To create a Wifi hotspot with a Raspberry Pi, I followed the instructions at Adafruit. The system needs a dhcp server to give out addresses to wifi clients, hostapd to authenticate clients and some iptables commands to nat the addresses of TCP requests going through the device.
The Wifi USB dongle I purchased is an Edimax Nano USB WiFi adapter (EW-7811Un) which cost $35 over the counter. These seem to work well with the Pi's limited power budget and are capable of being a hotspot.
My network is called "honeypot".
The simplest way to snoop on what an app is doing is with tcpdump. I monitor traffic on the wireless interface and display the first part of each packet in ascii. The command is "sudo tcpdump -i wlan0 -A". Here's what I see on opening a TV guide app:
You can see they are talking to flurry and crashlytics, but the display is not very convenient for seeing what's going on.
A more friendly way to watch HTTP traffic is to use a proxy such as mitmproxy. Then set the proxy on the device to point to it. Now in our terminal we see a nice summery of each request.
Pressing return lets us drill in to the request and see the headers nicely formatted:
Pressing tab switches over to the response:
Lots of interesting things to learn in there! I typically then use the MacOS JSON Edit program for exploring json data (there's lots of tools around for this).
iOS apps seem to honour the proxy setting but I find that often Android apps do not, or only do some. It's possible to use iptables to set up a transparent proxy. I've got this mostly working although most https requests mostly seem to fail, here's my magic incantation:
# start a transparent proxy
sudo sysctl -w net.ipv4.ip_forward=1
# clean old firewall
sudo iptables -F
sudo iptables -X
sudo iptables -t nat -F
sudo iptables -t nat -X
sudo iptables -t mangle -F
sudo iptables -t mangle -X
# nat on the local lan
sudo iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
sudo iptables -A FORWARD -i eth0 -o wlan0 -m state --state RELATED,ESTABLISHED -j ACCEPT
# forward all requests to the proxy
sudo iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 80 -j REDIRECT --to-port 8080
sudo iptables -t nat -A PREROUTING -i wlan0 -p tcp --dport 433 -j REDIRECT --to-port 8080
mitmproxy -T --host
So, a $38 raspberry pi plus a $35 Edimax wifi dongle, makes a pretty nice Wifi hotspot with advanced network inspection capabilities.