Questions About utun Interfaces on macOS

Dan-MT wrote:

Looking at my routing table on my m2 mac running Sanoma shows that I have multiple default routes for IPv6 pointing to various utun interfaces (utun0, utun1, utun2, utun3). What's odd is that these multiple tunnel interfaces are active, but I dont currently have any VPN or tunneling service running.

I have had VPNs and Littlesnitch on this machine before, but they have been since uninstalled. After uninstalling them and rebooting the utun interfaces are still present in the routing table. To me this suggests that the utun interfaces are likely created by some other process or application.

I then listed the processes using utun interfaces:

sudo lsof | grep utun

rapportd 52847 myusername 6u systm 0x2e0617622496aed9 0t0 [ctl com.apple.net.utun_control id 5 unit 1]

identitys 52862 myusername 8u systm 0x5c7b17eb89dc758b 0t0 [ctl com.apple.net.utun_control id 5 unit 2]

identitys 52862 myusername 9u systm 0x5c7b17eb89dc758b 0t0 [ctl com.apple.net.utun_control id 5 unit 2]

identitys 52862 myusername 12u systm 0x8118cc17bf408943 0t0 [ctl com.apple.net.utun_control id 5 unit 3]

identitys 52862 myusername 19u systm 0xcf6a5612ab0c881b 0t0 [ctl com.apple.net.utun_control id 5 unit 4]

So it's rapportd and identityservicesd processes are using the utun interfaces?

I then ran

sudo pkill rapportd

sudo pkill identityservicesd

and rebooted.

Still, there are no VPN configs in the network preferences.

sudo ifconfig en0 down

sudo ifconfig en0 up

and then

sudo lsof | grep utun

All of the utun interfaces are still there and active.

sudo kextstat | grep -v com.apple

There are no non-Apple kernel extensions currently loaded. This confirms that third-party kernel extensions are not contributing to the presence of the utun interfaces. Not knowing what else to really troubleshoot I looked though the logs.

Summary of Findings:

Processes Involved• : The identityservicesd process is repeatedly attempting to establish control channels over utun interfaces, which are not connecting successfully, resulting in repeated timeouts and attempts.

Interfaces• : The interfaces in question include utun0, utun1, utun2, utun3, and utun4.

Error Logs• : Numerous log entries indicate socket errors (Operation timed out, Connection refused).

My questions are:1.

What exactly are utun interfaces used for on macOS?

2. Are these interfaces related to VPN or any other network-related services?

3. Is it normal to have multiple utun interfaces active?

4. Are there any potential security concerns associated with these interfaces?

Any insights or explanations would be greatly appreciated.

I have never run a VPN, nor your Liittle Snitch

by comparison— this is what I see when I execute your command above:

"utun" is a virtual interface created by an application on macOS endpoints to interact with the system

you can try rebooting your machine.

ref: https://forums.developer.apple.com/forums/thread/682767