27

Recently I've noticed that internet speeds on my MBP 2018 (Mojave 10.14.4) are decreasing with time. For example, after a day it will go from 100 MB to 60 MB and it will continue to decrease. The plot below shows download speeds sampled every 15 minutes over the course of ~3 days.

enter image description here

A few things:

  • This is not my ISP, since it works perfectly on other devices.

  • After restarting the computer, it goes back to the maximum speed and countdown starts again.

  • It is both for wi-fi and ethernet.

  • Logging out and back in doesn't fix the issue.

  • There is no software that runs in the background and utilizes that bandwidth.

  • Network diagnostics don't show anything.

  • Trying iperf between Mac and PC over Ethernet and WiFi, gives same low numbers as on Mac. Speedtest on PC is OK.

  • Running Speedtest from Parallels Ubuntu VM also yields low download speeds.

  • For Ethernet, I am using Belkin HD dock.

Would appreciate any help or guidelines on how to debug this issue.

jojek
  • 322
  • 3
  • 10
  • From where are you measuring the transfer speed, inside or outside your network? – Allan May 09 '19 at 09:30
  • That would be inside. Computer is connected directly to the router via Ethernet. – jojek May 09 '19 at 09:31
  • So, you’re transferring a file from one computer on your network to another on the same network and measuring the performance? Also what dongle/adapter are you using? – Allan May 09 '19 at 09:35
  • Aaaah, sorry - I misunderstood your question. I am testing the speeds externally. Using `speedtest` in command line and running the `cron` job every 15 minutes. – jojek May 09 '19 at 09:37
  • It’s an interesting thing to try - transferring data between devices in the internal network. – jojek May 09 '19 at 09:40
  • 2
    There is a utility called [iPerf](https://apple.stackexchange.com/a/348841/119271) that can assist. Install it on your Mac and another computer and rerun the tests. I this way we can isolate to down to the least number do components – Allan May 09 '19 at 09:41
  • 1
    The reason I’m recommending it, is 1) to isolate your router from the equation and 2) account for threat based firewalls (wherever you’re connecting to) that automatically throttle bandwidth based on behavior. I don’t know either is happening but I can’t disprove it either. – Allan May 09 '19 at 09:45
  • I just run the `iperf` between Mac and another PC connected through Ethernet. Speeds are also low (same ballpark as on the plot I attached), which suggests that there is something wrong with the network layer in my Mac. Speedtest on PC gives same high speeds as on iPad, etc. – jojek May 09 '19 at 10:04
  • I would look at the Ethernet adapter at this point. Can you try a different one? – Allan May 09 '19 at 10:22
  • I am afraid not, it’s from Belkin HD dock. BTW, I also tried `iperf` over WiFi and it gives slow speeds. I tested it next to the router and Tx Rate reported by network widget gives 702 mbps. – jojek May 09 '19 at 10:25
  • Does this happen when you are on other networks, or only at home? – Harv May 11 '19 at 01:06
  • It is independent of the location. – jojek May 11 '19 at 22:01
  • Have you tested the connection in a brand new user account? – benwiggy May 12 '19 at 17:49
  • This is what I've been doing since this morning. So far it's good but I will have to leave it overnight. – jojek May 12 '19 at 17:50
  • 1
    The same happens with my MBP (13", early 2015 model). All I can do to up the network performance, is rebooting. – ShutterFreak May 15 '19 at 09:33
  • @ShutterFreak: Does the PulseSecure solution work in your case as well? – jojek Jul 01 '19 at 14:15
  • 1
    I updated the Pulse VPN client and the bandwith problem was gone. – ShutterFreak Dec 06 '19 at 18:22

4 Answers4

15

In my case this was caused by the Juniper/Pulse Secure VPN client's kernel extension, which was active even when not connected to the VPN. Unloading the kernel extension restored speed without a reboot.

Short term fix is to unload the extension, command copied from linked kb article:

sudo kextunload /Library/Extensions/PulseSecureFirewall.kext

Long term solution is to upgrade pulse secure client. I was experiencing this problem with pulse secure 9.0.3(1599). I upgraded to 9.0.3(1667) and the kext is no longer loaded by default. I can connect to the vpn without the kext loaded, and speed is no longer tailing off. Solved!

With pulsesecurefirewall.kext loaded: with pulsesecurefirewall.kext loaded Without pulsesecurefirewall.kext loaded: without pulsesecurefirewall.kext loaded

If your VPN security policy requires "Lock Down Mode" or "Traffic Enforcement", you may need to downgrade instead of upgrade the client.

For future reference, you can view loaded non-apple kexts with:

kextstat |grep -vi com.apple

Edit: What is a kernel extension? A kernel extension is a program that runs within the macOS kernel. Running within the kernel can give performance improvements for certain applications, and also access to APIs that aren't available to normal (user space) programs.

In this case, the pulse client included a kernel extension which provides firewall functionality by inspecting packets as they pass through the kernel. The provided extension is buggy and performance drops over time (maybe it keeps a list of something, and as that list grows, the length of time taken to scan the list increases, so the time to process a packet increases, leading to a drop in throughput??)

Unloading the kext removes the buggy code from the kernel, so that it doesn't affect performance.

Hugh Saunders
  • 449
  • 5
  • 11
  • 2
    Now that is amazing because I have the PulseSecure installed on this laptop! What is more impressive is the fact that it actually worked! Thank you so much Hugh! – jojek Jun 27 '19 at 16:56
  • 1
    Wow, it actually works. PulseSecure was my issue too. Can you explain what unloading the extension does? – Someguywhocodes Jul 01 '19 at 10:26
  • @Someguywhocodes Added a note about kernel extensions – Hugh Saunders Jul 02 '19 at 07:36
  • 1
    Holy Mother of God! The company I left years ago is still hunting me with the leftovers of those crappy BigCorp tools. I hope they going to rot in hell for that. No I hope they are forced to use this crappy tools in all eternity in an open space office! – Vad1mo Sep 09 '19 at 13:10
  • 1
    For me this was PdaNet, a tethering app. `sudo kextunload /Library/Extensions/PdaNetDrv.kext` and I'm back to 300/300 from 15/10 yay! – daknowles Apr 17 '21 at 00:36
3

As you've found, troubleshooting is a process of elimination and often requires patience. You've already done an excellent job of trying to get to the bottom of this, but there's a few things you haven't mentioned trying as part of your troubleshooting process.

1. Bootup into Safe Mode

I'd boot up into Safe Mode for a day. Not only can you test to see if the problem is replicated in Safe Mode, but the very act of booting into Safe Mode will run some checks, delete system cache files, verify your startup disk, and attempt to repair directory issues (if any are identified).

Follow these steps to boot your Mac into Safe Mode:

  1. Fully shut down your MBP
  2. Restart your MBP
  3. Immediately press the Shift key and keep it down
  4. Let go of the Shift key when you see the login window (NOTE: If you have FileVault enabled you may need to log in twice).
  5. Take a note of what happens (i.e. use your Mac for a day and see if your internet speeds drop over time)
  6. Exit Safe Mode to restart your Mac
  7. Test your Mac again to see if the behaviour has changed

If the Mac maintains speeds during Safe Mode, but not again afterwards, let me know.

2. Reset your NVRAM

It may be worth resetting your NVRAM. For your model MBP you'll need to follow these steps:

  1. Fully shut down your MBP
  2. Press the power button and then press the commandoptionpr keys. You have to make sure you press these keys before the gray screen appears or it won’t work.
  3. Hold those keys down until your Mac reboots again (i.e. wait until you've seen the Apple logo appear and disappear twice before letting go of the keys)
  4. Let go of the keys and let your MBP reboot normally.

Note: When you log back in you may need to readjust some of your system preferences (e.g. speaker volume, screen resolution, startup disk selection, time zone information, etc).

Test to see whether this has made any difference to your problem.

3. Create a new user account

If 1 and 2 above do not resolve the issue, create a new user account.

  1. Create a new user account
  2. Reboot your Mac as normal
  3. Log into the new account and use it for a day
  4. Determine if there's been a gradual drop over time in your internet speed

After doing the above, report back on what happens.

Monomeeth
  • 63,349
  • 14
  • 147
  • 188
1

In case it helps anyone: I was running into a similar problem with a 2017 MacBook Pro but found a different solution... download speeds on other devices (iPhones, newer MBP) were steady around 500-750 Mbps down, but on my 2017 MBP the speeds would gradually slow down until they were anywhere from like 5-10 Mbps, sometimes even <1 Mbps, all tested using fast.com and Vodafone's speed testing service. After restarting either the router or the 2017 MBP, download speeds were back to normal on the 2017 MBP. However, the speed would gradually decrease again until it was (relatively) super slow.

I put quite a bit of time into troubleshooting: tried looking in the "Network" tab of Activity Monitor to see if anything was hogging bandwidth, uninstalling VPNs, closing all applications one at a time, using a different browser, etc. Nothing seemed to work. Restarting the computer worked well but is time-consuming and pretty disruptive to workflow, so ultimately I decided to try restarting just the networking using the following terminal commands:

networksetup -setairportpower en0 off
networksetup -setairportpower en0 on

For me at least, this works to bring normal speeds back. It takes like 15-20 seconds total (opening terminal, copying/pasting the code, waiting for wifi to reconnect), and I know it's not technically fixing the problem... but it's better than nothing and most importantly won't waste any more time troubleshooting. Hope it can help someone else too.

9585868
  • 61
  • 2
0

Similar to Hugh Saunders's answer, I was using VPN that worked differently which does not use kext extension.

In my case, I figured out the VPN was the cause because killing the VPN's background process restored the network speed.

Quitting the VPN app did not stop the background root privilege process, so in order to shut it down completely I had to figure out its pid(process id) by ps -ef | grep (VPN Provider name) and then kill it by sudo kill -9 (pid).

After that, my network speed from speedtest increased from 80Mbps to 330~400Mbps.

So I decided to uninstall that, and fortunately the provider had uninstall instruction that completely removed related files.

ik1ne
  • 452
  • 4
  • 13