General: Forums subtopic: App & System Services > Networking TN3151 Choosing the right networking API Networking Overview document — Despite the fact that this is in the archive, this is still really useful. TLS for App Developers forums post Choosing a Network Debugging Tool documentation WWDC 2019 Session 712 Advances in Networking, Part 1 — This explains the concept of constrained networking, which is Apple’s preferred solution to questions like How do I check whether I’m on Wi-Fi? TN3135 Low-level networking on watchOS TN3179 Understanding local network privacy Adapt to changing network conditions tech talk TCP and UDP ports used by Apple software products support article Understanding Also-Ran Connections forums post Extra-ordinary Networking forums post Foundation networking: Forums tags: Foundation, CFNetwork URL Loading System documentation — NSURLSession, or URLSession in Swift, is the recommended API for HTTP[S] on Apple platforms. Moving to Fewer, Larger Transfers forums post Testing Background Session Code forums post Network framework: Forums tag: Network Network framework documentation — Network framework is the recommended API for TCP, UDP, and QUIC on Apple platforms. WWDC 2025 Session 250 Use structured concurrency with Network framework — This is a great introduction to the new Network framework API introduced in appleOS 2026. Building a custom peer-to-peer protocol sample code (aka TicTacToe) Implementing netcat with Network Framework sample code (aka nwcat) Configuring a Wi-Fi accessory to join a network sample code Moving from Multipeer Connectivity to Network Framework forums post NWEndpoint History and Advice forums post Wi-Fi (general): How to modernize your captive network developer news post Wi-Fi Fundamentals forums post Filing a Wi-Fi Bug Report forums post Working with a Wi-Fi Accessory forums post — This is part of the Extra-ordinary Networking series. Wi-Fi (iOS): TN3111 iOS Wi-Fi API overview technote Wi-Fi Aware framework documentation Building peer-to-peer apps sample code WirelessInsights framework documentation iOS Network Signal Strength forums post Network Extension Resources Wi-Fi on macOS: Forums tag: Core WLAN Core WLAN framework documentation Secure networking: Forums tags: Security Apple Platform Security support document Preventing Insecure Network Connections documentation — This is all about App Transport Security (ATS). WWDC 2017 Session 701 Your Apps and Evolving Network Security Standards [1] — This is generally interesting, but the section starting at 17:40 is, AFAIK, the best information from Apple about how certificate revocation works on modern systems. WWDC 2025 Session 314 Get ahead with quantum-secure cryptography Available trusted root certificates for Apple operating systems support article Requirements for trusted certificates in iOS 13 and macOS 10.15 support article About upcoming limits on trusted certificates support article Apple’s Certificate Transparency policy support article What’s new for enterprise in iOS 18 support article — This discusses new key usage requirements. Prepare your network environment for stricter security requirements support article — This is primarily of interest to folks developing management software, for example, an MDM server. Technote 2232 HTTPS Server Trust Evaluation Technote 2326 Creating Certificates for TLS Testing QA1948 HTTPS and Test Servers Miscellaneous: More network-related forums tags: 5G, QUIC, Bonjour On FTP forums post Using the Multicast Networking Additional Capability forums post Investigating Network Latency Problems forums post Share and Enjoy — Quinn “The Eskimo!” @ Developer Technical Support @ Apple let myEmail = "eskimo" + "1" + "@" + "apple.com" [1] This video is no longer available from Apple, but the URL should help you locate other sources of this info.

I applied on the Multicast Networking Entitlement Request site, but I did not receive a response email. How long does a response usually take?

Hello, I am investigating a roaming network selection use case on iPhone and would like to know whether Apple provides any supported API, entitlement, carrier capability, or carrier-specific integration that allows an application or a mobile network operator to access or control PLMN selection while roaming. My specific use case is: Device: iPhone 17 iOS: 26.6.1 Home operator: Orange France Roaming country: Switzerland Automatically selected roaming network: Salt Preferred roaming network: Swisscom At this location, Salt has very poor cellular coverage while Swisscom has excellent coverage. The user can manually select Swisscom through: Settings → Cellular → Network Selection → Swisscom I would like to determine whether there is any supported mechanism for a carrier or a carrier-authorized application to: Read the currently selected roaming PLMN. Obtain the available roaming PLMNs. Programmatically select a specific PLMN. Configure a preferred roaming PLMN. Ask the modem to prefer one roaming partner over another. Access any carrier-only/private entitlement that provides such functionality. For example, could an authorized Orange carrier application or carrier integration request that Swisscom (MCC 228 / MNC 01) be preferred over Salt (MCC 228 / MNC 03) while roaming in Switzerland? I understand that Core Telephony provides access to some carrier information and that certain capabilities require Apple-granted entitlements. If this functionality is not available to third-party applications, is there a carrier integration, carrier configuration, SIM/eSIM profile mechanism, or other Apple-supported mechanism that can influence the preferred roaming PLMN? I am specifically looking for a supported solution and not a jailbreak or other unsupported/private API. Thank you.

I am developing an iOS application for carrier network testing and diagnostics, and I need to access the following cellular, carrier, subscriber, and device information: RSRP RSRQ SINR RSSI PCI Cell ID LTE/5G Band EARFCN / NRARFCN Carrier name Country code MCC MNC Mobile/subscriber number IMEI Enable/Disable/connect wifi Enable/Disable hotspot Insert/update/delete e-sim I understand that some or all of this information is not available through Apple’s public iOS APIs. My question is: If I request Apple’s Interoperability Access or a carrier-related entitlement for an application developed specifically for carrier network testing and diagnostics, can these APIs/data become available? If yes, could someone please clarify: Which of the above data points can be accessed with carrier-related entitlements? Which specific entitlements or APIs are required? Are RSRP, RSRQ, SINR, RSSI, PCI, Cell ID, Band, and EARFCN/NRARFCN available through any Apple-approved entitlement? Can carrier information such as carrier name, MCC, MNC, and country code be accessed? Is mobile/subscriber number accessible? Is IMEI accessible with a carrier entitlement? Is there a specific Apple WWDR/Interoperability request process for these requirements? This is for a legitimate carrier testing/diagnostics application. I would appreciate any clear guidance on what is technically possible on current iOS versions and which Apple approval/entitlement process I should follow.

I have a watchOS app on a cellular Apple Watch (Series 11, watchOS 26.6) that periodically uploads small HTTPS payloads to a backend. It needs to keep working when the paired iPhone is absent and the watch is on its own cellular connection. What I observe: Foreground, no phone, cellular: uploads work. Background, no phone, cellular-only (no Wi‑Fi): nothing uploads for hours. The instant the watch joins Wi‑Fi (app still in background): the whole backlog flushes at once via my background URLSession. My questions: Is a background URLSession transfer over cellular ever expected to run without Wi‑Fi (e.g. while charging), or is Wi‑Fi effectively required in practice? Any configuration that improves the odds? 2. During an active HKWorkoutSession (which keeps the app executing), will a high-level URLSession data task reliably complete over cellular with the phone absent? And is using a workout session to keep a non-fitness background uploader alive acceptable, or is there a sanctioned alternative? 3. Is there any other supported mechanism for periodic background cellular upload from a phoneless watch that I'm missing? Any help would be greatly appreciated. Thank you!

We ship a consumer VPN app on iOS, iPadOS and tvOS using a Personal VPN configuration: NEVPNManager with NEVPNProtocolIKEv2, EAP-MSCHAPv2, no MDM profile installed. After exactly 120 seconds with no traffic, iOS destroys the Child SA and disconnects the tunnel. I would like to know whether that timer is configurable, and if not, what the intended mitigation is. From a device sysdiagnose (iPhone, iOS 26.6, build 23G71): NEIPSecDBStatsUpdate: SA is idle for past 120 secs KernelSASession[1, IKEv2 Session Database] idle timeout SA Internal SAID = 2 SPI = C53320D1 Direction = Outbound ChildSA[1] state Connected -> Disconnected error Domain=NEIKEv2ErrorDomain Code=15 "IdleTimeout" <NEIKEv2Provider: Primary Tunnel>: stopping tunnel since Child disconnected nesessionmanager: plugin disconnected with reason "Tunnel was idle for too long" This happened 12 times across a 9.2 hour overnight capture on one idle device. Median time before the tunnel re-established was 14m35s. DISCONNECT-ON-IDLE IS NOT ENABLED The same sysdiagnose shows the plugin's own configuration as: disconnectOnIdle = NO disconnectOnIdleTimeout = 0 These are the stock defaults. There is no disconnectOnIdle property on the public NEVPNProtocol, so a Personal VPN app cannot set them either way. The installed SA parameters contain no idle field at all, only "Lifetime Seconds = 1800", which is honoured correctly: the same capture shows 20 clean rekey cycles. WHAT I HAVE RULED OUT iOS logs a distinct stop reason for each of the following, and none of them occurred across 24 teardowns: "On Demand Disconnect rule matched", "Tunnel was terminated by the server", "Server is not responding", "Network changed, tunnel no longer viable", "Device went to sleep", "Stop command received". The only reason recorded was "Tunnel was idle for too long". On the gateway (strongSwan), IKE rekey and reauth are disabled, uniqueids is never, and DPD is answered in roughly 200ms right up to the teardown. The gateway considers the tunnel healthy at the moment iOS tears it down. DPD does not reset the timer, which makes sense: DPD is an INFORMATIONAL exchange on the IKE SA, whereas the log shows the timer measuring the OUTBOUND Child SA (SAID 2). THE APP CANNOT SEE THIS HAPPEN NEVPNConnection.fetchLastDisconnectError() returns nil for this teardown, because the error is in NEIKEv2ErrorDomain rather than NEVPNConnectionErrorDomain. The app has no supported way to detect that the tunnel dropped for this reason, or to distinguish it from a user-initiated disconnect. It is only visible in a sysdiagnose. TRAFFIC IS NOT HELD DURING THE RECONNECT With Connect On Demand enabled (NEOnDemandRuleConnect, interfaceTypeMatch .any), traffic after the teardown does not wait for the tunnel. On device wake following one of these drops: 01:32:43 device wakes 01:32:43 [C331 ... :443] path:satisfied @0.001s, interface: en0[802.11], uses wifi 01:32:44 [C331 ... :443] flow:finish_connect @0.623s (over en0) 01:32:47 tunnel status changed to connected so flows complete over the physical interface for several seconds before the VPN re-establishes. On-demand triggered the reconnect but did not delay the traffic. For a VPN product this window is the part that concerns me most. QUESTIONS Is the 120 second Child SA idle timeout configurable for a Personal VPN using NEVPNProtocolIKEv2, from the app or from a configuration profile? If DisconnectOnIdle / DisconnectOnIdleTimer are meant to control it, why does the teardown occur when they are NO / 0? If it is not configurable, is application-generated keepalive traffic the intended workaround? If so, how is that expected to work while iOS has the app suspended, which is exactly when a tunnel goes idle? Would server originated traffic that elicits a client response be a supported approach? Is there any supported way for an app to be notified of this teardown, given that fetchLastDisconnectError() returns nil for it? Is the behaviour in "traffic is not held during the reconnect" expected for NEOnDemandRuleConnect, or should matching flows be delayed until the tunnel is up? Is includeAllNetworks the only supported way to close that window? Happy to supply the full sysdiagnose privately.

For a given instantiation, is the Instance object passed to each method of NWProtocolFramerImplementaion the same? If that includes the initializer, why do the other methods still want it?

I am developing an iOS app that uses Core NFC to communicate with an ISO 14443 / ISO 7816 smart card. For security reasons, I would like to minimize or temporarily prevent other external communications while an NFC read/write session is active. My questions are: Is there any supported iOS API or entitlement that allows an app to temporarily disable or block Wi-Fi, cellular, or Bluetooth communication while a Core NFC session is active? If device-wide communication cannot be controlled by a third-party app, is there a supported way to guarantee that the app’s own process performs no network communication during that NFC session? Does Apple recommend any architecture or security practice for implementing an offline-only Core NFC read/write operation? The NFC communication itself must remain available during the operation. Thank you.

I have written a small Python program that needs to continuously listen on port 2237. The packets are received from one program, which I will call P1. There is also another program, P2, that receives commands from P1. Both P1 and P2 use port 2237. My problem is that when I start my Python script, it successfully receives data from P1, but it fails to receive data from P2. The functionality only works again after I stop my program. The Python script for receiving the packets is: def run(udp_port: int): logger.info("Starting listener on port %d", udp_port) client = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP) client.setsockopt() client.bind(("", udp_port)) while True: data, addr = client.recvfrom(4096) src_ip, src_port = addr logger.debug("Received %d bytes from %s:%d", len(data), src_ip, src_port) hexdump(data, logging.DEBUG) try: payload = parse_message(data) if payload is not None: logger.info("%r", payload) except Exception as e: logger.error("Failed to parse header: %s", e) Does anyone know what the root cause of this issue is, and how we can fix it?

I have written a small Python program that needs to continuously listen on port 2237. The packets are received from one program, which I will call P1. There is also another program, P2, that receives commands from P1. Both P1 and P2 use port 2237. My problem is that when I start my Python script, it successfully receives data from P1, but it fails to receive data from P2. The functionality only works again after I stop my program. The Python script for receiving the packets is: def run(udp_port: int): logger.info("Starting listener on port %d", udp_port) client = socket.socket(socket.AF_INET, socket.SOCK_DGRAM, socket.IPPROTO_UDP) client.setsockopt() client.bind(("", udp_port)) while True: data, addr = client.recvfrom(4096) src_ip, src_port = addr logger.debug("Received %d bytes from %s:%d", len(data), src_ip, src_port) hexdump(data, logging.DEBUG) try: payload = parse_message(data) if payload is not None: logger.info("%r", payload) except Exception as e: logger.error("Failed to parse header: %s", e) What could be causing this conflict? Is there a known issue where an active UDP listener process interferes with two other applications (P1 and P2) communicating on the same port? Any ideas or suggested workarounds would be helpful!

Hello, I am working on network traffic analyser for DLP. The solution is based on NETransparentProxyProvider due to necessity data modifying. To my knowledge, the Transparent Proxy API does not have a concept of an "asynchronous/delayed verdict" for flow authorization. The handleNewFlow(_:) method appears to be invoked sequentially for each new network flow that matches our interception rules. The challenge we are facing is that a portion of our proxy rules and configurations resides in a LaunchDaemon, which the Network Extension communicates with via XPC. Such separation is required by our cross-platform code base. Thus, we are forced to make a synchronous XPC call within handleNewFlow(_:) and block the thread while waiting for the interception verdict from the daemon. This creates a significant bottleneck when establishing new network flows. The current implementation works without issues, but we are always looking for ways to improve performance. Are there any best practices or recommended approaches for parallelizing handleNewFlow(_:)? Thank you in advance.

Filing this as a public thread to try to get DTS attention, similar to how thread 821372 (skmem_slab_free_locked double-free) got resolved - accumulated cross-referenced reports there are what got that one fixed in 26.5/26.6. Panic signature (identical every time): panic(cpu N caller 0x...): m_copym_with_hdrs n 0x... copy overflow @uipc_mbuf.c:3268 My own occurrences: 5 panics over 2 days on a MacBook Pro (Mac16,7 / M4 Pro), macOS 26.5.2 build 25F84, kernel Darwin 25.5.0 (xnu-12377.121.10~1/RELEASE_ARM64_T6041). Filed as Feedback Assistant report FB24343421 (5 panic logs + a full sysdiagnose attached). Why this looks like a generic kernel bug, not app-specific: I initially suspected a third-party VPN NetworkExtension (Tailscale) since it appeared in the full stackshot of every one of my panics. Ruled that out: That NE is a userspace-only component - cannot execute kernel code. Two other reporters have hit the identical panic string via completely different, unrelated paths: One reproduced it with no VPN/tunnel software running at all (engine stopped, sysext idle) - see FB24333740, cross-referenced at https://github.com/tailscale/tailscale/issues/20864 Another hit the same panic string on an Intel Mac via a third-party Ethernet kext, no VPN/utun involved at all - https://github.com/SongXiaoXi/AppleIGC/issues/34 So this reproduces through at least 3 independent producer paths (a NetworkExtension, no tunnel software at all, and a third-party Ethernet driver), which points to something generic in the TCP send path (tcp_output -> m_copym_with_hdrs) rather than anything specific to one app or extension. Known non-workarounds: net.inet.tcp.tso=0 does not avoid the code path (checked against the last public xnu source drop). No sysctl or config change has stopped recurrence for anyone who's tried. Related public reports: https://github.com/tailscale/tailscale/issues/20864 https://github.com/tailscale/tailscale/issues/20612 https://github.com/SongXiaoXi/AppleIGC/issues/34 FB24333740 (independent Feedback Assistant report, same signature) FB24343421 (mine, this thread) Still reproducing on the latest public release (26.6.1 / 25G76) per the other reporters. Happy to provide more diagnostics - this is easy to reproduce on my end, roughly every few hours to once a day under normal use.

I’m working on an open-source React Native library for Wi-Fi Aware / NAN: https://github.com/dcavalcante/react-native-wifi-aware The Android implementation has already been physically validated for capability detection, discovery, follow-up messaging, and data paths. The Apple implementation is in place and passes the current simulator/static compilation gates, but I don’t currently have the Apple hardware and Developer Program setup needed to validate it on physical devices. I’m looking for someone with an Apple Developer account and preferably two iOS/iPadOS 26 devices who can help test: Wi-Fi Aware entitlement/signing declared WiFiAwareServices publish / subscribe discovery system pairing Apple-to-Apple connectivity Android ↔ Apple discovery and interoperability The biggest unknown I want to validate is the cross-platform path between Android Wi-Fi Aware and Apple’s iOS 26 implementation. Testing results, fixes, documentation, and implementation contributions are all welcome.

Hi Everyone, We are tinkering on an App using associated domains with the working name "uff2.de". We have configured our Webserver (Caddy) to restrict all URIs except for /.well-known/apple-app-site-association using Www-Authenticate. Recently our associated domains started becoming flaky, which we believe has to do with requests from Apple’s CDN failing: The following example uses a query string to trigger a fresh request by Apple’s CDN. curl -sD - "https://app-site-association.cdn-apple.com/a/v1/uff2.de?foobar" -o /dev/null HTTP/1.1 404 Not Found Server: AppleHttpServer/7b3d349ae60c243cdd677edbde3e93e460f75820 Date: Sat, 05 Sep 2026 12:01:16 GMT Content-Type: text/plain; charset=utf-8 Content-Length: 10 Apple-Failure-Details: {"cause":"Connection timed out"} Apple-Failure-Reason: SWCERR00301 Timeout Apple-From: https://uff2.de/.well-known/apple-app-site-association Apple-Try-Direct: true Cache-Control: max-age=3600,public Vary: Accept-Encoding X-B3-TraceId: 457b6172513a930f Strict-Transport-Security: max-age=31536000 Age: 32 Via: https/1.1 defra2-vp-vst-018.ts.apple.com (acdn/331.16659), https/1.1 defra2-vp-vfe-016.ts.apple.com (acdn/331.16659), https/1.1 gbslo5-xdc-mx-020.ts.apple.com (acdn/331.16659), https/1.1 uklon5-edge-fx-024.ts.apple.com (acdn/331.16659) X-Cache: miss, miss, miss, miss CDNUUID: df5ac203-4188-4722-8bbc-68e9d9fd0b33-1118024500 Connection: keep-alive To investigate this further we enabled access logging and are seeing the following request that is blocked by us: 2026/09/05 12:01:16.824 INFO http.log.access.log0 handled request {"request": {"remote_ip": "57.103.82.202", "remote_port": "48366", "client_ip": "57.103.82.202", "proto": "HTTP/1.1", "method": "GET", "host": "uff2.de", "uri": "/apple-app-site-association", "headers": {"User-Agent": ["AASA-Bot/1.0.0"], "Accept-Encoding": ["gzip"]}, "tls": {"resumed": false, "version": 772, "cipher_suite": 4865, "proto": "", "server_name": "uff2.de"}}, "bytes_read": 0, "user_id": "", "duration": 0.000083782, "size": 0, "status": 401, "resp_headers": {"Server": ["Caddy"], "Alt-Svc": ["h3=\":443\"; ma=2592000"], "Www-Authenticate": ["Basic realm=\"restricted\""]}} But this seems to be the wrong URI (/apple-app-site-association instead of /.well-known/apple-app-site-association). When swapping ?foobar for other query strings like ?foobar2 or ?foobar3, some requests randomly work and some don’t. We’re also seeing flakiness for the same path (both with and without a query string) across time, but this is harder to test due to caching. For reference this is a correct request: 2026/09/05 17:54:26.075 INFO http.log.access.log0 handled request {"request": {"remote_ip": "57.103.81.17", "remote_port": "8692", "client_ip": "57.103.81.17", "proto": "HTTP/1.1", "method": "GET", "host": "uff2.de", "uri": "/.well-known/apple-app-site-association", "headers": {"User-Agent": ["AASA-Bot/1.0.0"], "Accept-Encoding": ["gzip"]}, "tls": {"resumed": false, "version": 772, "cipher_suite": 4865, "proto": "", "server_name": "uff2.de"}}, "bytes_read": 0, "user_id": "", "duration": 0.000088472, "size": 469, "status": 200, "resp_headers": {"Accept-Ranges": ["bytes"], "Content-Length": ["469"], "Server": ["Caddy"], "Alt-Svc": ["h3=\":443\"; ma=2592000"], "Vary": ["Accept-Encoding"], "Etag": ["\"dgrdbiykgv3ad1\""], "Content-Type": [], "Last-Modified": ["Sun, 01 Mar 2026 10:19:41 GMT"]}} Did we misread the documentation and should also serve /apple-app-site-association? Why would requests sometimes be made to /.well-known/apple-app-site-association and sometimes to /apple-app-site-association? Thank you!

Inquiry) A Linux-based embedded device is connected to an iPhone using a USB-C cable. The device operates as a USB device and presents a standard CDC-ECM Ethernet interface. The iPhone operates as the USB host. When the iPhone screen is on: 以太网接口被正确识别。 分配IPv4和IPv6地址。 互联网接入正常。 大约在 iPhone 被锁定 30 秒后，USB 连接进入暂停状态，以太网数据传输停止。 我们启用了USB远程唤醒。定期触发它有助于保持以太网接口的可用，当 iPhone 屏幕开启时网络会恢复。然而，屏幕关闭时以太网数据仍然无法保持活跃状态。 问题） 这在iOS上是正常的行为吗？ 有没有支持的方法可以在 iPhone 锁定时保持 USB 以太网数据活跃？ USB远程唤醒是否支持输入网络流量？ 助理在恢复后是否需要发送任何CDC链接通知？ 这需要支持MFi还是特定的iOS权限？ 谢谢。

I heard that the Network framework can help using networking with Swift concurrency. I read up on "NWConnection," which uses a DispatchQueue. I was wondering how queues fit together with concurrency, then I heard about a related class, "NetworkConnection." I realized that the new class is in the same module, but introduced for macOS 26. I saw the WWDC25 video about it, but it assumed that I already knew about its result-builder connection setup. I don't; was it introduced in an earlier video? A lot of times, I find a web article soon after some WWDC that explains how to actually a new API. The problem is that the class' name is un-Google-able, being two actual words concatenated together that can reasonably be found together. Does anyone have a link of a post-WWDC25 article explaining NetworkConnection?

I’m building a SwiftUI app that fetches public JSON data using URLSession.shared. The request works correctly in the iPhone 17 Pro Max Simulator, but fails on my physical iPhone 16 Pro Max running iOS 27 beta. Endpoint: https://api.jolpi.ca/ergast/f1/2026/driverstandings.json?limit=100 Error: NSURLErrorDomain Code=-1009 “The Internet connection appears to be offline.” NWPath: unsatisfied (Denied over Wi-Fi interface) Resolved 0 endpoints in 1ms The device can access the endpoint through Safari, and the same request works in Simulator. VPN, cellular permissions, Wi-Fi changes, and ATS settings have been checked. Could this be an iOS 27 beta networking regression affecting URLSession on physical devices? Are there recommended workarounds or diagnostics?

Hello, I have encountered unexpected behavior when running a Network Extension that implements NETransparentProxyProvider. This extension is part of a DLP (Data Loss Prevention) solution. If the "Auto proxy discovery" option is enabled for the Wi-Fi connection on the managed host, the leaks tool reports memory leaks with the following root cycles: ... 11 (1.03K) ROOT CYCLE: <CFRunLoopSource 0xa430cc540> [192] 10 (864 bytes) ROOT CYCLE: <std::__shared_ptr_emplace<PAC::PACClient> 0xa430f4000> [224] CYCLE BACK TO <CFRunLoopSource 0xa430cc540> [192] 6 (400 bytes) ROOT CYCLE: <std::__shared_ptr_emplace<PAC::PACQuery> 0xa43118080> [128] 2 (80 bytes) ROOT CYCLE: 0xa42ca9000 [32] 1 (48 bytes) ROOT CYCLE: <__NSMallocBlock__ 0xa42804de0> [48] CFNetwork invocation function for block in PAC::PACClient::initialize(void const*, __CFURL cons..." 1 (32 bytes) ROOT CYCLE: <std::__shared_ptr_pointer<BlockHolderVar<__CFString const*, __CFData const*, std::shared_ptr<__CFArray const>, std::shared_ptr<__CFError>>*, SmartBlockWithArgs<__CFString const*, __CFData const*, std::shared_ptr<__CFArray const>, std::shared_ptr<__CFError>>::Deleter> 0xa4343da80> [32] 2 (160 bytes) <NSURL 0xa42840310> [112] 1 (48 bytes) _clients --> <CFString 0xa42c08fc0> [48] 1 (160 bytes) <NWConcrete_nw_pac_resolver 0xa4280cb40> [160] 1 (48 bytes) <CFError 0xa42804ed0> [48] 1 (32 bytes) <std::__shared_ptr_pointer<__CFError*, Deleter_CFRelease> 0xa4343dc20> [32] ... 11 (1.03K) ROOT CYCLE: <CFRunLoopSource 0xa43128540> [192] 10 (864 bytes) ROOT CYCLE: <std::__shared_ptr_emplace<PAC::PACClient> 0xa430f4a80> [224] CYCLE BACK TO <CFRunLoopSource 0xa43128540> [192] 6 (400 bytes) ROOT CYCLE: <std::__shared_ptr_emplace<PAC::PACQuery> 0xa43118880> [128] 2 (80 bytes) ROOT CYCLE: 0xa428105e0 [32] 1 (48 bytes) ROOT CYCLE: <__NSMallocBlock__ 0xa428887b0> [48] CFNetwork invocation function for block in PAC::PACClient::initialize(void const*, __CFURL cons..." 1 (32 bytes) ROOT CYCLE: <std::__shared_ptr_pointer<BlockHolderVar<__CFString const*, __CFData const*, std::shared_ptr<__CFArray const>, std::shared_ptr<__CFError>>*, SmartBlockWithArgs<__CFString const*, __CFData const*, std::shared_ptr<__CFArray const>, std::shared_ptr<__CFError>>::Deleter> 0xa4343f5c0> [32] 2 (160 bytes) <NSURL 0xa428424c0> [112] 1 (48 bytes) _clients --> <CFString 0xa42c0a640> [48] 1 (160 bytes) <NWConcrete_nw_pac_resolver 0xa4280d7c0> [160] 1 (48 bytes) <CFError 0xa42888390> [48] 1 (32 bytes) <std::__shared_ptr_pointer<__CFError*, Deleter_CFRelease> 0xa4343f4c0> [32] ... The extension creates an nw_connection_t to the remote host for each handled flow like this: nw_parameters_t parameters = nw_parameters_create_secure_tcp(NW_PARAMETERS_DISABLE_PROTOCOL, NW_PARAMETERS_DEFAULT_CONFIGURATION); nw_endpoint_t connectTo = nw_endpoint_create_host([endpoint.hostname UTF8String], [endpoint.port UTF8String]); nw_connection_t connection = nw_connection_create(connectTo, parameters); When "Auto proxy discovery" is disabled, everything works as expected, and no memory leaks or issues are observed. Could you please advise on how to resolve or work around this issue? Thank you in advance!

I've been investigating memory consumption issues with a network extension. It seems as though the "leak" exists within the network extension framework. Looking at a memory graph, there appears to be a _socketFlows dictionary or similar in the network extension framework that holds all of the flows and they continue to pile up and consume memory. The problem seems to be particularly bad when I leave my MacBook plugged in and running over the weekend and come back on Monday. For instance, in that time period, the memory consumption grew from <100MB to >1GB. To try to narrow this down to see if it was an "us" problem or truly in the framework, I installed Objective-See Foundation's Lulu tool, which also uses a network extension. It similarly saw memory grow from around 30MB or less to 600MB in the same time frame. Has anyone else seen this? We do have an open feedback ticket FB18731867 that might be related that has to do with seeing multiple instances of the same data filter provider started and maybe running in a network extension.

We are developing a consumer digital wellbeing app and are evaluating an optional feature that deliberately slows network traffic when explicitly enabled by the user. The proposed architecture is: NEPacketTunnelProvider device wide traffic no MDM or per-app VPN no remote VPN server packet processing/forwarding performed locally on device no application layer inspection no traffic profiling or advertising use no network data uploaded to our servers bounded latency/bandwidth shaping only user can disable it immediately The goal is user controlled “intentional bandwidth” rather than security, privacy filtering, circumvention, or remote VPN access. I’d like to clarify: Is NEPacketTunnelProvider an appropriate public API for this kind of local device wide bandwidth pacing? Is it supported to consume packets via packetFlow, process/forward them locally, and send them to the public Internet without a remote VPN endpoint? Is intentional bandwidth/latency shaping considered an acceptable use of the Network Extension entitlement? Would this still be treated as a “VPN service” for App Review purposes even though no traffic is routed through a remote VPN service? If so, would the organization-enrollment requirement for VPN apps apply? Is there another public API Apple recommends for this use case? I understand that the App Review questions may ultimately need to be answered by App Review rather than the forums. My main goal here is to validate whether this is a supported NetworkExtension architecture before investing in the packet processing implementation.