NEFilterSocketFlow remoteHostname property

Question

Created May ’21

Replies 3

Boosts 0

Participants 2

Hi, i was wondering about the remoteHostname property of NEFilterSocketFlow that is available on macOS 11.0+. I have been doing some tests and I can never seem to get a value, it is always nil. I am looking at all flows from all apps. In what cases will this property show up?

Answered by DTS Engineer in 674548022

OK. If you get remoteEndpoint but not remoteHostname then there simply is no DNS name available. The doc comments associated with that property make it clear that this is a possibility:

Code Block  This property is only non-nil if the flow was created using Network.framework or NSURLSession.

Was the connection created by Network framework or NSURLSession (the latter includes Safari)?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Boost

Answer 1

DTS Engineer OP

Apple

May ’21

Can you get things to a point where remoteEndpoint gets populated?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 2

santalvarez OP

May ’21

Yes, I can get the remoteEndpoint populated

Code Block guard let socketFlow = flow as? NEFilterSocketFlow,
    let remoteEndpoint = socketFlow.remoteEndpoint as? NWHostEndpoint,
    let localEndpoint = socketFlow.localEndpoint as? NWHostEndpoint else {
      return nil
}
     
if #available(macOS 11.0, *) {
    if let hostname = socketFlow.remoteHostname {
        // Access hostname
    }
}

0

Answer 3

DTS Engineer OP

Apple

May ’21

Accepted Answer

OK. If you get remoteEndpoint but not remoteHostname then there simply is no DNS name available. The doc comments associated with that property make it clear that this is a possibility:

Code Block  This property is only non-nil if the flow was created using Network.framework or NSURLSession.

Was the connection created by Network framework or NSURLSession (the latter includes Safari)?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0