Find Active Internet Connection Using libpcap Mac

Question

I'm trying to monitor packets for current active internet connection using pcaplib. But I'm not sure how can I find current active internet connection. I know pcap_findalldevs() will return list of available net devices. but user might use en0, en1 or even a VPN Connection over them. I was wondering how can I find current internet connection and how can I be notified when it changes?

Answer 1

There's nothing in OS X (or in many other operating systems) that's explicitly an indication of which interface is the "current Internet connection".

The closest thing would be the interface for the default route; there is code that could do that, but it's a bit complicated.

A somewhat easier way that would probably give the right answer in most if not all cases would be to take the output of pcap_findalldevs() and look for the first interface that has an AF_INET or AF_INET6 address (don't just look for the first interface that has any address, as, in OS X and *BSD, that could include link-layer addresses) and doesn't have PCAP_IF_LOOPBACK set.