Thanks Matt for the reply. Paste below the rules setting.
private func buildRules(fullMode: Bool) -> [NENetworkRule] {
var hosts = [("", "")]
var rules: [NENetworkRule] = []
hosts = [("0.0.0.0", "80"),
("0.0.0.0", "443")]
for host in hosts {
let ep = NWHostEndpoint(hostname: host.0, port: host.1)
let rule = NENetworkRule.init(remoteNetwork: ep, remotePrefix: 0, localNetwork: nil, localPrefix: 0, protocol: .TCP, direction: .outbound)
rules.append(rule)
}
for seg in 1...223 {
if seg != 127 {
let ep = NWHostEndpoint(hostname: "\(seg).0.0.0", port: "0")
// capture all udp traffic including port 53
var rule = NENetworkRule.init(remoteNetwork: ep, remotePrefix: 8, localNetwork: nil, localPrefix: 0, protocol: .UDP, direction: .outbound)
rules.append(rule)
}
}
return rules
}
private func exceptRules() -> [NENetworkRule] {
var hosts = [("", "")]
var rules: [NENetworkRule] = []
// rule out dhcp, ntp traffic
hosts = [("0.0.0.0", "67"),
("0.0.0.0", "68"),
("0.0.0.0", "123")]
for host in hosts {
let ep = NWHostEndpoint(hostname: host.0, port: host.1)
let rule = NENetworkRule.init(remoteNetwork: ep, remotePrefix: 0, localNetwork: nil, localPrefix: 0, protocol: .UDP, direction: .outbound)
rules.append(rule)
}
return rules
}
override func startProxy(...) {
...
let settings = NETransparentProxyNetworkSettings.init(tunnelRemoteAddress: "127.0.0.1")
settings.includedNetworkRules = buildRules()
settings.excludedNetworkRules = exceptRules()
setTunnelNetworkSettings(settings) {
...
}
}
Attached also traces with these two websites. Only printout target url when a difference flowId (flows.hash) request is up.
We can see that:
- The number of request is significant
- Even with different flowId, there are many continuous request with the same url. Not sure how it is decided to generate a new flowId.
Thanks in advance for the support.
Richard
