NEFilterDataProvider seemed to perfectly meet our needs to monitor and control a Mac's network traffic, in total and by process.
But: we found out that traffic from about 50 Apple processes is excluded from being seen and controlled by NEFilterDataProvider, due to an undocumented Apple exclusion list. This is a regression from what was possible with NKEs.
We believe it has a high number of drawbacks, and we already know this is negatively affecting our end users.
I've covered all of the above in detail in FB8808172, also why other ways to monitor and control traffic are not alternatives we could consider for this scenario. I'd appreciate if someone at Apple could have a look as soon as possible.
But: we found out that traffic from about 50 Apple processes is excluded from being seen and controlled by NEFilterDataProvider, due to an undocumented Apple exclusion list. This is a regression from what was possible with NKEs.
We believe it has a high number of drawbacks, and we already know this is negatively affecting our end users.
I've covered all of the above in detail in FB8808172, also why other ways to monitor and control traffic are not alternatives we could consider for this scenario. I'd appreciate if someone at Apple could have a look as soon as possible.