This seems to happen each time I connect to a WiFi, the ipsec interface goes up with a PTP VPN config with description, VPN: ProtonVPN.

I've deleted every ProtonVPN artifact I can find and still the problem persists.

I have no VPN profiles configured, and scutil --nc yields an empty response.

Same with lsof, no mention of ipsec0

ProtonVPN support has not helped resolve the issue.

How can I determine which process / service is doing this?

ifconfig -a -vv ipsec0 -- Note the agent domain desc:"VPN: ProtonVPN" [App Cleaner used to remove ProtonVPN several times]

ipsec0: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1400 index 17
    inet --> netmask 0xff000000 
    netif: E22A3DA9-EA52-41DE-9C1F-5F4598DEF26F
    flowswitch: E79F3C2B-56E4-4816-B390-7DB240E9664E
    type: 0x1 family: 18 subfamily: 0
    functional type: wifi
    agent domain:Skywalk type:NetIf flags:0x8443 desc:"Userspace Networking"
    agent domain:Skywalk type:FlowSwitch flags:0x4403 desc:"Userspace Networking"
    agent domain:NetworkExtension type:VPN flags:0xf desc:"VPN: ProtonVPN"
    link quality: -1 (unknown)
    state availability: 0 (true)
    scheduler: FQ_CODEL 
    effective interface: en0
    qosmarking enabled: no mode: none
    low power mode: disabled
    multi layer packet logging (mpklog): disabled

netstat -nr

Routing tables

Destination        Gateway            Flags        Netif Expire
default            link#17            UCS         ipsec0       
default         UGScI          en0            link#17            UHW3I       ipsec0     29       link#17            UHWIi       ipsec0       link#17            UHWIi       ipsec0         UH          ipsec0           link#17            UHWIi       ipsec0       link#17            UHWIi       ipsec0       link#17            UHWIi       ipsec0      link#17            UHWIi       ipsec0     link#17            UHWIi       ipsec0      link#17            UHWIi       ipsec0     link#17            UHWIi       ipsec0      link#17            UHWIi       ipsec0       link#17            UHWIi       ipsec0      link#17            UHWIi       ipsec0       link#17            UHWIi       ipsec0     link#17            UHWIi       ipsec0      link#17            UHWIi       ipsec0       link#17            UHWIi       ipsec0      link#17            UHWIi       ipsec0       link#17            UHWIi       ipsec0      link#17            UHWIi       ipsec0        link#17            UHWIi       ipsec0         link#17            UHWIi       ipsec0      link#17            UHWIi       ipsec0        link#17            UHW3I       ipsec0     29       link#17            UHWIi       ipsec0     link#17            UHWIi       ipsec0       link#17            UHW3I       ipsec0     35      link#17            UHWIi       ipsec0      link#17            UHWIi       ipsec0      link#17            UHWIi       ipsec0     link#17            UHWIi       ipsec0      link#17            UHWIi       ipsec0      link#17            UHW3I       ipsec0     33
127                UCS            lo0          UH             lo0       
169.254            link#6             UCS            en0      !
172.16.215/24      link#19            UC          vmnet8      !     ff:ff:ff:ff:ff:ff  UHLWbI      vmnet8      !       UGHS           en0       
192.168.16/22      link#6             UCS            en0      !    link#6             UCS            en0      !       f0:9f:c2:1a:63:cf  UHLWIir        en0   1187      9c:30:5b:d3:77:2f  UHLWI          en0   1138      0:b3:62:34:7b:de   UHLWI          en0    877     c4:61:8b:4c:ec:5f  UHLWI          en0   1057     c8:3c:85:a0:2f:b7  UHLWI          en0    814     2c:be:8:bb:5e:c3   UHLWI          en0    825     80:82:23:66:84:4   UHLWI          en0    877     0:15:99:d7:f6:5a   UHLWI          en0   1185     c:51:1:c7:a4:1e    UHLWI          en0    856  link#6             UCS            en0      !     0:80:92:cb:ab:bf   UHLWI          en0   1180       6c:8d:c1:3f:b5:2d  UHLWI          en0   1079      d8:1c:79:ea:8e:2b  UHLWI          en0    911      90:e1:7b:d7:75:23  UHLWI          en0   1007      34:2:86:87:d1:b    UHLWI          en0   1069      d8:1c:79:ca:6b:bd  UHLWI          en0   1176     14:20:5e:85:36:2   UHLWI          en0   1031     38:b1:db:e3:40:3b  UHLWIi         en0   1165     30:d1:6b:10:93:c0  UHLWI          en0   1079       c0:a6:0:7:ee:c9    UHLWI          en0    857      8c:85:90:11:5c:90  UHLWI          en0   1094      40:bc:60:1e:2:d5   UHLWI          en0    967     7c:a1:ae:8:29:8f   UHLWI          en0   1066     34:42:62:7d:a7:d0  UHLWI          en0   1124     14:10:9f:e9:31:a2  UHLWIi         en0   1163     3c:2e:ff:1f:94:ca  UHLWI          en0   1138       58:6b:14:6:b5:9e   UHLWI          en0    931      54:33:cb:51:60:53  UHLWIi         en0    813      80:c:67:3f:2c:e1   UHLWI          en0    988      b0:ca:68:9c:83:3c  UHLWI          en0    924     b8:41:a4:54:c0:8a  UHLWIi         en0    874     ff:ff:ff:ff:ff:ff  UHLWbI         en0      !
192.168.74         link#18            UC          vmnet1      !     ff:ff:ff:ff:ff:ff  UHLWbI      vmnet1      !
224.0.0/4          link#17            UmCS        ipsec0       
224.0.0/4          link#6             UmCSI          en0      !        link#17            UHmW3I      ipsec0     33 link#17            UCS         ipsec0 link#6             UCSI           en0      !

Destination                             Gateway                         Flags         Netif Expire
default                                 fe80::%utun0                    UGcI          utun0       
default                                 fe80::%utun1                    UGcI          utun1       
default                                 fe80::%utun2                    UGcI          utun2       
default                                 fe80::%utun3                    UGcI          utun3       
::1                                     ::1                             UHL             lo0       
fe80::%lo0/64                           fe80::1%lo0                     UcI             lo0       
fe80::1%lo0                             link#1                          UHLI            lo0       
fe80::%en10/64                          link#4                          UCI            en10       
fe80::aede:48ff:fe00:1122%en10          ac:de:48:0:11:22                UHLI            lo0       
fe80::aede:48ff:fe33:4455%en10          ac:de:48:33:44:55               UHLWIi         en10       
fe80::%en0/64                           link#6                          UCI             en0       
fe80::3:aea3:bd6f:3c20%en0              78:31:c1:c7:8a:ac               UHLWI           en0       
fe80::45:ff77:829e:1285%en0             8c:85:90:98:cd:34               UHLWI           en0       
fe80::6d:c188:a11c:8f03%en0             9c:20:7b:de:7:a7                UHLWI           en0       
fe80::4cb:eb4c:daae:2b54%en0            b8:17:c2:c1:77:3a               UHLWI           en0       
fe80::4d1:99e4:6833:564%en0             a4:83:e7:5e:75:e1               UHLWI           en0       
fe80::8e0:d15f:bde0:dc04%en0            98:1:a7:a4:a6:1b                UHLWI           en0       
fe80::8f6:451f:1b75:721e%en0            f8:ff:c2:2e:ca:73               UHLWI           en0       
fe80::ca8:73fd:44fe:228a%en0            f8:ff:c2:44:e9:44               UHLI            lo0       
fe80::cf5:61:515f:c450%en0              10:94:bb:ed:2c:18               UHLWI           en0       
fe80::108b:8810:1b67:3c89%en0           8c:85:90:11:5c:90               UHLWI           en0       
fe80::10b4:36dc:d9c9:990f%en0           88:e9:fe:5c:21:19               UHLWI           en0       
fe80::1438:8686:40a6:4389%en0           b0:34:95:3d:7a:59               UHLWI           en0       
fe80::1493:6a8f:4a22:4454%en0           68:db:ca:9e:83:95               UHLWI           en0       
fe80::14a6:911:68f6:a4b8%en0            38:f9:d3:5a:8d:5b               UHLWI           en0       
fe80::180f:3b62:489b:7928%en0           38:f9:d3:b6:32:59               UHLWI           en0       
fe80::18bc:cdbc:550:64e0%en0            6c:8d:c1:3f:b5:2d               UHLWI           en0       
fe80::18ee:81f3:88fd:51d9%en0           a4:83:e7:83:f4:69               UHLWI           en0       
fe80::1cdb:e916:7bf8:8d4f%en0           38:f9:d3:cd:a0:28               UHLWI           en0       
fe80::%awdl0/64                         link#8                          UCI           awdl0       
fe80::6c52:f6ff:fe27:30de%awdl0         6e:52:f6:27:30:de               UHLI            lo0       
fe80::%llw0/64                          link#9                          UCI            llw0       
fe80::6c52:f6ff:fe27:30de%llw0          6e:52:f6:27:30:de               UHLI            lo0       
fe80::%utun0/64                         fe80::ef8d:39b7:d0a7:bcff%utun0 UcI           utun0       
fe80::ef8d:39b7:d0a7:bcff%utun0         link#15                         UHLI            lo0       
fe80::%utun1/64                         fe80::f855:da2f:9165:598b%utun1 UcI           utun1       
fe80::f855:da2f:9165:598b%utun1         link#16                         UHLI            lo0       
fe80::%utun2/64                         fe80::c8b3:a4f3:ff43:d729%utun2 UcI           utun2       
fe80::c8b3:a4f3:ff43:d729%utun2         link#20                         UHLI            lo0       
fe80::%utun3/64                         fe80::8a6d:ce1a:3267:fdcb%utun3 UcI           utun3       
fe80::8a6d:ce1a:3267:fdcb%utun3         link#21                         UHLI            lo0       
ff01::%lo0/32                           ::1                             UmCI            lo0       
ff01::%en10/32                          link#4                          UmCI           en10       
ff01::%en0/32                           link#6                          UmCI            en0       
ff01::%awdl0/32                         link#8                          UmCI          awdl0       
ff01::%llw0/32                          link#9                          UmCI           llw0       
ff01::%utun0/32                         fe80::ef8d:39b7:d0a7:bcff%utun0 UmCI          utun0       
ff01::%utun1/32                         fe80::f855:da2f:9165:598b%utun1 UmCI          utun1       
ff01::%utun2/32                         fe80::c8b3:a4f3:ff43:d729%utun2 UmCI          utun2       
ff01::%utun3/32                         fe80::8a6d:ce1a:3267:fdcb%utun3 UmCI          utun3       
ff02::%lo0/32                           ::1                             UmCI            lo0       
ff02::%en10/32                          link#4                          UmCI           en10       
ff02::%en0/32                           link#6                          UmCI            en0       
ff02::%awdl0/32                         link#8                          UmCI          awdl0       
ff02::%llw0/32                          link#9                          UmCI           llw0       
ff02::%utun0/32                         fe80::ef8d:39b7:d0a7:bcff%utun0 UmCI          utun0       
ff02::%utun1/32                         fe80::f855:da2f:9165:598b%utun1 UmCI          utun1       
ff02::%utun2/32                         fe80::c8b3:a4f3:ff43:d729%utun2 UmCI          utun2       
ff02::%utun3/32                         fe80::8a6d:ce1a:3267:fdcb%utun3 UmCI 
  • 1
    If you’ve deleted it from system pref > network, wont it ask again next time someone tries to add it ? – anki Mar 21 '20 at 5:35
  • Presumably it should but it's not being configured that way..I've tracked it down to an NEIKEv2Provider process whose parent is launchd. But the PID of the NEIKE process is not listed as the PID of any of the services found from launchctl list – t0dd Mar 21 '20 at 5:59

The direct answer to my question:

Track down the process by gathering more information

scutil --nwi

Network information

IPv4 network interface information
  ipsec0 : flags      : 0x5 (IPv4,DNS)
           address    :
           VPN server : X.X.X.X
           reach      : 0x00000003 (Reachable,Transient Connection)

Check PIDs of network connections to VPN server and find parent PID

lsof -i | grep -E "X.X.X.X"

NEIKEv2Pr  **942** todd    7u  IPv4 0x6816df6181c68875      0t0  UDP>X.X.X.X:ipsec-msft 

ps -l 942 | grep -v grep

UID   PID  PPID        F CPU PRI NI       SZ    RSS WCHAN     S             ADDR TTY           TIME CMD
  502   942     **1**     4004   0  31  0  5007340   8496 -      Ss                  0 ??         0:00.46 /System/Library/Frameworks/NetworkExtension.framework/PlugIns/NEIKEv2Provider.appex/Contents/MacOS/NEIKEv2Provider

PID 1 belongs to launchd in this case...now on to my next problem of finding the service responsible for launching this NEIKEv2 process..any help is welcome although I'll most likely have to start a new thread.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .