These flows are delivered to your extension off of a queue assigned specifically to the network criteria your network extension is claiming to filter on. Since these flows can be delivered off of this queue in very close proximity (I doubt this would ever be in parallel) it is usually recommended in Network Extensions to plan for a lot of processing to take place in handleNewFlow. However, since you are working with a NEFilterDataProvider and are most likely wanting your users to approve flows, there may be a need to halt traffic until a flow is approved. In this case it makes sense to process these flows one at a time.
Check out an example of this in the
Filter Network Traffic sample.
Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com