10.0.3 "Sophos Network Extension" process using 150% CPU

My computer updated to macOS 11.2.1 yesterday and everything seemed fine, then Sophos updated from 10.0.2 to 10.0.3 early this morning. Since the Sophos update, my computer has been experiencing random network data loss. For instance, Microsoft Teams keeps disconnecting, web pages fail to load, etc. These usually only last less than 10 seconds each, but their frequency creates a very high level of frustration.

I noticed that for very long stretches of time (20minutes or more), the Sophos Network Extension is running at 150% CPU usage.

I have all of the components configured to start and I have been running the EAP successfully since the beginning of the program. Today, I had to remove it. The network stability blips and the increased laptop fan usage caused by the high cpu process was too much.

  • Same problem here.

    Sophos Network Extension and nessionmanager are both running > 100% CPU and web traffic randomly seems to be blocked

  • Same issue as well SNE and SXLD 100% cpu and random network drops since this morning.

  • Yes, I'm also seeing this issue.  I think I started having this issue yesterday, but it may have been earlier.  I'm also seeing frequent drops within the AnyConnect client now.

  • We are seeing the same issue across our entire fleet. After the update to 10.0.3 that was applied this morning, we are seeing CPU usage from the Sophos Network Extension reaching greater than 100%, and memory usage skyrocketing in some cases consuming all available memory, and then the process crashing. 

    We are also seeing significant issues with web socket based communications. As a result we've had to disable Endpoint Protection and InterceptX across our entire fleet. 

  • This appears to be the same experience I am having. I did not notice the memory leak until you pointed it out.

    It turns out that in my case, the Network Extension eventually consumes all available memory and once it does, the process crashes. It eventually restarts and begins spiking the cpu and consumes all of the available memory until it crashes again. This is that loop I referred to in my original post where it would go for 20 minutes or more and then stop.

  • Also finding those processes mentioned at sustained high CPU usage after 10.0.3 installed on my macOS 11.2.1 updated laptop. Seems to seriously interfere with VPN connections. When trying to connect I now intermittently get disconnected with "Protocol wrong type for socket" errors. also random web pages failing to load. I won't be able to keep Sophos if i hope to get any work done. Still holding back our fleet of Macs to macOS Catalina because of Sophos.


  • In my case, my VPN connection kept "randomly" disconnecting.
    My workaround was to remove my computer from EAP, run Sophos update and confirm downgrade to 10.0.1, then reenroll my computer in EAP, run Sophos update to get 10.0.3 but decline the Transparent Proxy request. 
    Rock solid since then.

  • Add another one to the list.

    Here it is resetting connections to our VPN

  • This works because you are not granting the Network Extension permission. This may be a workaround for some, but many organizations (such as my own) pre-approve that dialog and therefore cannot disable the feature.

  • Hi mscottblake and Craine Runton,

    Sorry to hear that you're having trouble. What issues are you seeing with web socket based communications? We would like to investigate the issue more, could you please provide a SDU from the affected machine? We would also like a sample of the affected process when the issue occurs.

    To create a sample:

    • Go into Activity Monitor, and double click on the affected process taking CPU usage (i.e.: Sophos Network Extension).
    • Click on sample button
    • Please private message me and attach the sample’s output text file

    Please also provide an SDU from the affected machine by following these steps:

    Thanks for your feedback.