mitmproxy VS Wireshark

This statement gives a false sense of security. You can use a transparent proxy, like mitmproxy, to view HTTPS traffic - https://mitmproxy.org/. https://reedmideke.github.io/networking/2021/01/04/mitmproxy-openwrt.html

You'll need to install mitmproxy and set it up on your computer and iOS. I won't go into too much detail here on how to do this, but there are plenty of guides available. This is a pretty good one: https://nadav.ca/2021/02/26/inspecting-an-iphone-s-https-traffic/

TIL this goes back to 2006, how cool! We nowadays have a much simpler version as a mitmproxy example: https://github.com/mitmproxy/mitmproxy/blob/main/examples/ad.... Although it obviously does not work as well anymore with everything being HTTPS nowadays (unless you trust the cert of course). :)

Perhaps you could have your device use a proxy that can do the HTTPS unwrap for you? https://mitmproxy.org/ maybe?

A great way to test the effectiveness of a pinning implementation is by simulating an MITM attack. Tools like Mitmproxy or Wireshack allow us to create a test environment to monitor, intercept, and proxy network requests for a test host.

To begin with Wireshark, visit their official website for the download. The installation process is straightforward, but attention should be paid to the installation of command-line tools, which may require separate steps. Upon launching Wireshark, users are greeted with a selection of network interfaces as seen below. Choosing the correct interface, such as the loopback for local server debugging, is crucial for capturing relevant data.

Wireshark

If you're very curious as to what is really going on under the hood, I recommend you familiarize yourself with port mirroring for your switch platform of choice, and then use a laptop in promiscuous mode to capture traffic using Wireshark. Failing that, hire a network engineer to interview one of their sales engineers or architects, and have them explain it to you.

You should do a hands fins-on lab with Wireshark.

A great way to test the effectiveness of a pinning implementation is by simulating an MITM attack. Tools like Mitmproxy or Wireshack allow us to create a test environment to monitor, intercept, and proxy network requests for a test host.

They even have a nice comment explaining the heuristic: https://github.com/wireshark/wireshark/blob/ef9c79ae81b00a63...

     * Heuristics to detect the WireGuard protocol:

This has been put together for Wireshark, starting on line 1520 https://github.com/wireshark/wireshark/blob/master/epan/dissectors/packet-cip.c

Obviously based on the question you know the answer is a Wireshark-like software and it boils down to how you classify Wireshark. My issue is that Wikipedia refers to it as a Packet Analyzer, Varonis refers to it as a Packet Sniffer, Wireshark refers to itself as a Network Protocol Analyzer, Kali documentation refers to it as a Network Sniffer, Wireshark's README refers to itself as a Network Analyzer OR Sniffer...