Apple - Internet speed getting slower over time on MBP

In my case this was caused by the Juniper/Pulse Secure VPN client's kernel extension, which was active even when not connected to the VPN. Unloading the kernel extension restored speed without a reboot.

Short term fix is to unload the extension, command copied from linked kb article:

sudo kextunload /Library/Extensions/PulseSecureFirewall.kext

Long term solution is to upgrade pulse secure client. I was experiencing this problem with pulse secure 9.0.3(1599). I upgraded to 9.0.3(1667) and the kext is no longer loaded by default. I can connect to the vpn without the kext loaded, and speed is no longer tailing off. Solved!

With pulsesecurefirewall.kext loaded: Without pulsesecurefirewall.kext loaded:

If your VPN security policy requires "Lock Down Mode" or "Traffic Enforcement", you may need to downgrade instead of upgrade the client.

For future reference, you can view loaded non-apple kexts with:

kextstat |grep -vi com.apple

Edit: What is a kernel extension? A kernel extension is a program that runs within the macOS kernel. Running within the kernel can give performance improvements for certain applications, and also access to APIs that aren't available to normal (user space) programs.

In this case, the pulse client included a kernel extension which provides firewall functionality by inspecting packets as they pass through the kernel. The provided extension is buggy and performance drops over time (maybe it keeps a list of something, and as that list grows, the length of time taken to scan the list increases, so the time to process a packet increases, leading to a drop in throughput??)

Unloading the kext removes the buggy code from the kernel, so that it doesn't affect performance.

As you've found, troubleshooting is a process of elimination and often requires patience. You've already done an excellent job of trying to get to the bottom of this, but there's a few things you haven't mentioned trying as part of your troubleshooting process.

1. Bootup into Safe Mode

I'd boot up into Safe Mode for a day. Not only can you test to see if the problem is replicated in Safe Mode, but the very act of booting into Safe Mode will run some checks, delete system cache files, verify your startup disk, and attempt to repair directory issues (if any are identified).

Follow these steps to boot your Mac into Safe Mode:

1. Fully shut down your MBP
2. Restart your MBP
3. Immediately press the Shift key and keep it down
4. Let go of the Shift key when you see the login window (NOTE: If you have FileVault enabled you may need to log in twice).
5. Take a note of what happens (i.e. use your Mac for a day and see if your internet speeds drop over time)
6. Exit Safe Mode to restart your Mac
7. Test your Mac again to see if the behaviour has changed

If the Mac maintains speeds during Safe Mode, but not again afterwards, let me know.

2. Reset your NVRAM

It may be worth resetting your NVRAM. For your model MBP you'll need to follow these steps:

1. Fully shut down your MBP
2. Press the power button and then press the commandoptionpr keys. You have to make sure you press these keys before the gray screen appears or it won’t work.
3. Hold those keys down until your Mac reboots again (i.e. wait until you've seen the Apple logo appear and disappear twice before letting go of the keys)
4. Let go of the keys and let your MBP reboot normally.

Note: When you log back in you may need to readjust some of your system preferences (e.g. speaker volume, screen resolution, startup disk selection, time zone information, etc).

Test to see whether this has made any difference to your problem.

3. Create a new user account

If 1 and 2 above do not resolve the issue, create a new user account.

1. Create a new user account
2. Reboot your Mac as normal
3. Log into the new account and use it for a day
4. Determine if there's been a gradual drop over time in your internet speed

After doing the above, report back on what happens.