Introduction to Network Kernel Extensions Programming GuideĮmphasis in quoted content mine.Network kernel extensions are far more powerful and allow for more detailed control. Similarly, packet logging should generally be done using bpf. For example, where possible, IP filtering should generally be done using ipfw. They essentially act as filters between a protocol stack and a device.Īlternatives to network kernel extensions exist as you mentioned, but only for certain use cases.īecause even minor bugs in kernel-level code can cause serious consequences, including application instability, data corruption, and even kernel panics, the techniques described in this document should be used only if no other mechanism already exists. They can also modify the traffic (for example, encrypting or performing address translation). These interface filters (previously known as data link NKEs) can passively observe traffic (regardless of packet type) as it flows into and out of the system. Interface filter KPI, which allows a KEXT to add a filter to a specific network interface.The resulting filters lie between the socket layer and the protocol.

Socket filters can also filter out-of-band communication such as calls to setsockopt or bind. Socket filter KPI, which permits a KEXT to filter inbound or outbound traffic on a given socket, depending on how they are attached.These modules can monitor and modify network traffic, and can receive notification of asynchronous events from the driver layer, such as interface status changes.Įach of the networking KPI mechanisms performs a specific task. NKEs allow you to create modules that can be loaded and unloaded dynamically at specific positions in the network hierarchy. Little Snitch uses a network kernel extension to intercept network traffic.

Little snitch macos