Ask Different is a question and answer site for power users of Apple hardware and software. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

What are Tun and Tap (ether tap stack) in the startup items folder? Are they legitimate ones used by services like Parallels or HPTrap monitor etc or are they installed to bypass services like Little Snitch? I found them while looking at space hogs on my computer.

share|improve this question
up vote 3 down vote accepted

TUN and TAP are software-based network devices. They're usually created by VPN or ssh-tunnelling applications to handle network address translation or bridge functions from one network to another. They're also used for virtual machine bridging and you'll find them created by VirtualBox if you happen to use it as a VM solution. Possibly Parallels or Fusion might create them as well (though I don't have them on my Fusion-enabled machines).

From this wikipedia entry:

Packets sent by an operating system via a TUN/TAP device are delivered to a user-space program that attaches itself to the device. A user-space program may also pass packets into a TUN/TAP device. In this case TUN/TAP device delivers (or "injects") these packets to the operating system network stack thus emulating their reception from an external source.

If LittleSnitch resides between your ethernet interface and the OS, a TUN/TAP pair won't help route traffic around it. Though it may encrypt it beyond inspection.

That wikipedia lists a bunch of legitimate applications that might set up TUN/TAP pairs on your machine but that list by no means exhaustive. The pair might even be present for Little Snitch packet routing and inspection (though, truthfully, I thought Little Snitch just enhanced OS X's default Firewall service, not replaced it...I may be wrong about that though).

You can use netstat -nrl to try and ascertain what, if any, routes are being shuffled through the TUN/TAP pair. First do an ifconfig and get the ether value (the MAC address) for the pair, and then look up routes in the table that netstat -nrl returns to see if you can spot either MAC address.

If that doesn't work you can use Wireshark to listen on the interface(s) for traffic and see if you can figure out from where and to where it's headed. There's a homebrew recipe for Wireshark to install it:

brew install wireshark

It's a fairly complicated program to use so leave a comment if you need this expanded upon.

share|improve this answer
Thanks a lot, My wife's MacBookPro contains no such software in the startup items. She has LittleSnitch installed on her computer as well, so i guess it is not LittleSnitch that is putting them there. Also, She uses Fusion rather than Parallels so fusion doesn't seem to be using them. I wondered if the Parallels software is using it to bridge/share the network with OS X side of things. I probably have to ask the forums of Parallels and HP to see if they use TUN/TAP software. I wonder if i can safely delete them without emptying recyclebin and see which program doesn't work. – Ram Apr 24 '12 at 19:15
Make sure Parallels is stopped, remove them, and then start Parallels. I'd place good money on Parallels using them for VM <-> Guest OS bridging. – Ian C. Apr 24 '12 at 19:41
i stopped Parallels, deleted TAP/TUN and then upgraded Parallels. It wasn't Parallels either. I am guessing it may be something else. – Ram Apr 25 '12 at 17:40

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.