nsurlsessiond downloading nonstop in the background

[Flyview]

Well I've search and searched, lots of threads on this with no definitive solution. Let's try and get to the bottom of it. Going to list some facts below:

My system is a 16" M1 Max MacBook Pro running MacOS Sequoia 15.3.1.

I noticed the process "nsurlsessiond" is downloading something non-stop at 35-200kB/s (usually around 45kB/s).

I understand this process can be used by a variety of apps for network traffic.

Another associated process that I noticed was using up the CPU and stops the traffic when killed is:
"/System/Library/DriverExtensions/com.apple.DriverKit-AppleBCMWLAN.dext/com.apple.DriverKit-AppleBCMWLAN"

System updates auto download and auto install are disabled.

I noticed this before updating from 15.3.0 to 15.3.1. It continued after the update.

Killing nsurlsessiond stops the traffic temporarily but it restarts a few minutes later.

Killing com.apple.DriverKit-AppleBCMWLAN stops the traffic temporarily but it restarts seconds later.
Edit: That was stopping it because it reset the WiFi connection. AppleBCMWLAN controls the WiFi.

I closed down all my open apps.

I tried restarting.

I'm not signed into iCloud. I'm not even signed into Settings with my AppleID (although I am to Messages).

Here is the output of "Open Files and Ports" for nsurlsessiond:

/
/usr/libexec/nsurlsessiond
/Library/Preferences/Logging/.plist-cache.ZdXHzMpY
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsessiond/tasks.sqlite-shm
/System/Library/Frameworks/Foundation.framework/Versions/C/Resources/FoundationErrors.loctable
/private/var/db/analyticsd/events.allowlist
/usr/lib/dyld
/System/Library/Frameworks/CFNetwork.framework/Versions/A/Resources/DafsaData.bin
/usr/share/icu/icudt74l.dat
/private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/0/com.apple.LaunchServices.dv/com.apple.LaunchServices-6024-v2.csstore
/System/Library/Frameworks/CFNetwork.framework/Versions/A/Resources/Localizable.loctable
/dev/null
/dev/null
/dev/null
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsessiond/tasks.sqlite
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsessiond/tasks.sqlite-wal
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsessiond/tasks.sqlite-shm
CFECC38F-5B6B-4D77-81C5-B52ADDC61A7C[8] user-packet-pool
[ctl com.apple.netsrc id 7 unit 35]

 

[bogdanw]

nsurlsessiond is very stubborn , it doesn’t give up until it finishes the task it thinks it has to finish.
I had a similar problem with nsurlsessiond being triggered by Chrome and I ended up uninstalling Chrome completely to make it stop.
Looking at the “Open files” you posted, I think probably deleting tasks.sqlite would solve the problem.
From Terminal with Full Disk Access:

sudo find /private/var/folders -iname "tasks.sqlite*" -exec rm -f {} +

and restart.

 

[Flyview]

Before I do that, I'd love to find out what the task is. Can you help me find this "tasks.sqlite-shm"?

According to the Radio Silence app I found suggsted in another thread, nsurlsessiond is connecting to gateway.icloud.com. WTF apple I have icloud disabled and signed out. Check out some of the other processes: CloudTelemetryService? adprivacyd? ... Go to Apple for privacy they said...

 

[bogdanw]

The icloud domain is used during the update process, without having to be signed into an Apple Account.

 

[Flyview]

The icloud domain is used during the update process, without having to be signed into an Apple Account.

I don't think there's anything to update. I just updated to 15.3.1.

Where are these private folders?

Here's the output of just the find command:
sudo find /private/var/folders -iname "tasks.sqlite*"

find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/0/com.apple.ScreenTimeAgent/Store: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/0/com.apple.lockoutagent: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/0/com.apple.progressd/ClassKit: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/0/com.apple.exchangesync: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/0/com.apple.LaunchServices.dv: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/0/dmd: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/0/com.apple.nsurlsessiond: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/0/com.apple.SharedWebCredentials: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/0/com.apple.routined/dv: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/com.apple.syncdefaultsd/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/com.apple.transparencyd/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/com.apple.triald/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/com.apple.ap.promotedcontentd/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/com.apple.parsec-fbf/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/com.apple.fileproviderd/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/com.apple.nsurlsessiond/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/com.apple.chrono/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/com.apple.calaccessd/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/duetexpertd/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/com.apple.identityservicesd/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/com.apple.sharingd/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/homed/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/com.apple.quicklook.ThumbnailsAgent/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/com.apple.pluginkit/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/com.apple.donotdisturbd/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/com.apple.imagent/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/T/com.apple.imdpersistence.IMDPersistenceAgent/TemporaryItems: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/C/com.apple.siriactionsd/ShortcutsSandboxCache: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/C/com.apple.WebKit.WebContent.Sandbox: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/C/com.apple.WorkflowKit.BackgroundShortcutRunner/ShortcutsSandboxCache: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/C/com.apple.WebKit.Networking.Sandbox: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/C/com.apple.quicklook.ThumbnailsAgent/com.apple.QuickLook.thumbnailcache: Operation not permitted
find: /private/var/folders/bv/3473kr4s3wzb19kj5ytqybvw0000gn/C/com.apple.WebKit.GPU.Sandbox: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/0: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000sm00006d/C: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n000013800008t/T/com.apple.trustd/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsessiond: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/T/com.apple.nsurlsessiond/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000z000007r/0/com.apple.ScreenTimeAgent/Store: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000z000007r/0/com.apple.lockoutagent: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000z000007r/0/com.apple.exchangesync: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000z000007r/0/dmd: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000z000007r/0/com.apple.nsurlsessiond: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000z000007r/0/com.apple.SharedWebCredentials: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000z000007r/0/com.apple.routined/dv: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000z000007r/C/com.apple.siriactionsd/ShortcutsSandboxCache: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000z000007r/C/com.apple.quicklook.ThumbnailsAgent/com.apple.QuickLook.thumbnailcache: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/T/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/com.apple.WebKit.WebContent.Sandbox: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/com.apple.WebKit.Networking.Sandbox: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n00000s0000068/C/com.apple.WebKit.GPU.Sandbox: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n000012r00008p/T/com.apple.MobileAccessoryUpdater/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/0/com.apple.LaunchServices.dv: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/com.apple.mobileassetd/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/com.apple.dasd/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/com.apple.revisiond/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/countryd/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/com.apple.nehelper/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/T/com.apple.GSSCred/TemporaryItems: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/com.apple.WebKit.WebContent.Sandbox: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/com.apple.WebKit.Networking.Sandbox: Operation not permitted
find: /private/var/folders/zz/zyxvpxvq6csfxvn_n0000000000000/C/com.apple.WebKit.GPU.Sandbox: Operation not permitted

 

[bogdanw]

Make sure Terminal has Full Disk Access and try

sudo find 2>/dev/null /private/var/folders -iname "tasks.sqlite*"

I tested the delete command in a virtual machine with SIP disabled, I’ll test later with SIP enabled.

 

[Flyview]

Make sure Terminal has Full Disk Access and try

sudo find 2>/dev/null /private/var/folders -iname "tasks.sqlite*"

I tested the delete command in a virtual machine with SIP disabled, I’ll test later with SIP enabled.

Thanks for your help. It got me to enter my password and it seemingly went through. Was that supposed to create a file somewhere?

 

[Flyview]

@bogdanw are you the same person who wrote the "Macos 12/13/14 system daemon minimization" thread over on renoise.com? That's hilarious I was just about to sign up and post there to ask if you're still using it on Sequoia!

 

[bogdanw]

It got me to enter my password and it seemingly went through. Was that supposed to create a file somewhere?

I’ve tested now in Sequoia 15.3 with SIP enabled and the commands do not work.
2>/dev/null was not supposed to create a file, just ignore errors.

You could try something else: turn off Wi-Fi and reboot. That should terminate nsurlsessiond’s tasks.

are you the same person who wrote the "Macos 12/13/14 system daemon minimization" thread over on renoise.com?

I have not participated in that forum, but the script mentioned is mine and discussed here https://forums.macrumors.com/threads/macos-debloating-thread.2278758/
I have not installed Sequoia on my Macs yet, I only have virtual machines with it.
I made a version for Sequoia and has a file with descriptions of the daemons https://gist.github.com/b0gdanw/b349f5f72097955cf18d6e7d8035c665

 

[Flyview]

Wow dude thank you so much! I just stayed up way too long looking into this. I will try running your script tomorrow after I decide what to disable. I'm surprised com.apple.mediaanalysisd is not on your Sequoia list. I still see it popping up in Activity Monitor.

P.S. nsurlsessiond download traffic stops if I unplug the laptop! It's only doing it while plugged in. Would still love to find out what it's downloading if you have any ideas on how to find out.

 

[Flyview]

I wanted to update this thread after figuring out how to stop it. I carefully looked through Activity Monitor to see what else was using the CPU while nsurlsessiond was downloading and stopped after I killed nsurlsessiond. I came across these 2:

STExtractionService
mobileassetd

Killing STExtractionService (temporarily) stopped the downloading. Killing mobileassetd did not.

Under Open Files and Ports for STExtractionServices I found:

/System/Library/AssetsV2/downloadDir/com_apple_MobileAsset_Trial_Siri_SiriTextToSpeech.dc50382fca021ffc135839a7e1340df8694edc8d.auto.E35A4B3C-4147-42B3-8E7E-9F07184F410C

Deleting this folder stopped the downloading and it has not come back. I tried putting the folder back from trash and it has still not restarted, even after rebooting.

So it looks like it was Siri related. Before deleting the folder I tried enabling and disabling Siri to no effect.

 

[Flyview]

Another update

The downloading eventually resumed, even after running @bogdanw 's script to disable a lot of services. I manually disabled com.apple.mobileassetd the way the debloat script does, and that seemed to have finally fixed it... but you guessed it, it came back.

I'm at a loss now for what is triggering these asset downloads for things I don't use. I don't want the OS to download anything without asking me first.

 

[bogdanw]

Disabling com.apple.mobileassetd might break Software Update.
As you have now disabled SIP, you can try to delete the tasks.sqlite files.

 

[Flyview]

Yup I deleted the 3 database files and the problem has not returned for a couple days now. They were located at:

/private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsessiond

I had to give myself read access to the "0" folder by going to get info, unlocking with password, then changing the "Everyone" permission from no access to read only (even with SIP disabled). I opened up tasks.sqlite with DB Browser for SQLite and saw this:

The other 2 files (tasks.sqlite-shm and tasks.sqlite-wal) could not be opened as it was requesting an encryption key. Strangely enough these 2 files disappeared after trying to open them (even tried on a copy of the folder I had made). I then deleted all 3 files and left a couple other folders that were in there. The database files (and the no access permission) was recreated a few hours later, and it continues to be modified maybe once a day, but there has been no more rogue downloading to:

/System/Library/AssetsV2/downloadDir/

@bogdanw was right from the very beginning. I kept thinking I had to find the process that was initiating the download and make sure it doesn't run, but I guess whether or not I had found it, nsurlsessiond was already told to get it and so it was initiating it itself and it wasn't giving up. One of the columns in the database was "retryCount" and it was set to 18.

Would still love to find which process it is that starts this whole thing. Maybe it was me turning on Siri and back off, same with iCloud. From the evidence I've found (see screenshot), I think it's likely to be related to com.apple.mobileassetsd, or maybe that's just a middleman process, I don't know.

 

[Flyview]

UPDATE - I confirmed it is indeed 'com.apple.mobileassetd' initiating the downloads:

I reset the services to default by deleting the plist files under:
/private/var/db/com.apple.xpc.launchd/

Rebooted

tasks.sqlite files regenerated at:
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsessiond

nsurlsessiond immediately started downloading to:
/System/Library/AssetsV2/downloadDir

Turned off WiFi, deleted the tasks.sqlite, deleted the files in downloadDir, ran the script (without mobileassetsd), rebooted, and the same thing happened. Then I did the following and it finally stopped.

Steps to stop the rogue downloading:

1) Turn off SIP
2) Reboot
3) Turn off WiFi
4) Disable com.apple.mobileassetd:
A) Add it to @bogdanw 's script under the system section and run it it in terminal:
sudo sh [path_to_debloatScript.sh]

Make sure to run the script from a "fresh" sate, after deleting any already modified plist files at
/private/var/db/com.apple.xpc.launchd/, and rebooting.

OR

B) In terminal:
sudo launchctl bootout /system/com.apple.mobileassetd
sudo disable /system/com.apple.mobileassetd

5) Delete all sqlite files under:
/private/var/folders/zz/zyxvpxvq6csfxvn_n00000y800007k/0/com.apple.nsurlsessiond
You will need to give "Everyone" read access to this folder in Finder -> get info -> unlock the lock in the bottom right -> then change the permission.
Your path may vary. Check the path by looking for tasks.sqlite from Activity Monitor -> nsurlsessiond -> Open Files and Ports.

6) Delete any files already downloaded under:
/System/Library/AssetsV2/downloadDir

7) Empty trash. I've seen nsurlsessiond still using tasks.sqlite from trash!
8) Reboot


I would love it if someone could confirm this works for them.

The sad part is if I ever want to reset the script and then re-run it, I have to re-do all these steps as mobileassetd seems to immediately get to work as soon as it's allowed to run.

 

[bogdanw]

I still think disabling mobileassetd might not be a good idea.

As you have identified the downloaded files to be for SiriTextToSpeech, try to disable the launch agents:
/System/Library/LaunchAgents/com.apple.sirittsd.plist
/System/Library/LaunchAgents/com.apple.SiriTTSTrainingAgent.plist

There is an additional one that might be related
/System/Library/LaunchAgents/com.apple.voicebankingd.plist

Also, Turn VoiceOver off and disable the keyboard shortcuts for VoiceOver
https://support.apple.com/en-euro/guide/voiceover/vo2682/mac

 

[Flyview]

You think it won't be able to download updates or not even let me know there's an update?

I think in this case it was for Siri but one time I saw it trying to download 3 different things:

So I don't really want to monitor what it might or might not download. If I have to I'll download an install OS updates manually. What other problems do you foresee?

VoiceOver was already off. I couldn't find a way to turn off the cmd + F5 keyboard shortcut for VoiceOver. Even if I untick VoiceOver under Accessibility -> Shortcut, that only changes which functions are presented to you when pressing option + cmd + F5.

Yup, I've had my eye on "voicebankingd" and "heard" haha. How come com.apple.sirittsd.plist and com.apple.SiriTTSTrainingAgent.plist are not in your list?

 

[bogdanw]

You think it won't be able to download updates or not even let me know there's an update?

mobileassetd might be partially responsible for firmware updates.

How come com.apple.sirittsd.plist and com.apple.SiriTTSTrainingAgent.plist are not in your list?

First of all, they should not run if Siri is not enabled during the setup.
Second, I'm waiting to test on a real Mac before adding all. Apple doesn't allow certain functions in a virtual machine, like Apple Intelligence, so it's difficult to understand what is running on a real Mac.