10 ms·

Conntrack is Linux specific. Are you aware of any macOS analogs?

• toast0 6y ago
  MacOS supports pf (search for OpenBSD pf) and ipfw firewalls, both of which can do stateful firewalls. Be advised, the Mac tcp stack is mostly taken from 2001 FreeBSD, with MPTCP added later, maybe they put in path mtu probing changes from after the initial import, not sure. It was taken before the syncache and syncookies, and definitely doesn't have any of the other major scalability improvements FreeBSD has made over time in the last 20 years. Parts of the firewall code are broken (or were broken in past releases), and there's not really any body of internet knowledge about what parts actually work. I guess that makes it a good system to play on, because if you try something and it doesn't work, it's a good idea to go spelunking through the code, because there's a good chance it's broken. OTOH, it'll be depressing to see how long it's been broken for, how long it's been fixed upstream, and how likely it is to be fixed in future mac os releases (probably never). All that said, Apple's TCP stack does better on iOS than Android, because Apple enabled and tweaked path MTU probing, so if you're on a dumb network with MTU set too large and ICMP blocked, iOS send smaller packets pretty quickly and your connections will work, Android ships with probing disabled, so it just sends big packets that get dropped until the connection times out.