Question Regarding peekOutboundBytes Limit in NEFilterDataProvider When Using SMB

Question

blackson OP

Created 14h

Replies 1

Boosts 0

Participants 2

Dear Apple Developer Technical Support,

I am currently developing a macOS network filtering solution using NetworkExtension with NEFilterDataProvider.

During implementation of the handleOutboundData logic, we are using the following verdict:

NEFilterNewFlowVerdict.filterDataVerdict(
    withFilterInbound: true,
    peekInboundBytes: InboundPeekBytes,
    filterOutbound: true,
    peekOutboundBytes: OutboundPeekBytes
)

However, we have encountered an issue when SMB traffic is involved. When SMB protocol communication occurs, the network connection occasionally becomes unresponsive or appears to stall when peekOutboundBytes is set to a large value.

Through testing, we observed the following behavior:

On some systems, reducing the peekOutboundBytes value allows SMB communication to proceed normally.
On other systems, even relatively small values can still cause the SMB connection to stall.
This behavior appears inconsistent across different macOS environments.

Because of this, we would like to clarify the following:

Is there a documented or recommended maximum value for peekOutboundBytes when using NEFilterNewFlowVerdict.filterDataVerdict?
Are there any internal limits or constraints within NetworkExtension that could cause SMB traffic to stall when the peek buffer size is too large?
Are there best practices for selecting appropriate peekInboundBytes / peekOutboundBytes values when filtering high-throughput protocols such as SMB?

If necessary, we can provide additional information such as macOS version, test environment details, and logs.

Thank you for your assistance.

Best regards, sangho

Boost

Answer 1

DTS Engineer OP

Apple

10h

This isn’t the first time I’ve seen reports of this. See this thread.

Unfortunately something I failed to drive that thread to a conclusion )-: so I’m going to use your thread to continue the issue.

In that thread I suggested that the developer tweak their filter to return .allow(), purely as a diagnostic test to see whether the problem is fundamental to content filters or something specific to the filter working on the SMB stream. They indicated that it’s the latter. Do you concur?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0