Hi all,
I did some experiment on user's computer, it seems that the leak might relate to netbios (UDP targeting local port 137, 138) and mDNSResponder (UDP targeting local port 5353).
Run 1: I forgot to backup the code for filtering all UDP traffic, the app retained 786 NEFilterSocketFlow instances in 30 minutes.
Run 2: When filtering everything except the traffic mentioned above, the app retained only 5 NEFilterSocketFlow in 20 minutes.
				let rules = ["0.0.0.0", "::"].map { address -> [NEFilterRule] in
						["137", "138", "5353"].map { port -> NEFilterRule in
								let localNetwork = NWHostEndpoint(hostname: address, port: port)
								let networkRule = NENetworkRule(
										remoteNetwork: nil,
										remotePrefix: 0,
										localNetwork: localNetwork,
										localPrefix: 0,
										protocol: .UDP,
										direction: .any
								)
								return NEFilterRule(networkRule: networkRule, action: .allow)
						}
				}.flatMap { $0 }
				let filterSettings = NEFilterSettings(rules: rules, defaultAction: .filterData)
It would be more precise if I do another experiment filtering everything (to compare with run 2), but I think the data above should be sufficient to isolate the problem, and that's the workaround that I've found with current NetworkExtension APIs.
Shay
