Based on threads from past years, it is mentioned that a NEFilterDataProvider supports IPPROTO_TCP, IPPROTO_UDP, IPPROTO_ICMP and IPPROTO_IGMP.
[Q] What about IPPROTO_RAW? Is this something that would have been added recently?
Which socketProtocols are handled by a NEFilterDataProvider these days?
IPPROTO_RAW isn’t a real protocol. It’s a placeholder used at various places within the kernel and API. It’s value, 255, is reserved in the list of IP protocol numbers [1], meaning that you shouldn’t expect to see it on the wire.
Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
[1] https://www.iana.org/assignments/protocol-numbers/protocol-numbers.xhtml
OK but then is it expected for a NEFilterSocketFlow to have the following properties:
direction = outbound protocol = 255 (IPPROTO_RAW) family = 2 (PF_INET) type = 3 (SOCK_RAW) localEndpoint = 0.0.0.0:0 remoteEndpoint = not.a.local.ip:0
?