The Berkeley Packet Filter

The Berkeley Packet Filter (BPF) is a part of macOS that lets privileged processes capture and inject network traffic on any network interface. It was made for analyzing network problems, with tools like tcpdump or Wireshark.

Despite its name, BPF does not filter the data that goes in or out of your Mac. That’s what firewalls do. The “filter” is about analysis: networks carry huge amounts of data, and a debugging tool is usually interested in only a small part of it. So BPF lets the tool describe that part in a small script, the filter program. Processes get access to BPF through pseudo-devices in the file system: /dev/bpf0, /dev/bpf1, …, /dev/bpf255.

What relevance does BPF have for Little Snitch?

Besides capturing traffic, BPF lets a process inject data packets at the network interface. A privileged app that opens a BPF device can send any data packet to any address. The packet goes straight into the network interface layer and bypasses all firewalls on the Mac, so Little Snitch can’t see it.

Because Little Snitch can’t filter these packets, it controls access to the /dev/bpf devices instead. When a process opens a /dev/bpf device, Little Snitch treats this like a network connection and applies your rules for BPF. If no rule allows or denies the access, Little Snitch shows a connection alert.

How is BPF related to Endpoint Security?

To control access to file system objects such as /dev/bpf, Little Snitch needs an Endpoint Security system extension. With this extension, macOS asks Little Snitch each time a process opens a file. To install it, choose Little Snitch > Settings > Advanced > Install System Extension….

Why is Endpoint Security a separate installation?

Controlling access to BPF devices comes at a price:

You must allow a second system extension in System Settings > General > Login Items & Extensions.
You must give Full Disk Access to “Little Snitch Endpoint Security” in System Settings > Privacy & Security > Full Disk Access.
Your Mac gets slightly slower, because Little Snitch takes part in every operation that opens a file.

At the same time, when Little Snitch 7.0 was released, there was no known malware that uses BPF to bypass firewalls. That’s why we made this an optional installation.

Should I install Endpoint Security?

That depends on what you use Little Snitch for. If you mainly want to protect your privacy, for example with blocklists against trackers, you don’t need to worry about BPF and can skip the extra complexity. But if you use Little Snitch to catch new, unknown malware, you want to control every possible way out, and then the installation is worth it.