macBook Pro – Troubleshooting Slower Internet Speed Over Time on macOS

internetmacbook promacosNetwork

Recently I've noticed that internet speeds on my MBP 2018 (Mojave 10.14.4) are decreasing with time. For example, after a day it will go from 100 MB to 60 MB and it will continue to decrease. The plot below shows download speeds sampled every 15 minutes over the course of ~3 days.

enter image description here

A few things:

  • This is not my ISP, since it works perfectly on other devices.

  • After restarting the computer, it goes back to the maximum speed and countdown starts again.

  • It is both for wi-fi and ethernet.

  • Logging out and back in doesn't fix the issue.

  • There is no software that runs in the background and utilizes that bandwidth.

  • Network diagnostics don't show anything.

  • Trying iperf between Mac and PC over Ethernet and WiFi, gives same low numbers as on Mac. Speedtest on PC is OK.

  • Running Speedtest from Parallels Ubuntu VM also yields low download speeds.

  • For Ethernet, I am using Belkin HD dock.

Would appreciate any help or guidelines on how to debug this issue.

Best Answer

In my case this was caused by the Juniper/Pulse Secure VPN client's kernel extension, which was active even when not connected to the VPN. Unloading the kernel extension restored speed without a reboot.

Short term fix is to unload the extension, command copied from linked kb article:

sudo kextunload /Library/Extensions/PulseSecureFirewall.kext

Long term solution is to upgrade pulse secure client. I was experiencing this problem with pulse secure 9.0.3(1599). I upgraded to 9.0.3(1667) and the kext is no longer loaded by default. I can connect to the vpn without the kext loaded, and speed is no longer tailing off. Solved!

With pulsesecurefirewall.kext loaded: with pulsesecurefirewall.kext loaded Without pulsesecurefirewall.kext loaded: without pulsesecurefirewall.kext loaded

If your VPN security policy requires "Lock Down Mode" or "Traffic Enforcement", you may need to downgrade instead of upgrade the client.

For future reference, you can view loaded non-apple kexts with:

kextstat |grep -vi com.apple

Edit: What is a kernel extension? A kernel extension is a program that runs within the macOS kernel. Running within the kernel can give performance improvements for certain applications, and also access to APIs that aren't available to normal (user space) programs.

In this case, the pulse client included a kernel extension which provides firewall functionality by inspecting packets as they pass through the kernel. The provided extension is buggy and performance drops over time (maybe it keeps a list of something, and as that list grows, the length of time taken to scan the list increases, so the time to process a packet increases, leading to a drop in throughput??)

Unloading the kext removes the buggy code from the kernel, so that it doesn't affect performance.