I'm trying to reproduce this on a macbook. I'm a developer, not a networks guy so please excuse me for not knowing the basics!
After doing `sudo tcpdump -In -i en0 -s 2048 -A dst i.instagram.com`, and using every instagram feature from my iPhone, nothing happens in the terminal.
```
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on en0, link-type IEEE802_11_RADIO (802.11 plus radiotap header), capture size 2048 bytes
```
I try running with -v and -vv, but no difference (except it doesn't suggest running in verbose more).
After hitting C-c to stop the program, it outputs
```
^C
0 packets captured
29816 packets received by filter
0 packets dropped by kernel
```
So there's a lot of things being captured, but the filter does not catch my Instagram activity. I'm logged in there, refreshing, getting images, getting followers/following, etc.
Monitor/promiscuous mode only works on WEP and open wifi networks. I assume you have a WAP network so this isn't working. As a POC you can add your phone as a network interface. To do that:
1. Plug in your iPhone/iPad into your computer via USB cable
2. Go into Xcode Organizer and find your iDevice's UID
3. Hop over to terminal and type 'rvictl -s <UID>'
4. Type 'sudo tcpdump -n -i rvi0 -s 2048 -A dst i.instagram.com'
5. Open Instagram on the device, and the packet info should appear in terminal. The rest is the same
6. When you're done you can type 'rvictl -x <UID>'
Well, are you connected to the same open wireless network as the iPhone, and are within close range of it? This isn't going to work on an WPA network. Try taking off your "dst i.instagram.com" filter and see what you're actually capturing.
After doing `sudo tcpdump -In -i en0 -s 2048 -A dst i.instagram.com`, and using every instagram feature from my iPhone, nothing happens in the terminal.
```
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on en0, link-type IEEE802_11_RADIO (802.11 plus radiotap header), capture size 2048 bytes
```
I try running with -v and -vv, but no difference (except it doesn't suggest running in verbose more).
After hitting C-c to stop the program, it outputs
```
^C
0 packets captured
29816 packets received by filter
0 packets dropped by kernel
```
So there's a lot of things being captured, but the filter does not catch my Instagram activity. I'm logged in there, refreshing, getting images, getting followers/following, etc.
EDIT: oh shit, HN doenst do markdown. That sucks.