Mysterious second Ethernet stack on my Mac?

Question

What are Tun and Tap (ether tap stack) in the startup items folder? Are they legitimate ones used by services like Parallels or HPTrap monitor etc or are they installed to bypass services like Little Snitch? I found them while looking at space hogs on my computer.

Answer 1

TUN and TAP are software-based network devices. They're usually created by VPN or ssh-tunnelling applications to handle network address translation or bridge functions from one network to another. They're also used for virtual machine bridging and you'll find them created by VirtualBox if you happen to use it as a VM solution. Possibly Parallels or Fusion might create them as well (though I don't have them on my Fusion-enabled machines).

From this wikipedia entry:

Packets sent by an operating system via a TUN/TAP device are delivered to a user-space program that attaches itself to the device. A user-space program may also pass packets into a TUN/TAP device. In this case TUN/TAP device delivers (or "injects") these packets to the operating system network stack thus emulating their reception from an external source.

If LittleSnitch resides between your ethernet interface and the OS, a TUN/TAP pair won't help route traffic around it. Though it may encrypt it beyond inspection.

That wikipedia lists a bunch of legitimate applications that might set up TUN/TAP pairs on your machine but that list by no means exhaustive. The pair might even be present for Little Snitch packet routing and inspection (though, truthfully, I thought Little Snitch just enhanced OS X's default Firewall service, not replaced it...I may be wrong about that though).

You can use netstat -nrl to try and ascertain what, if any, routes are being shuffled through the TUN/TAP pair. First do an ifconfig and get the ether value (the MAC address) for the pair, and then look up routes in the table that netstat -nrl returns to see if you can spot either MAC address.

If that doesn't work you can use Wireshark to listen on the interface(s) for traffic and see if you can figure out from where and to where it's headed. There's a homebrew recipe for Wireshark to install it:

brew install wireshark

It's a fairly complicated program to use so leave a comment if you need this expanded upon.