@zwass possibly. I'm specifically interested in socket events for starters, which I want to match up with a system that's monitoring network traffic. in some cases, a delay is fine. but there's a part of the system that tracks flows and forgets about them after the flows are closed, so for socket events that are for short-lived flows, i might not be able to match these up