I'm able to reproduce the problem with the SimpleFirewall example. When following the procedure described in the ticket: UDP traffic is never seen. TCP traffic is seen. As far as I can tell, the issue is with incoming UDP traffic. I tried with a binary where the Apple signature was removed, I tried different ports.

It's actually more what is not seen. TCP traffic is seen by the handleNewFlow method/function. UDP traffic is not. Ref. https://feedbackassistant.apple.com/feedback/16846115

OK. I will file a feedback assistant ticket to at least get the minimum one line sentence in the online documentation. BTW, the Comment feature (popup window icon) is broken at the time of this writing. Filing another feedback assistant ticket about this.

OK but then is it expected for a NEFilterSocketFlow to have the following properties: direction = outbound protocol = 255 (IPPROTO_RAW) family = 2 (PF_INET) type = 3 (SOCK_RAW) localEndpoint = 0.0.0.0:0 remoteEndpoint = not.a.local.ip:0 ?