Which Wireshark settings to see connections from phone

Question

I am trying to find out which URLs my phone is accessing when on a local WIFI network.

My trials so far have been running an Ad-hoc network on my Laptop and sharing Internet through it (this works). I then tried to use Wireshark to monitor which connections the phone is opening. However, I am not sure which settings to use and do not see connections originating from my phone.

My Setup:

1. MacBookPro connected to Ethernet and sharing Internet through Wifi.
2. Android phone (Android 2.2.2, no root possible.)

I would like to open the browser or an app on my phone, and type in superuser.com and have that show up in Wireshark. Even better, if only my phone would show up in Wireshark.

Related, but these questions are not using the laptop as a Wifi-Switch/Hub:

1. How can I capture other computers traffic in Wireshark on a WiFi-network?
2. Wireshark Not Displaying Packets From Other Network Devices, Even in Promisc Mode

Answer 1

Your setup is fine. Tell Wireshark to capture on the Wi-Fi interface, in non-promiscuous, non-monitor mode. If you want, you could filter on the IPv4 (and IPv6) address(es) of your phone. If you really only cared about port 80 HTTP traffic, you could filter on TCP port 80 as well.

If it turns out that the app in question is making secure HTTP connections, you might need to install something like the "Charles" web proxy software on your Mac and configure your phone to use your Mac as its web proxy. This basically allows you to do a "man-in-the-middle" (MitM) "attack" on your own connections. You have to tell your phone to trust the certificate the Charles proxy offers.

There are lots of iOS and Android software developers using Charles proxy to see what their client devices are doing, so there's lots of information on how to set this stuff up on the Charles proxy website.