Robin - Remote Packet Capture

Robin turns your iPhone into a control panel for remote packet capture.

It connects over SSH to your own OpenWrt router or Linux host, runs tcpdump remotely, and sends a standard pcap straight back to your iPhone.

Robin offers two capture sources:

• Air capture — use monitor mode on a compatible Wi-Fi radio to capture 802.11 frames. Robin can scan nearby access points and configure the radio, channel, and width.
• Interface capture — capture packets visible to an existing Linux interface such as br-lan or eth0. Monitor-mode support is not required, and Robin does not change the interface state.

Robin does not require jailbreaking your iPhone or attaching a USB Wi-Fi adapter to it. The capture runs on the remote host; your iPhone handles connection, detection, configuration, control, and download.

Robin is not a generic SSH client. It is a guided workflow built for remote packet capture:

• Connect — securely over SSH with password or Ed25519/RSA key authentication. Passphrase-protected private keys are supported, and host keys are pinned on first use.
• Detect — check whether air and interface capture are available, including radios, Linux interfaces, required tools, and permissions.
• Configure — choose a capture source, channel, or network interface, then add an optional BPF filter, stop timer, and output directory.
• Filter — get basic BPF validation as you type, with common examples, a combination builder, and a syntax reference.
• Capture — start a detached tcpdump task that keeps running if SSH disconnects. Interface capture excludes the current SSH control connection by default and has a protective file-size limit.
• Download — pull the .pcap to your iPhone and open it in Wireshark or your tool of choice.

WORKS WITH:

• OpenWrt routers, usually with root login
• Regular Linux hosts using an existing active network interface
• A monitor-mode-compatible Wi-Fi radio for air capture; interface capture does not require one
• Root, file capabilities, passwordless sudo, or password-based sudo
• Standard Dropbear / OpenSSH targets, with no SFTP required

BUILT FOR:

Network engineers, Wi-Fi troubleshooters, and security researchers who need a fast, portable way to collect pcaps from infrastructure they own or are authorized to test.

GOOD TO KNOW:

• Robin requires an SSH-accessible remote device with tcpdump. Only air capture requires Wi-Fi monitor mode.
• Captures survive SSH disconnects and can be resumed after reconnecting.
• Credentials are stored in the iOS Keychain, never on the remote device.
• Air capture on a single-radio router may drop your Wi-Fi control link. Interface capture does not switch the radio mode, and Robin warns you when the air-capture risk applies.

Robin is a capture and transfer tool. Use it only on networks you own or have explicit permission to test. Capturing traffic on networks without authorization may be illegal in your jurisdiction.