netbiosd cpu usage > 100% after appproxy sys extension restarted

Question

richard_wang OP

Created Feb ’22

Replies 5

Boosts 0

Views 2.7k

Participants 4

Hi there,

This was realised during the test. That is: When we use appproxy to filter all udp traffics with netbiosd running, and observe netbiosd cpu usage with Activity Monitor. Then if we just restart the appproxy (just kill the sys extension process is fine). After system extension process is re-spawn, you will find that netbiosd cpu usage boosts to above 100%.

Tried as well to put netbiosd related udp port (137, 138 and 139) as excludedNetworkRules, but doesn't help.

How to reproduce:

Start netbios service by

isudo launchctl load -w /System/Library/LaunchDaemons/com.apple.netbiosd.plist

Start appproxy application (with wrapper process and system extension process). Setup in includedNetworkRules filtering all udp outbound traffics.
Just kill appproxy system extension process so that the wrapper process will spawn a new system extension process.
Observe from Activity Monitor cpu usage of netbiosd, you will find that it is above 100% then.
It makes no difference even if you put in excludedNetworkRules all netbiosd related ports including 137, 138 and 139 (tcp and udp).

Thanks in advance for any suggestion.

Regards Richard

Boost

Answer 1

Systems Engineer OP

Apple

Feb ’22

I would open a bug report for this with a sysdiagnose. Please respond back with the Feedback ID.

Matt Eaton
DTS Engineering, CoreOS
meaton3@apple.com

0

Answer 2

richard_wang OP

Feb ’22

Thanks Matt for the suggestion. Submitted TSI 9915482 and uploaded system diagnosis via Feedback Assistant.

0

Answer 3

AbhilashJaiswal OP

Jul ’22

Hello Matt I have been experiencing the exact same issue in Monterey(12.4). Can you let me know what is the fix/workaround for this issue ?

0

Answer 4

DTS Engineer OP

Apple

Jul ’22

Well, I’m not Matt but I’ll take a stab at this anyway (-:

I looked through the records for FB9915482 and there’s not much to say here. We believe that this is a bug. The OP filed a bug about it but there’s no sign of a fix. We’re not aware of any reasonable workaround.

Share and Enjoy
—
Quinn “The Eskimo!” @ Developer Technical Support @ Apple
let myEmail = "eskimo" + "1" + "@" + "apple.com"

0

Answer 5

Systems Engineer OP

Apple

Jul ’22

One more thing that may be related; in some cases this issue was only observed after killing and restarting the Network System Extension process multiple times and only doing this a few times did not have an affect. I believe this was a result due to test the system extension so I suspect that this would not come up as part of an every day field use-case.

0