Network fault injection for testing monitors Network Link Conditioner dummynet pfctl and DNS blackhole
Parent: macOS App Testing and Release QA · Published reference · snapshot 2026-10-02
↓ Facts as markdownall context files
Source-anchored research for Network fault injection for testing monitors Network Link Conditioner dummynet pfctl and DNS blackhole. Run status: COMPLETED.
These notes link each claim to its source. Some citations identify archived research reports that are no longer hosted on this site. A published reference means the content is available; it does not certify independent review or accuracy.Read the editorial policy and follow the sources before relying on a claim.
Measurements and reference values
- NLC applies system-wide to all apps, limiting uplink/downlink bandwidth, latency and packet loss, with separate DNS delay; presets run from '100% Loss' to 'WiFi 802.11ac' plus custom profiles. It has no per-app scoping, no profile hot-swap, no auto-disable timer and no menu bar indicator. (medium confidence) [source]
- The 100% Loss preset is the simplest offline simulation for a monitor: it exercises reachability-lost and recovery paths without touching Wi-Fi or Ethernet hardware. (low confidence) [source]
- dnctl configures dummynet pipes: bw (e.g. 300Kbit/s; 0 = unlimited), delay in ms (rounded to clock ticks, typically 10 ms), plr as a float 0..1 (1 = 100% loss) and queue size (default 50 slots). (high confidence) [source]
Comparisons and alternatives
- To verify what the app will actually see, use 'dscacheutil -q host -a name <host>' rather than dig, since dig reads /etc/resolv.conf and bypasses the macOS resolution chain. (low confidence) [source]
Facts and statements
- Network Link Conditioner ships in Apple's 'Additional Tools for Xcode' download (Hardware folder, Network Link Conditioner.prefPane) and installs into System Settings; it is not bundled with the OS. (high confidence) (verified as of 2026-03-01) [source]
- Dummynet recipe on macOS: add 'dummynet-anchor ts' and 'anchor ts' to /etc/pf.conf, reload with pfctl -f, enable pf with 'pfctl -E', create a pipe with dnctl, then load rules such as 'dummynet out proto tcp from any to any port 6000 pipe 1' into the anchor with 'pfctl -a ts -f rules.txt'. (high confidence) [source]
- Dummynet rules require an explicit 'in' or 'out' direction (enforced since OS X 10.10.3), and 'pfctl -sd' (undocumented) lists dummynet rules. (medium confidence) [source]
- Teardown: 'pfctl -a <anchor> -F all' flushes only your anchor, and 'dnctl -q flush' removes pipes. Scoping to an anchor avoids dropping system pf rules. pf is disabled by default, so a harness that enables it should also restore the prior state afterwards. (medium confidence) [source]
- Per-domain DNS faults: a file /etc/resolver/<domain> redirects that domain's queries to the nameserver it names, and 'scutil --dns' shows the resulting resolver entries with reachability. Pointing the file at an unroutable address is a plausible DNS blackhole, but no source reviewed demonstrates this exact technique. (low confidence) [source]
- A forum report says pf rules were ignored by some processes (e.g. com.apple.geod, WebKit) on macOS 15.0.0-15.3.1 while 'block all' worked on 14.7.4; a DTS engineer pointed to another thread without a fix. Treat pf-based fault injection as unverified on each new macOS and smoke-test it with tcpdump before trusting results. (low confidence) (verified as of 2025-03-01) [source]
- NLC has a history of failing to load or disappearing after macOS updates; the usual workaround is moving the pane from ~/Library/PreferencePanes to /Library/PreferencePanes. (medium confidence) (verified as of 2026-03-01) [source]
Children
- No children recorded.