Skip to main content

Resolving Network Issues with FileWave Server or Boosters on macOS when using Carbon Black EDR Extension

What

FileWave has observed network issues when the Carbon Black EDR (Endpoint Detection and Response) system extension isand network filter are installed on a FileWave serverServer or boosterBooster running on macOS. The issuesmost common symptom is that the Booster stops responding, which can manifest as Boosters stopping to answer or respond, leading to disruption ininterrupt device managementcheck-ins workflows.and content delivery.

When/Why

The issue occurs when thereThis is amost likely to appear under high volume of network traffictraffic, andwhere the Carbon Black EDRnetwork extensionfilter is insertedinspecting intotraffic on the networksame stack.macOS Thesystem extension'sthat presenceis inserving theFileWave networkclients. stackThat seemscombination tocan causecreate performance issues, which can result in networkor connectivity andproblems communicationfor problems.FileWave services.

How

If you experienceFileWave network issues withbegin FileWaveafter whenCarbon Black EDR is installed on the same macOS Server or Booster, check whether the Carbon Black EDRsystem extension isand installed,network youfilter canare resolve the problem by removing the extension from the FileWave server or booster. This solution has been proven to resolve the issue in multiple cases.active. On a macOS system, you canmacOS, use the followingthis command in Terminal.app to list all kernel extensions:app:

systemextensionsctl list

The output will appear like this:

--- com.apple.system_extension.endpoint_security
enabled    active    teamID    bundleID (version)    name    [state]
*    *    7AGZNQ2S2T    com.vmware.carbonblack.cloud.se-agent.extension (3.7.2fc81/3.7.2fc81)    com.vmware.carbonblack.cloud.se-agent.extension    [activated enabled]

You should checkCheck the output of this command to determine iffor the Carbon Black EDR extension isor presentnetwork onfilter. If removing or disabling the extension restores FileWave service responsiveness, work with your system.security Ifteam youand haveCarbon concernsBlack/Broadcom aboutsupport before redeploying it to the performanceFileWave ofServer theor Carbon Black EDR extension in high-volume network traffic environments, it may be worth contacting Carbon Black's support team to discuss the issue further.Booster.

Related Content

Digging Deeper

KernelModern extensionsmacOS (KEXTs)security products often use System Extensions and Network Extensions instead of older kernel extensions. Carbon Black EDR uses this model on current macOS versions so it can inspect endpoint and network activity.

That inspection can still affect network-heavy systems. FileWave Servers and Boosters handle repeated client communication and content delivery, so they are softwaremore modulessensitive thatto can beanything inserted into the macOSlocal kernelnetwork to extend its functionality. They can be used to add new features, support new hardware, or modify the behavior of existing drivers. KEXTs run in kernel mode, which means they have the highest level of privilege and can access system resources directly.

However, KEXTs can also introduce stability and performance issues. Since they run in kernel mode, they can crash the system or cause conflicts with other KEXTs. In addition, they can potentially introduce security vulnerabilities if they're not properly designed or implemented.path.

The systemextensionsctl list command is a quick way to confirm whether the Carbon Black EDR extension is anactive. exampleTreat ofthis as a kerneltroubleshooting extensionsignal, not a request to remove security tooling without approval.

If you need to exclude a FileWave Server or Booster from the Carbon Black network filter, coordinate that inserts itself into the macOS network stack. By doing so, it's able to monitor network traffic and detect security threats. However, in high-volume network traffic environments, the extension can cause performance issues, which can lead to disruptions in FileWave's device management workflows.

To manage kernel extensions on macOS, Apple provides the systemextensionsctl command. This command allows you to list, enable, disable, and uninstall extensions. If you're experiencing issues with a KEXT, you can use this command to disable or uninstall it to see if that resolves the issue.

In general, it's important to use kernel extensions with caution and only install those from trusted sources. If you're unsure whether a particular KEXT is necessary or safe to use, you should consultdecision with the vendorcustomer orsecurity seekowner adviceand fromCarbon aBlack/Broadcom subject matter expert.support.

Back to top