Is a `flowClosed` report guaranteed when the owning process exits or crashes?

App & System Services Networking
dylandylandylan OP
Created
Replies 2
Boosts 0
Views 88
Participants 2

Our macOS NEFilterDataProvider sets shouldReport = true on flow verdicts and receives NEFilterReport.Event.flowClosed in handle(_:). In testing, we have observed close reports after the owning process exits or crashes, sometimes with a short delay.

Is a flowClosed report guaranteed for every TCP and UDP flow in these cases? Does the behavior differ by protocol, and is there a documented upper bound on delivery time?

We also set statisticsReportFrequency = .low. Does that setting affect only periodic .statistics reports, with no effect on flowClosed delivery?

Answered by DTS Engineer in 914815022

I would expect .flowClosed events to occur regardless of how the flow closes.

Written by dylandylandylan in 855509021

is there a documented upper bound on delivery time?

No.

What sort of delays are you seeing?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

Replies  2
Boosts 0
Views  88
Participants  2
DTS Engineer OP
Apple
Accepted Answer

I would expect .flowClosed events to occur regardless of how the flow closes.

Written by dylandylandylan in 855509021

is there a documented upper bound on delivery time?

No.

What sort of delays are you seeing?

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"
dylandylandylan OP

As long as .flowClosed is reliable, we can work with the delays. We were just contemplating if we need to hook into process exits. Thanks for the confirmation.