title: Sniffing bonjour traffic between iPhone and Mac
body: <p>My end result is to try and see the plist being sent between my iphone &amp; my mac (I know its a plist because I can see <code>bplist00</code> in the hexdump).</p>
  
  <p>I have an app sending data between my iphone to my mac via a bonjour service.</p>
  
  <p>I use tcpdump to capture the traffic and try and transform the payload hexdump into binary to then convert it into a plist text file.</p>
  
  <p>Here are my steps:</p>
  
  <ol>
  <li>Make sure the iphone and mac are connected, have the command ready to send</li>
  <li>Run tcp dump: <code>sudo tcpdump -vSs 0 -A -i en1 -w Dump.pcap 'tcp port 57097'</code> on my wireless network (I used <a href="http://www.tildesoft.com/" rel="nofollow">Bonjour Browser</a> to find what port the service is registered on), then hit the send command on the phone.</li>
  <li>Convert the pcap file to a text file: <code>tshark -V -r Dump.pcap &gt; Dump.txt</code> (the <a href="http://pastebin.com/eqJxs05G" rel="nofollow">end result is this</a>)</li>
  <li>Manually remove the headers and other info from the text file so that I am just left with the payload (we now <a href="http://pastebin.com/8nqx8CGB" rel="nofollow">have this</a> in the file)</li>
  <li>Do a reverse hex dump to convert the file into binary: <code>xxd -r Dump.txt Dump1.txt</code></li>
  <li>Convert the binary plist to a text file: <code>plutil -convert xml1 Dump1.txt</code></li>
  </ol>
  
  <p>However, at step 6 is where things fail: <code>Dump1.txt: Property List error: Conversion of string failed. The string is empty. / JSON error: JSON text did not start with array or object and option to allow fragments not set.</code> (although it could have been a mistake from an earlier step). And I'm not sure why it reports errors on JSON when I have asked for an XML conversion?</p>
  
  <p>This low level network capturing is not something I am normally akin to (I'm normally higher up with fiddler or charles, but considering this isn't via HTTP I need to go lower down the stack).</p>
  
  <p>Can someone please tell me if what I am doing is correct, or whether there is an easier way to do this?</p>
  
  <p>How can I go about capturing the plist being sent to my mac?</p>