macOS 15.0.x network problems are occuring when the Carbon Black Cloud 3.8.x sensor is runnning

Products

• Carbon Black Cloud Endpoint Standard
• Carbon Black Cloud Enterprise EDR (formerly Cb Threathunter)

Issue/Introduction

• Various network issues include:
  • VPN dropping connections
  • Citrix connection problems
• There are no network errors or slowness otherwise
• The problem disappears when the CBC Network Extension (NE) is disabled

Environment

• Carbon Black Cloud macOS sensor:  3.8.1.x
• Carbon Black Cloud Console: All versions
• MAC OS: 15.X

Cause

3rd party security extensions monitoring high network throughput applications, can sometimes trigger a packet ordering issue within the macOS 15 network framework, which then causes a TCP connection drops.

Resolution

We are working with Apple on a full resolution. We have seen improvements in the macOS 15.3 release and will continue to update this article as more information is available.

Additional Information

For VPN issues, a workaround is to add a bypass rule to the process. Example:

/System/Library/Frameworks/NetworkExtension.framework/**
Performs any Operation > Bypass

Note: This is just a generic example. The recommendation would be to add the full path to the exact process.