**Post date:** [February 22, 2017, 5:02pm UTC](https://discourse.mitmproxy.org/t/coundnt-use-mitmproxy-for-sniffing-speedtest-in-ios-app/355/7 "2017-02-22T17:02:05Z")

</div>

I looked in Mallory as its also in Python.  
They also used python sockets with “SOCK\_STREAM” for TCP.  
But dont know the difference in settings or how they do the data forwarding  
The flags maybe even not the problem, was just a thought.

---

<div class="post-metadata">

**Author:** ![benjo](https://avatars.discourse-cdn.com/v4/letter/b/dec6dc/32.png) [@benjo](https://discourse.mitmproxy.org/u/benjo)\
**Post date:** [February 28, 2017, 3:14pm UTC](https://discourse.mitmproxy.org/t/coundnt-use-mitmproxy-for-sniffing-speedtest-in-ios-app/355/8 "2017-02-28T15:14:47Z")

</div>

Is there somthing you can recommend to test or try to find out more?