2 ms·

Someone correct my foggy experience with this - The 'tun' (tunnel) interface is user accessible, because it's creating a layer 3 packet/datagram, and programs

Someone correct my foggy experience with this - The 'tun' (tunnel) interface is user accessible, because it's creating a layer 3 packet/datagram, and programs are expected to need to be able to write these to do their job (web browsers send packets to a web server; email clients send packets to a mail server, et cetera) The 'tap' (like a viper's fang injecting venom) interface is not user accessible. It requires a privilege escalation to perform the operation of receiving all of the layer 2 frames on a network interface. This allows the software access to greater information, and allows the reception and introduction of broadcast traffic, snooping on frames destined for other stations, and allows for a more comprehensive managing of the local network. It's been a very long time.

tenebrisalietum 5y ago
`tun` lets a user-space process send/receive Layer 3 IP packets. `tap` lets a user-space process send/receive Layer 2 Ethernet frames. Ethernet is a layer below IP, so it doesn't care about IP addresses, in the same manner that Ethernet switches don't (it cares about MAC addresses instead). If you want to do virtual switching, you'll use taps. If you need to deal with a protocol that needs to use Ethernet broadcasts, like DHCP, you'll also use taps. tap can be user accessible, it just needs to be part of a bridge (at least on Linux). The entire bridge consisting of one or more NICs will have an IP, and the individual interfaces of the bridge function like a switch.