What Are Socket Filters and What Do They Do?

Question

My company recently required me to install Cisco AnyConnect on my privately used MacBook Pro in order to connect to the company VPN. At seemingly random times after installation this message keeps popping up:

I keep refusing the request and the VPN works anyway, but the message keeps showing up which is really annoying. When you accept it, AnyConnect will add these Socket Filters in Network Preferences:

The filters are always running and connected to something, even if the VPN is disconnected. What are they actually doing? How can I permanently refuse the installation of these socket filters?

Answer 1

A socket filter is a means to listen to a particular network socket and communicate with an application.

In Cisco AnyConnect's case, the fact that their socket filters show as 'running' is a poor choice of naming - they are running in the context of the local system, but are not communicating anything back to any external host. You can test this by disabling all active Internet connections or network services.

If you're still concerned, create a new network Location from System Preferences > Network, select each Cisco interface and set it to disabled. Then just switch to that location before opening the AnyConnect application and connecting to your organization's VPN.

Answer 2

In general, a global socket filter is small program installed on your computer that - when enabled - is able to inspect and edit any socket network data sent and received by programs on your computer.

Socket network data includes communication on your local network and on the Internet - almost all ordinary programs uses socket networking.

The program can chose to do almost anything with the data that flows through it. It can change data that you receive from for example the Internet before it reaches an application, and it can modify data that applications tries to send to the network. All without that application knowing about it.

It is also possible for a socket filter to never modify incoming and outgoing data - but instead just read the data that is passed through it. That can be either something simple like a filter that counts up your network usage in terms of types - or it can be something malicious like waiting for a specific time and then sending copies of your data to a foreign state.

In this specific case, the Cisco claims that their AnyConnect socket filter performs the following three tasks:

• DNS proxying
• App/transparent proxying
• Content filtering

As far as I understand from this document, the DNS proxying feature is meant to ensure that all DNS requests from your computer are routed through the VPN. Any attempts to do DNS lookups from outside the VPN tunnel are blocked.

App/transparent proxying means that when programs on your computer try to communicate with the network, the data they try to send (not the fully network packets) are routed through a proxy server on the other side of the VPN. This essentially allows the VPN server and its proxy server to do various kinds of filtering, blocking, etc.

Content filtering means that data you send and/or receive can be filtered. For example the VPN administrator might decide that any access to facebook.com should be blocked when using the VPN.