MacOSX: how to capture network events? Or: how does Private-Eye works?

Question

I stumbled upon Private Eye and wonder how it works.

I.e. what APIs it is using to get those information (all incoming/outcoming network connections and the application using it)?

It is installing a kext. Is that needed?

Answer 1

Developer here.

It uses a kext to catch the connections. The basic idea is to install a socket filter that gets called whenever there is a network event. The kext will then grab and store whatever information it needs, and communicate it over a kernel control socket to the userland client.

Here's Apple's great intro about making a network kernel extension. http://developer.apple.com/library/mac/#documentation/Darwin/Conceptual/NKEConceptual/intro/intro.html

Almost everything in that applies to Private Eye.