6

My company recently required me to install Cisco AnyConnect on my privately used MacBook Pro in order to connect to the company VPN. At seemingly random times after installation this message keeps popping up:

enter image description here

I keep refusing the request and the VPN works anyway, but the message keeps showing up which is really annoying. When you accept it, AnyConnect will add these Socket Filters in Network Preferences:

enter image description here

The filters are always running and connected to something, even if the VPN is disconnected. What are they actually doing? How can I permanently refuse the installation of these socket filters?

2 Answers 2

2

A socket filter is a means to listen to a particular network socket and communicate with an application.

In Cisco AnyConnect's case, the fact that their socket filters show as 'running' is a poor choice of naming - they are running in the context of the local system, but are not communicating anything back to any external host. You can test this by disabling all active Internet connections or network services.

If you're still concerned, create a new network Location from System Preferences > Network, select each Cisco interface and set it to disabled. Then just switch to that location before opening the AnyConnect application and connecting to your organization's VPN.

2
  • Excellent idea regarding the different network locations, thank you!
    – Double M
    Mar 27, 2022 at 17:30
  • 2
    Note that it is not actually correct that they "are not communicating anything back to the external host" - you cannot know that in the general case. It might be that this particular filter is well-behaved and never does that - but you can't really know for sure without checking the code of the filter yourself.
    – jksoegaard
    Mar 27, 2022 at 21:43
9

In general, a global socket filter is small program installed on your computer that - when enabled - is able to inspect and edit any socket network data sent and received by programs on your computer.

Socket network data includes communication on your local network and on the Internet - almost all ordinary programs uses socket networking.

The program can chose to do almost anything with the data that flows through it. It can change data that you receive from for example the Internet before it reaches an application, and it can modify data that applications tries to send to the network. All without that application knowing about it.

It is also possible for a socket filter to never modify incoming and outgoing data - but instead just read the data that is passed through it. That can be either something simple like a filter that counts up your network usage in terms of types - or it can be something malicious like waiting for a specific time and then sending copies of your data to a foreign state.

In this specific case, the Cisco claims that their AnyConnect socket filter performs the following three tasks:

  • DNS proxying
  • App/transparent proxying
  • Content filtering

As far as I understand from this document, the DNS proxying feature is meant to ensure that all DNS requests from your computer are routed through the VPN. Any attempts to do DNS lookups from outside the VPN tunnel are blocked.

App/transparent proxying means that when programs on your computer try to communicate with the network, the data they try to send (not the fully network packets) are routed through a proxy server on the other side of the VPN. This essentially allows the VPN server and its proxy server to do various kinds of filtering, blocking, etc.

Content filtering means that data you send and/or receive can be filtered. For example the VPN administrator might decide that any access to facebook.com should be blocked when using the VPN.

1
  • Thank you for the comprehensive answer and official references, they have been very useful.
    – Double M
    Mar 27, 2022 at 17:29

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .