What is the utun interface?

What is the utun interface?

71176
Created On 01/05/21 00:37 AM - Last Modified 01/07/21 23:52 PM


Question


What is the utun interface?

Environment


  • macOS endpoints
  • GlobalProtect App 5.1.4+


Answer


A "utun" is a virtual interface created by an application on macOS endpoints to interact with the system. 

Beginning in macOS Catalina and GlobalProtect App 5.1.4 and later releases, we have replaced the pangpd kext with utun while utilizing the more modern system extension feature deployed by Apple. 

Please see the snippets below for differences in output:

(Ifconfig output while using pangpd kext)
gpd0: flags=8863<UP,BROADCAST,SMART,RUNNING,SIMPLEX,MULTICAST> mtu 1400
    ether 02:50:41:00:01:01 
    inet6 fe80::50:41ff:fe00:101%gpd0 prefixlen 64 scopeid 0x15 
    inet 10.101.100.107 netmask 0xffffffff broadcast 10.101.100.107
    inet6 fdfa:6a1c:c7b7:dec6::100d prefixlen 128 
    nd6 options=201<PERFORMNUD,DAD>


(Ifconfig output while using system extensions)
utun2: flags=8051<UP,POINTOPOINT,RUNNING,MULTICAST> mtu 1400
    inet 10.85.40.243 --> 10.85.40.243 netmask 0xffffffff 
    inet6 fe80::3af9:d3ff:fe69:1732%utun2 prefixlen 64 scopeid 0xd 
    inet6 fdae:f7e0:9f37:64::146 prefixlen 128 
    nd6 options=201<PERFORMNUD,DAD>


 
Note: Please be aware that any installed application has the ability to create a utun interface on your macOS device and this is not isolated to the GlobalProtect product. 
 


Additional Information




Actions
  • Print
  • Copy Link

    https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA14u000000HCAOCA4&lang=en_US&refURL=http%3A%2F%2Fknowledgebase.paloaltonetworks.com%2FKCSArticleDetail

Choose Language