Robin - Remote Packet Capture

Robin turns your iPhone into a control panel for remote packet capture. It connects over SSH to your own OpenWrt router or Linux host, runs tcpdump remotely, and sends a standard pcap straight back to your iPhone. Robin offers two capture sources: • Air capture — use monitor mode on a compatible Wi-Fi radio to capture 802.11 frames. Robin can scan nearby access points and configure the radio, channel, and width. • Interface capture — capture packets visible to an existing Linux interface such as br-lan or eth0. Monitor-mode support is not required, and Robin does not change the interface state. Robin does not require jailbreaking your iPhone or attaching a USB Wi-Fi adapter to it. The capture runs on the remote host; your iPhone handles connection, detection, configuration, control, and download. Robin is not a generic SSH client. It is a guided workflow built for remote packet capture: • Connect — securely over SSH with password or Ed25519/RSA key authentication. Passphrase-protected private keys are supported, and host keys are pinned on first use. • Detect — check whether air and interface capture are available, including radios, Linux interfaces, required tools, and permissions. • Configure — choose a capture source, channel, or network interface, then add an optional BPF filter, stop timer, and output directory. • Filter — get basic BPF validation as you type, with common examples, a combination builder, and a syntax reference. • Capture — start a detached tcpdump task that keeps running if SSH disconnects. Interface capture excludes the current SSH control connection by default and has a protective file-size limit. • Download — pull the .pcap to your iPhone and open it in Wireshark or your tool of choice. WORKS WITH: • OpenWrt routers, usually with root login • Regular Linux hosts using an existing active network interface • A monitor-mode-compatible Wi-Fi radio for air capture; interface capture does not require one • Root, file capabilities, passwordless sudo, or password-based sudo • Standard Dropbear / OpenSSH targets, with no SFTP required BUILT FOR: Network engineers, Wi-Fi troubleshooters, and security researchers who need a fast, portable way to collect pcaps from infrastructure they own or are authorized to test. GOOD TO KNOW: • Robin requires an SSH-accessible remote device with tcpdump. Only air capture requires Wi-Fi monitor mode. • Captures survive SSH disconnects and can be resumed after reconnecting. • Credentials are stored in the iOS Keychain, never on the remote device. • Air capture on a single-radio router may drop your Wi-Fi control link. Interface capture does not switch the radio mode, and Robin warns you when the air-capture risk applies. Robin is a capture and transfer tool. Use it only on networks you own or have explicit permission to test. Capturing traffic on networks without authorization may be illegal in your jurisdiction.