Network system extension reporting 0.0.0.0 for failed connections

I have a network system extension that is a `FilterDataProvider`. It works well for successful connections to and from the host machine.

Example from printing the local and remote NWHostEndpoint objects from the `handleNewFlow` function:

```

New flow observed : 192.168.56.1:64911->192.168.56.105:9000 (Outbound)[TCP]

```

However when I make a failed TCP connection from my host, a new flow is not created because the connection failed. In this case I see that the functions `handleInboundDataComplete` get called. The local address is always `0.0.0.0:0` for an outbound connection example:

```

0.0.0.0:0 -> 192.168.56.105:9000

``

Now a `tcpdump` on the remote machine shows that the connection was attempted:

```

12:09:16.929211 IP 192.168.56.105.9000 > 192.168.56.1.64910: Flags [R.], seq 0, ack 885948719, win 0, length 0

12:09:17.931356 IP 192.168.56.1.64910 > 192.168.56.105.9000: Flags [S], seq 885948718, win 65535, options [mss 1460,nop,wscale 6,nop,nop,TS val 783305121 ecr 0,sackOK,eol], length 0

12:09:17.931682 IP 192.168.56.105.9000 > 192.168.56.1.64910: Flags [R.], seq 0, ack 1, win 0, length 0

12:09:21.937581 ARP, Request who-has 192.168.56.1 tell 192.168.56.105, length 28

12:09:21.937760 ARP, Reply 192.168.56.1 is-at 0a:00:27:00:00:00 (oui Unknown), length 46

```

Question 1 ) Is there any way of getting local address and port information from an Outbound failed connection?


I also can't find how to get any notification in this framework in the case of a failed INBOUND connection.


Question 2) Is there any way of getting information for failed Inbound connections?


NOTE : I understand that I could use the PacketFilterProvider, but this would require complex matching between the two providers and is potentially needless processing, plus I need the pid of the process responsible for the flow (or failed flow).


Thank you.

I've been looking into using PacketProvider along with DataProvider with no luck. Is there any way to get pid and exe from `NEFilterPacketContext` in PacketProvider ?

Please ignore question 2 of my original request. Getting information on failed inbound connections is not necessary.


However please note that I've also found that all outbound udp connections have a 0 source address:

```
0.0.0.0:235 -> 192.168.56.105:9000
```

Is this expected - seems like a bug

Please respond. This is an ongoing problem

Please respond.

Folks here try to help out where they can but you have to understand that DevForums is not an official support channel. If you want an official response, you have two options:

  • If you believe that this is a bug, you should file a bug report about it. Please post your bug number, just for the record.

  • If you want someone to see if there’s a workaround, you should open a DTS tech support incident. That will allow me, or one of my colleagues, to dedicate the time required to look into your issue.

Share and Enjoy

Quinn “The Eskimo!”
Apple Developer Relations, Developer Technical Support, Core OS/Hardware

let myEmail = "eskimo" + "1" + "@apple.com"
Hi,
Following on that, does anyone know if there is a workaround for that?
If not, I'll file a relevant bug report, as Quinn suggested.
I'm not exactly sure what is happening here, but like Quinn suggest, if you open a TSI with a sample project I can try to look into this more to see if there is anything we can uncover.


Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com
Hi Matt,
I have seen this is a common issue, experienced by many (by the number of threads on this forum). Opened FB9076102.
Network system extension reporting 0.0.0.0 for failed connections
 
 
Q