Based on threads from past years, it is mentioned that a NEFilterDataProvider supports IPPROTO_TCP, IPPROTO_UDP, IPPROTO_ICMP and IPPROTO_IGMP.
[Q] What about IPPROTO_RAW? Is this something that would have been added recently?
How did we do? We’d love to know your thoughts on this year’s conference. Take the survey here
Which socketProtocols are handled by a NEFilterDataProvider these days?
IPPROTO_RAW isn’t a real protocol. It’s a placeholder used at various places within the kernel and API. It’s value, 255, is reserved in the list of IP protocol numbers [1], meaning that you shouldn’t expect to see it on the wire.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
[1] https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
OK but then is it expected for a NEFilterSocketFlow to have the following properties:
direction = outbound protocol = 255 (IPPROTO_RAW) family = 2 (PF_INET) type = 3 (SOCK_RAW) localEndpoint = 0.0.0.0:0 remoteEndpoint = not.a.local.ip:0
?