Does anyone know if it is possible to identify the Process ID associated with a packet in the NEFilterPacketHandler closure for macOS?
I've been looking around for what I might be able to squeeze out of the NEFilterPacketContext, but I haven't found anything yet.
Thanks.
If you delay the packet then you’ll get back an
NEPacketmetadataHowever, you have to be careful here. A filter packet provider is extremely performance sensitive, so it’s unwise to delay every packet. You’ll need some mechanism to ensure that most packets go via the fast path (that is, your
NEFilterPacketHandler.allow.dropYou might choose to only delay packets that meet specific criteria.
You might maintain a flow cache, and only delay the first packet, or first few packets, of any given flow.
Share and Enjoy
—
Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware
let myEmail = "eskimo" + "1" + "@apple.com"ps DTS is closed 21 Dec through 1 Jan.