12

I've been digging into Darwin source to try to find some way to create virtual Ethernet interfaces on Mac/Darwin without adding a kernel extension like tuntaposx. In doing so I've found something interesting that seems to exist but have zero documentation.

Here's the source file:

https://opensource.apple.com/source/xnu/xnu-4570.41.2/bsd/net/if_fake.c.auto.html

Reading the file leads me to think this is similar to a veth pair on Linux: create two interfaces and packets going into one pop out the other.

The only problem is that I can find nothing on the Internet about this.

I have been able to confirm that it exists as of OSX Mojave and assume they exist on older versions too:

# ifconfig feth0 create
feth0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  ether 66:65:74:68:00:00
  peer: <none>
  media: autoselect
  status: inactive

After looking some more I seem to have found an undocumented option in ifconfig to link two of these:

# ifconfig feth0 peer feth1
# ifconfig feth0
feth0: flags=8843<UP,BROADCAST,RUNNING,SIMPLEX,MULTICAST> mtu 1500
  ether 66:65:74:68:00:00
  inet 9.9.9.9 netmask 0xffffff00 broadcast 9.9.9.255
  peer: feth1
  media: autoselect
  status: active

Now when I add an IP to feth0 and tcpdump feth1, I see a bunch of packets that are things like mDNS announcements that you would expect a Mac to spew into a new Ethernet link.

I'm posting this here because I'm curious about whether anyone else has any clue about this or has ever used it.

Edit: I can now confirm that if you peer them and bring them both up (ifconfig feth0 up, etc.) you can inject packets into either side and see them in the other. It looks like this indeed could work as a layer 2 Ethernet tap device or virtual machine veth pair device without requiring a kernel extension. Not only is this awesome for network virtualization but paired with Apple's virtualization extensions it would also allow a kext-free VM host with full networking capabilities.

Edit #2: We also just found this, which is also not very well documented albeit much better than feth. It may offer a more officially supported way of creating virtual Ethernet devices. We'll have to see how it works. The feth stuff is still interesting though!

https://developer.apple.com/documentation/vmnet

Improve this question
2
  • Just a note for anyone coming through: In fact there is a built-in, userspace mechanism for creating virtual network devices called utun. The way it works is that a user-space application opens a SOCK_DGRAM socket (using an - apple-specific - kernel control interface) which can be used for reading/writing packets. This interface's lifetime is tied to the process that holds the socket open (unlike in linux). It's protocol layer though so no way to process link layer (ethernet) frames - just like the linux TUN adapter. Check out OpenVPN to see how it's implemented. – pinkeen May 20 '20 at 17:32
  • Yes, utun is the documented method, but you can't create a layer 2 tap device with utun. The feth mechanism is the only known way to create a layer 2 tap device on MacOS without a kernel extension. In addition utun is hard-coded as blacklisted in the MacOS bonjour/mDNS daemon, meaning that mDNS doesn't work and can never work over utun device networks without a hack like writing a "repeater" that listens to the main interface and repeats mDNS packets. – Adam Ierymenko May 29 '20 at 11:40
0

Yes you can create new interfaces and link them however you would like for whatever your heart desires : ) You can utilize this feature for all different things like isolating certain traffic. For ex: forcing all traffic through a VPN except for some criteria. My router sends all traffic through a VPN which is a separate LAN from my STB/Cable Box. I want to use my mobile device to change the channel but it won’t work if I’m in a VPN, a separate interface can ether tunnel traffic from my device or isolate traffic directed to the mobile app I’m using and route it around the VPN.

As for reference and documentation, Unix utilizes man pages like Linux too for basic and core reference. I like to use cheat.sh for examples, it’s formatted very nicely too when you make a query within your terminal. It’s formatted like this cheat.sh/example. ~ cheat.sh/ifconfig

Improve this answer
1
  • Yes, but feth is not mentioned in any manual page on Mac. It's very undocumented but it exists. – Adam Ierymenko Feb 3 '20 at 20:58

Not the answer you're looking for? Browse other questions tagged .