I've tested FilterDataProvider as long with its FilterControlProvider: I'm able to see traffic and to read bytes from it but I'm afraid it's not the entire traffic generated or received by my iPhone. I'm overriding all handle* functions but still, some traffic is not going there; I've even activated the flight mode to let it reconnect and create new flows. Results are different between what I see by using FilterData/Control and the app using a TunnelProvider (and more magic in it I'm trying to replicate): from that app I can see way more connections happening, and I'm trying to understand why.

Hi meaton, thanks for your reply. I'm working on a study project on my own, totally not publishing on App Store. My goal is exactly to monitor my iPhone traffic, including system applications connections: I've found few projects on App Store that are able to do that and I would like to replicate that behaviour, "If they can do it, I can do it too" approach. I read from docs that NEAppProxyProvider target a particular app: I'm going to test if I can apply this logic to a system application too, or, by only using .matchDomains, I can target particular domains and all the apps connecting to them.

Hello Quinn, thanks for all the replies about NE around the forum, really helped me a lot to understand the framework a bit more! Anyway, are SOCKS not supported still? I'm trying to figure out how to set the tunnel to use SOCKS, with no luck indeed - I managed to have a tunnel up and running but only with HTTP/HTTPS proxy, "SOCKSEnabled = NO".