Just Published! Threat Report: Exposing Malware in Linux-Based Multi-Cloud Environments | Download Now

Carbon Black Cloud: Network is Slow or Disconnects after Sensor Installed on MacOS

Carbon Black Cloud: Network is Slow or Disconnects after Sensor Installed on MacOS

Environment

  • Carbon Black Cloud Sensor: 3.5.1 and Higher
  • Apple MacOS: 11/Big Sur and later

Symptoms

  • Network is slow or disconnects entirely when MacOS is connected to Ethernet Adapter
  • Connections to servers are slow or timing out
  • Putting the Sensor in Bypass does not resolve the issue

Cause

  • The CBC Network Extension (NE) contains two content filters: a data filter and a packet filter. Enabling the NE registers both filters with the OS and the OS will then forward network activity to the appropriate filter. 
  • This issue can happen as soon as the data or packet filter is enabled regardless of whether or not packets are processed.

Resolution

 

Additional Notes

  • MacOS 12.3 and later require Sensor version 3.6.2. Older sensors versions will not function correctly on 12.3 and later.
  • To confirm if MacOS device is affected by this issue please do one of the following:
    • Disable Network Extension to confirm if the issue still persists. If the issue does not persist, please re-enable the Network Extension as there have been some cases where this resolves the issue. 
    • If unable to disable Network Extension, please test by uninstalling the MacOS sensor to confirm if issue persists. 
  • If issue is not resolved by uninstalling Sensor or disabling/re-enabling Network Extension then likely something else in the environment is causing network connectivity issues.

Related Content


Was this article helpful? Yes No
100% helpful (1/1)
Article Information
Author:
Creation Date:
‎01-12-2022
Views:
2637
Contributors