API for intercepting network traffic

Question

Can someone give a hint by which the API could intercept internal and outgoing network traffic , such as Little Snitch on Mac OS X ?

Cocoa based API is supported.

Is it necessary to write kext , or is it somehow permitted - a user application can also do the job?

Answer 1

I do not know how Little Snit does it (but I would like ...); I used these dTrace probes:

# The socket accepts by process name:

dtrace -n 'syscall :: accept *: entry {@ [execname] = count (); } '

# :

dtrace -n 'syscall:: connect *: entry {trace (execname); ustack(); } '

# :

dtrace -n 'tcp: accept-installed {@[args [3] → tcps_raddr, args [3] → tcps_lport] = count(); } '

( "DTrace: Oracle Solaris, Mac OS X FreeBSD Brendan Gregg Jim Mauro, Prentice Hall 2011" http://www.dtracebook.com/index.php/Network_Lower_Level_Protocols.)

DTraceToolkit: http://www.brendangregg.com/dtrace.html#DTraceToolkit

, tcpsnoop tcptop.