Although I haven't tried on iOS -- this was for macOS.

I haven't tried it yet, but NWPathMonitor / nw_path_monitor_t look promising.

grrrr apple did not email me despite this thread being marked as watched.

That is beautiful code.

I should clarify myself -- I have no problem with that! I often tend to use very, very precise working to make sure that what I'm saying is not confused for something else.

Hm, maybe that wasn't. I changed it to subclass NETransparentProxyProvider, and my handleNewFlow method isn't being called at all. And all networking (even a ping I started beforehand) dies. Hm hm hm hm.

Ah! THAT WAS IT! In one of my test programs, I was using NETransparentProxyProvider, but in this one I wasn't. That explains why I got confused between the behaviour I saw, the documentation that I read, and what I expected! You rock, my person.

As I said, "I was just hopeful someone had already saved me a bit of work." It's mostly gruntwork; any cleverness is in how you handle IPv4 and IPv6, and how you handle adding TCP, UDP, ICMP, etc., on top of those.