28 November 2018
ifconfig is a venerable tool that’s been around since 2008, according to the manpage on macOS. If you have a recent device, you’ll discover a much larger number of devices than on Linux.
Here’s the simplified output from my computer.
$ ifconfig | sed -E 's/[[:space:]:].*//;/^$/d' | sort VHC128 XHC0 XHC1 XHC20 ap1 awdl0 bridge0 en0 en1 en2 en3 en4 en5 gif0 lo0 p2p0 stf0 utun0 utun2 utun3
Let’s walk through them individually.
lo0 is the loopback interface. This is used for the machine to refer to itself.
gif0 is the software network interface.
stf0 is the IPv6 to IPv4 interface.
gif0 is a tunnel interface for IPv4 to IPv6.
p2p0 is airdrop.
en0 is the WiFi interface.
en1 through en4 are the Thunderbolt interfaces, first through fourth.
bridge0 is the Thunderbolt bridge. typically for transfering files over cable between two Macs.
awdl0 is the Apple Wireless Direct Link, typically used for Hotspot functionality with iOS devices and your Apple computer.
ap1 is probably related to the above but I can’t confirm.
en5 is iBridge adapter for the TouchBar.
utunN are related to the sharing of information between devices on the same iCloud account. They can also be created by any VPN interfaces you’ve added.
XHC20, XHC0, XHC1, and VHC128 are something I’ve never seen before with an ifconfig output. I assume they are related to USB controllers. Let’s look at the IOUSB registry plane for more details.
$ ioreg -p IOUSB +-o Root [...] +-o AppleUSBVHCIBCE Root Hub Simulation@80000000 [...] +-o AppleUSBXHCI Root Hub Simulation@14000000 [...]
Here we can see two virtual USB hub simulators.
On the first, a simulated virtual USB Host Controller Interface, we can see many iBridge devices connected, including the display, ambient light sensor, camera, microphone, keyboard/trackpad, and something called a DFR brightness. The closest related acronym I could find was digital feedback reducer. In any case, all the Apple devices are exposed via this virtual USB hub. The address of the AppleUSBVHCIBCE is 128 so that explains the VHC128 interface on the ifconfig output.
On the second, an eXtensible Host Controller Inteface (HCI) for Universal Serial Bus (USB), will show any devices you have connected via the ports on your Mac. If we dig deeper into the AppleUSBHostController,
$ ioreg -w0 -rc AppleUSBHostController
[… output truncated …]
We can see one AppleIntelCNLUSBXHCI client which shares the same PCI bus with the four AppleUSB20XHCITypeCPort clients. Furthermore, we can see two AppleUSBXHCITR , each of which having two of the AppleUSB30XHCITypeCPort class, likely the USB 3.0 controllers. Important to note is that the addresses of the clients with the AppleUSBXHCITR class: XHC1@14, XHC2@00, and XHC3@01, giving us the three devices we see in the ifconfig output: XHC20, XHC0, and XHC1, if you we take the high byte from the addresses. It’s likely the numbers after XHC are their sequential locations on the bus.
From these we can conclude that these are merely the USB debugging interfaces, both for the internal clients and external clients.
Using ioreg to dig deeper into the relationship between entities wasn’t as easy as I’m used to on Linux by using lsusb. This leads me to believe that perhaps ioreg is deprecated and there’s a better utility available or some of this information is not exposed completely in publically available tools.
In any case, knowing the source of these interfaces certainly leaves me less perturbed.