elastic / elastic/endpoint

macOS Elastic Endpoint — enable IPv6-only connectivity to Fleet Server and Elasticsearch

Open
#107 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Swift
Stars
47
Forks
9
PR merge metrics
No merged PRs in 30d

Description

**Problem:** macOS Elastic Endpoint cannot establish outbound connections to Fleet Server or Elasticsearch when IPv6 is the only available path (AAAA DNS records and IPv6-only listeners). Elastic Agent and other integrations on the same host connect successfully. Defend stays degraded and security events are not uploaded.

**Environment:** macOS endpoints running Elastic Agent + Elastic Defend (observed on 9.4.2) against Elastic Stack 9.4, reaching internal Fleet Server and Elasticsearch ingest nodes over corporate/VPN networks that are IPv6-first or IPv6-only.

**Repro:**
1. IPv6-only DNS and services → `Could not resolve host` / `Failed to connect … port 9200` (pre-TLS)
2. Dual-stack (IPv4 A records + IPv4 listeners on Fleet/ES) → Endpoint connects; Defend recovers

**Workaround:** Maintain dual-stack — IPv4 in DNS and on Fleet Server / Elasticsearch ingest listeners.

**Request:** Support IPv6-only outbound connectivity from macOS Endpoint to Fleet Server (8220) and Elasticsearch output (9200), including:
- AAAA resolution and TCP/TLS over IPv6 (system-extension network path on macOS)
- Parity with Elastic Agent IPv6 behaviour on the same host
- Improve `elastic-endpoint test output` error messages for IPv6-only scenarios and document macOS Endpoint IPv6 support in public docs.

**Impact:** IPv6-only or IPv6-first network designs block macOS Defend telemetry while other stack components work, creating detection gaps and inconsistent cross-platform behaviour.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the IPv6-only failures to Fleet Server on port 8220 and Elasticsearch on port 9200, then inspect the macOS system-extension network path and compare it with Elastic Agent's IPv6 behavior. Use `elastic-endpoint test output` to examine diagnostics; done means successful AAAA resolution and TCP/TLS connectivity over IPv6, with clearer errors for IPv6-only failures and public documentation covering macOS Endpoint IPv6 support.

Written by the indexing model from the issue text.

Assessment

Tech stack
macos, swift
Domain
networking, operating-systems, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.