Capture all traffic to the specified remote IP

Question

Created Aug ’20

Replies 2

Boosts 0

Participants 3

I have to capture all traffic for only a particualar remote IP (e.g. 30.40.50.60) . i have tried to set NEFilterRule for NEFilterDataProvider as follow :

Code Block host= [NWHostEndpoint endpointWithHostname:@"30.40.50.60" port:@"0"]
Rule= [[NENetworkRule alloc] initWithDestinationNetwork:host prefix:0 protocol:NENetworkRuleProtocolAny];
FilterRule = [[NEFilterRule alloc] initWithNetworkRule:Rule action:NEFilterActionFilterData];
FilterRuleArray = [NSArray arrayWithObjects:FilterRule, nil];
FilterSettings = [[NEFilterSettings alloc] initWithRules:FilterRuleArray defaultAction:NEFilterActionAllow];
[self applySettings:FilterSettings completionHandler:^(NSError *error){}];

somehow I am still getting all the traffic in handleNewFlow . i wan it only for the particular IP address .
not sure what is wrong here . any pointer on this will help .

Boost

Answer 1

Systems Engineer OP

Apple

Aug ’20

Try using a NENetworkRule that matches the full range of the IP in the destinationPrefix.

Code Block swiftlet anyNetworkRule = NENetworkRule(destinationNetwork: NWHostEndpoint(hostname: "30.40.50.60",	port: "80"), prefix: 32, protocol: .any)

So this would be any connections for specifically 30.40.50.60:80.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

0

Answer 2

jeev2k OP

Aug ’20

thank you matt. that did help .

0