Is a `flowClosed` report guaranteed when the owning process exits or crashes?

App & System Services Networking
dylandylandylan OP
Created
Replies 1
Boosts 0
Views 61
Participants 2

Our macOS NEFilterDataProvider sets shouldReport = true on flow verdicts and receives NEFilterReport.Event.flowClosed in handle(_:). In testing, we have observed close reports after the owning process exits or crashes, sometimes with a short delay.

Is a flowClosed report guaranteed for every TCP and UDP flow in these cases? Does the behavior differ by protocol, and is there a documented upper bound on delivery time?

We also set statisticsReportFrequency = .low. Does that setting affect only periodic .statistics reports, with no effect on flowClosed delivery?

Replies  1
Boosts 0
Views  61
Participants  2
DTS Engineer OP
Apple

I would expect .flowClosed events to occur regardless of how the flow closes.

Written by dylandylandylan in 855509021

is there a documented upper bound on delivery time?

No.

What sort of delays are you seeing?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"