Thanks, we just want to make sure if this is the recommended way by Apple to track the opened socket (using filter network extension), so we proceed with our implementation.

Besides the capability enhancement, Is there another way besides content Filter to get events on new sockets?

Hi, Here is the enhancement request ID: FB13696531 Thanks