thank you for your answer and I have one more question when i try to load a network extension(data filter) i stuck at the request to system, system didn't finish my request, send a user prompt or something. i use "systemextensionctl list" , found that corresponding extension was in "validating by category" status.

and i check the system log: 2024-03-13 17:40:13.468430 +0800 sysextd waiting for external validation of extension with identifier com.a.ExtsLoadTestTool.HNetDataFltExt 2024-03-13 17:40:13.470535 +0800 nesessionmanager Validating system extension com.a.ExtsLoadTestTool.HNetDataFltExt 2024-03-13 17:40:13.517456 +0800 sysextd returning cdhash for local arch arm64 of extension com.a.ExtsLoadTestTool.HNetDataFltExt how to solve this problem?

Have solved this problem by creating a new project...

Hello. Sorry, i can't recurrent this problem. i have delete the old project. all i remember is that in log output the log above appeared about every ten seconds. In addition, the old project is actually the SampleEndpointApp and I add a data filter network extension target to it. now i create a new project and everything works well.

oh, I SEE. What type of flow did you get this value from? i didn't know to check the protocol type with NEFilterSocketFlow at that time... and now I try to decode TCP Header, the result looks better by including the initial 4 bytes. so when Data have a protocol type with TCP/UDP, it does not have a 4-byte attr field?

it seems that in the case of tcp, readBytes only contains the data of upper layer, i have retrieve http packet when I access a website. and one flow corresponds to one TCP connection. so in the whole process of accessing a website the request i send and the response i get all belongs to that flow with direction attribute set to outbound(i just got confused about i didn't get any inbound flow before). hope i'm not making any mistake this time?

as you can see in main post, I'm doing char conversion(wchar_t to char, char to wchar_t).After conversion, I have problem to comparing and outputing strings containing non-ASCII characters with C++ api(cause the original project is ported from Windows). actually, it's just solved today by using completely C api. but for myself, I'm confused and curious about this "locale" thing.