Network is Slow or Disconnects after Sensor Installed on MacOS

Products

• Carbon Black Cloud Endpoint Standard (formerly Cb Defense)
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Network is slow or disconnects entirely when MacOS is connected to Ethernet Adapter
• Connections to servers are slow or timing out
• Putting the Sensor in Bypass does not resolve the issue

Environment

• Carbon Black Cloud Sensor: 3.5.1 and Higher
• Apple MacOS: 12.3 and Lower

Cause

• The CBC Network Extension (NE) contains two content filters: a data filter and a packet filter. Enabling the NE registers both filters with the OS and the OS will then forward network activity to the appropriate filter. 
• This issue can happen as soon as the data or packet filter is enabled regardless of whether or not packets are processed.
• This issue has also been seen on Mac Studio devices

Resolution

• Networking issues have been resolved in MacOS Monterey 12.4 and MacOS 13.0. The What's new for enterprise in macOS Monterey documents the following release note: "Resolves an issue where the network becomes unresponsive using multiple Network Extensions or a Network Extension with an Ethernet adapter."
• If unable to upgrade MacOS to 12.4 or 13.0, the following may workaround the issue:
  • Use the Wifi Adapter for all network connectivity

Additional Information

• MacOS 12.3 and later require Sensor version 3.6.2. Older sensors versions will not function correctly on 12.3 and later.
• If the sensor was installed on an unsupported version of MacOS and upgraded then the sensor may need to be uninstalled/reinstalled to fix the issue.