nsurlsessiond - what is this and why does it use alot of data?

Question

Level 1

6 points

nsurlsessiond - what is this and why does it use alot of data?

Hello

Firstly

I was in a public library, uploading to my dropbox account, and all of sudden my network speed indicator/ montior showed heaps of download and fast too.

but i was not downloading anything.

I was upping to my dropbox account.

In activity monitor i noticed this service was operating "nsurlsessiond"

What is this service?

In my connection alert it tells me nsurlsessiond tried to establish a connection to apple-dnld.vo.llnwd.net on TCP port 80 (http)

---

Secondly, i was using my own wifi, and saw this nsurlsessiond service consuming heaps of data. Again I was upping to my dropbox account. About 1gb this time.

---

Now I have blocked communciation to "nsurlsessiond"

What is the impact of blocking such communication?

please see details of service in screenshot

---

Now after this experience, I am wondering is it apple policy to have communication from our macbook's to somwhere without us knowingly allowing it? I thought apple was respective of our privacy, or has this changed?

thankyou for your help and time.

regards

10.10.2

dropbox v3.4.4

macbook pro

Message was edited by: seaseasea added screenshot

Message was edited by: seaseasea added device and osx

MacBook Pro (13-inch Mid 2010), OS X Yosemite (10.10.3), null

Posted on Apr 29, 2015 7:56 PM

Reply

Answer 1

seaseasea Author

Level 1

6 points

May 5, 2015 3:01 PM in response to seaseasea

Forgot to mention:

OSX Activity Monitor for some odd reason is now opening on reboot, although the dock setting is not to open on login.

I have verified

Docked Item Option is OFF for Open at Login
Activity Monitor is not in listed under Login Items in System Preferences/Accounts.
Activity Monitor was closed before I shutdown

No idea why.

Please see screenshot, docked Activity Montior icon settings.

Reply

Answer 2

seaseasea Author

Level 1

6 points

May 5, 2015 2:43 PM in response to Linc Davis

Hello Linc,

Thankyou for your time and effort. I have been busy troubleshooting. It appears this surge of network activity (and data transfer) from this process, nsurlsessiond.. was the start of my MacBook pro starting to have performance Issues.

I noticed these performance issues when I was using Pathfinder, Dropbox Sync or OSX Mail. For example, my file transfers (move) between mac and my external over local home WIFI is very good. Often many GB at a time. Then I had this transfer for 30000 files but only 130mb in size that took 10hrs! I stopped it 3 times, to try and get a better transfer rate, then just let it run thru the night. It completed.

So something is not happy for my macbook, I have concluded.

Action Taken

Mac OSX
1. Checked the Console Logs, and heaps of items mentioning de.novamedia... nmnetmgrd.. launch2net.. These all related to a vodafone USB installed app for the USB mobile broadband that never worked. So uninstalled and deleted via terminal anything related to this. Followed Sleep - OS X 10.6.8
2. Remembered by MacBook for the first time has been forced into sleep mode as I was on free wifi and ran out of battery. When I rebooted it did not do it correctly (both times) as the Clock was not set correctly. Well my setting is for check on internet time asia, but when I rebooted I had no internet, so silly think does not remember the date from before loosing power. I connected to internet and fixed this. Recurring issue. My setting for power is never allow this computer to sleep as wierd things happen with returning from Sleep Mode so I no longer trust it.
3. Checked Console Logs, and many many system logs that show event, wakeups (microstackshots only). No idea what this means.
4. Checked Console Logs, and had heaps for opendirectoryd (Apple's Directory Services). LIke it was so busy writing these logs..there were many. I checked Apple Support Forum and essentially I got the message, some node, is out of whack.. and my lovely MacBook cannot find something first try. So I popped into Disk Utility and ran Verify Permissions (there were like 5 to repair, so clicked Repair) and the other check routine (?Verify Disk). Received the all good. So no sure how this node thing.. happened.. if its still there...
5. Then I remembered I had downloaded so new utility OSX Apps and there were many so had created a sub-directory under Applications/Utilities. So this is non-standard. Removed this and moved all the Apps under /Applications
Email App -- I rebuild my Email mailbox (option in OSX email, Rebuild). Not sure if it works, but I tried. Next step, will see if I can delete entire mailbox off macbook and simply resync to Gmail. it is 5GB, 1 mail account, many many folders and many emails.
Dropbox Sync App -- In reading the Apple Forums, I read, often Dropbox Sync is the problem for this enormous amount of log activity. Then I remembered I upgrade to v3.4.4 for Dropbox Sync very recently. And these issues only started recently. And then I had a crash and crash report is called, garcon_2015-05-05-144442_computername.crash. And then somehow when I was trying to fix another dropbox issue (dropbox-daemon runs on seedbox and links to same Dropbox Account that is sync to macbook), I managed to unlink the Dropbox Account to Dropbox Macbook. So I relinked and everything looked ok, but maybe i messed it all up... Sadly Dropbox Support dont respond and no replies in forum either... (Maybe too popular).
PathFinder (File Browser App) -- Send 2 sample process to App Support of Pathfinder. Awaiting

So now, current settings regarding connections allowed/blocked

Allowed (stopped blocking) nsurlsessiond, but I do not like how it uses data on my mobile broadband. If Apple need to check something, I really prefer they give me option, to check while on WIFI as mobile broadband is so expensive. or if they need to check on a public WIFI, they ask as I do not want to be downloading stuff that I do not realise on a public WIFI. I also see this nurlissueID using data is an issue for others (What is Apple's fix for the nsurlsessiond issue of uploading data and hogging bandwidth?). So I have used the Feedback link to inform Apple, and when I am on mobile broadband block connections I try to remember to block nsurlsessiond manually.
Blocking the other one mentioned in post, mapspushd, as it errks me all this location information about me being transmitted. I don't use maps

Console under Library/Logs/Crash Reporter, I am seeing many for com.apple.networking.discoveryd.log, that I dont know what means. I recently added the app, MacFusion and it is having trouble with time-out before authenticates me, although passcode correct. So maybe it has something to do with this.

May 6 07:19:00.359020 localhost discoveryd_helper[258]: Basic RemoteControl com.apple.discoveryd_helper Starting XPC Server

May 6 07:19:00.359535 localhost discoveryd_helper[258]: Detailed RemoteControl com.apple.discoveryd_helper XPC connection 0x7f9c83d00a20: start (pid=72, <unknown> not root)

MBP fan does do its churning thing when the mac is really working and for no reason. I have not reset SMC yet, as in prior times before FRESH install of yosemite osx, this I ddi and nothing improvement. To reset SMC, I follow Resetting the System Management Controller (SMC) on your Mac - Apple Support
I do not know where else to troubleshoot, so I wait and check the Console for unusual logs. This is all I can think off.

I need to have Dropbox Sync running alot in next few 3 days. So I will record times.

Any other suggestion of next troubleshooting steps? Any particular log to log-out for in Console?

Reply

Answer 3

Apr 30, 2015 3:35 AM in response to seaseasea

Hi,

I have the same process acting weird as well as two others called "mapspushd" and "nbagent" application that say they want to connect to apple.com; however in doing so this makes the mac completely still nothing happens except pinwheel torture.

I'd like to bring attention to this thread Re: Slow start and Mac as I believe the core problem in most of these Yosemite posts is the same.

cheers

Reply

Answer 4

Jul 13, 2015 6:09 PM in response to Linc Davis

Hey Linc.

Did it not occur to you to actually answer the question asked? What is it and why does it use a lot of data? Simple enough right?

Reply

Answer 5

seaseasea Author

Level 1

6 points

Apr 30, 2015 1:07 AM in response to Linc Davis

i couldnt say. it was just that i happen to be only upping, to dropbox, and then saw downloading on the monitor.

that was triggered as odd.

i rarely look at what services are going on... only if my macbook slows down or something else odd.

in both cases i was only upping to dropbox.

i dont do alot with my macbook, other than upping to dropbox laterly.

thankyou for your thinking and help.

Reply

Answer 6

Linc Davis

Level 10

209,739 points

Apr 30, 2015 7:00 AM in response to seaseasea

When you see the activity, note the exact time: hour, minute, second.

These instructions must be carried out as an administrator. If you have only one user account, you are the administrator.

Launch the Console application in any of the following ways:

☞ Enter the first few letters of its name into a Spotlight search. Select it in the results (it should be at the top.)

☞ In the Finder, select Go ▹ Utilities from the menu bar, or press the key combination shift-command-U. The application is in the folder that opens.

☞ Open LaunchPad and start typing the name.

The title of the Console window should be All Messages. If it isn't, select

SYSTEM LOG QUERIES ▹ All Messages

from the log list on the left. If you don't see that list, select

View ▹ Show Log List

from the menu bar at the top of the screen.

Each message in the log begins with the date and time when it was entered. Scroll back to the time you noted above.

Select the messages entered from then until the end of the episode, or until they start to repeat, whichever comes first.

Copy the messages to the Clipboard by pressing the key combination command-C. Paste into a reply to this message by pressing command-V.

The log contains a vast amount of information, almost all of it useless for solving any particular problem. When posting a log extract, be selective. A few dozen lines are almost always more than enough.

Please don't indiscriminately dump thousands of lines from the log into this discussion.

Please don't post screenshots of log messages—post the text.

Some private information, such as your name, may appear in the log. Anonymize before posting.

When you post the log extract, you might see an error message on the web page: "You have included content in your post that is not permitted," or "The message contains invalid characters." That's a bug in the forum software. Please post the text on Pastebin, then post a link here to the page you created.

Reply

Answer 7

etresoft

Level 9

57,212 points

May 5, 2015 2:33 PM in response to seaseasea

seaseasea wrote:

In activity monitor i noticed this service was operating "nsurlsessiond"

What is this service?

Now I have blocked communciation to "nsurlsessiond"

What is the impact of blocking such communication?

Now after this experience, I am wondering is it apple policy to have communication from our macbook's to somwhere without us knowingly allowing it? I thought apple was respective of our privacy, or has this changed?

Hello seaseasea,

This is a system process used to perform network communication. It is used by both Apple and 3rd party software. Your system will not function properly if you disable it.

Apple only has control over its own software and any software sold through the Mac App Store. You can be reasonably confident that any software your downloaded via the Mac App Store will respect your privacy because of Apple's sandboxing architecture and review process. There is no such guarantee if you download software from outside the Mac App Store. However, this is a sensitive topic on the internet and privacy issues are usually quickly identified and corrected. This applies to both Apple itself and 3rd party software. In most cases, if you are using reputable software, there is nothing to worry about.

Reply

Answer 8

May 12, 2015 4:34 PM in response to seaseasea

Seems like this mystery is going nowhere. All that I know is that since I blocked it (in and out) with Little Snitch, it has tried to make contact 8857 times and still is trying. I see no problems arising other than periodic freezes of Safari, which may or may not be related. I am going to continue to keep it blocked until someone can explain why I shouldn't.

Reply

Answer 9

nikkormac

Level 1

118 points

Feb 23, 2016 8:59 AM in response to Glynn Wood

thankfully, etresoft did. s/he wrote:

Hello seaseasea,

This is a system process used to perform network communication. It is used by both Apple and 3rd party software. Your system will not function properly if you disable it.

Apple only has control over its own software and any software sold through the Mac App Store. You can be reasonably confident that any software your downloaded via the Mac App Store will respect your privacy because of Apple's sandboxing architecture and review process. There is no such guarantee if you download software from outside the Mac App Store. However, this is a sensitive topic on the internet and privacy issues are usually quickly identified and corrected. This applies to both Apple itself and 3rd party software. In most cases, if you are using reputable software, there is nothing to worry about.

Reply

Answer 10

Jun 2, 2016 6:31 AM in response to Linc Davis

Hello Linc Davis,

I value your opinions. So if you have the time maybe you or someone else can answer this question.

I'm having a similar problem with "mapspushed". It's always trying to connect to bunch of random chars followed by cloufront.net, for example hsfy3bysv.cloudfront.net.. I just had the address pulled up in console and did cmd+c to copy but for some reason I believe it deleted it. I am using 2 apps which are not from the app store; UnRarX and VLC. I am aware after some research cloudfront.net is basically some kind of data retrieval [usually] for third party programs to gather your information in order to sell it to marketing firms. I THINK it is fairly harmless, it just tracks buying / spending habits to then allow other companies to be able to target you better. Again I do not know if this is fact or just my opinion. From what I have read it seems as though thats what it does.

Forgive me the above is incorrect it is using SpotlightNetHelper to try and connect to that cloudfront.net address. Which is dalk4zrp4jp3q.cloudfront.net <-- this is the actual address the framework is trying to connect to. Below is where my SpotlightNetHelper.app is located. I am hoping this is the proper place.

/System/Library/PrivateFrameworks/ParsecUI.framework/Versions/A/Support/Spotligh tNetHelper.app

I am writing this post to see if this is an issue. And to also see if my operating system [El Captain 10.11.5] may be compromised?

Thank you for your time,

B

P.S | [EDIT]:*I have been using some hotspots lately, they are provided by my ISP but still make me a bit wary. Also when using these hotspots they do not work if my VPN is enabled.*

}

Reply