How can I track down the process that started a VPN interface on Catalina?

The direct answer to my question:

Track down the process by gathering more information

scutil --nwi

Network information

IPv4 network interface information
  ipsec0 : flags      : 0x5 (IPv4,DNS)
           address    : 10.6.4.48
           VPN server : X.X.X.X
           reach      : 0x00000003 (Reachable,Transient Connection)

Check PIDs of network connections to VPN server and find parent PID

lsof -i | grep -E "X.X.X.X"

NEIKEv2Pr  **942** todd    7u  IPv4 0x6816df6181c68875      0t0  UDP 192.168.0.32:ipsec-msft->X.X.X.X:ipsec-msft

ps -l 942 | grep -v grep

UID   PID  PPID        F CPU PRI NI       SZ    RSS WCHAN     S             ADDR TTY           TIME CMD
  502   942     **1**     4004   0  31  0  5007340   8496 -      Ss                  0 ??         0:00.46 /System/Library/Frameworks/NetworkExtension.framework/PlugIns/NEIKEv2Provider.appex/Contents/MacOS/NEIKEv2Provider

PID 1 belongs to launchd in this case...now on to my next problem of finding the service responsible for launching this NEIKEv2 process..any help is welcome although I'll most likely have to start a new thread.

How can I track down the process that started a VPN interface on Catalina?

Related

Recent Posts