We recently received our first MacBook Pro with an M1 ARM based processor and the external NIC appears to be blocked by the "ElasticEndpoint" that is running in the Network window. Our other MacBook Pros which are all Intel chip based currently use a USB-C to Ethernet port to hard wire to the network work without any issues.
All MacBooks Pros that we are testing the Elastic Agents on are running the same MacOS version 12 and USB-C to Ethernet port cables. None have an issue joining our Elastic Cloud via Fleet which has been done while connected through WiFi. The external NIC does get a DHCP IPv4 address from the router on all of them (WiFi is then turned off), but after that point only the notebook with the M1 is blocked from reaching out to the network. The M1 notebook is not even capable of pinging itself at 127.0.0.1.
Is there a known issue with the M1 processor and Elastic Agent not functioning together?
There's no known issue regarding Elastic Endpoint blocking traffic associated with NICs. However in the past we've seen a few cases where network stopped functioning with any network extension in the place, not necessarily just the one from Elastic Endpoint. They turned out to be macOS issues, and those cases have been cleared out by applying latest macOS patches.
I know that the MacBook with the problem is up to date with all of the current patches, like the rest. It is very new, so to the best of my knowledge there is nothing else installed in there that is not already on the rest (like the preinstalled applications).
Would you be able to provide the make/model of the external NIC? I was able to test with an M1 Macbook with a Belkin USB-C ethernet adapter and there did not seem to be the issue that is being described in the OP.
We think that discussion case is different from ours because any USB-C hub/Ethernet port work fine when the agent is not installed. The moment we install the agent, the network/Internet connection is lost; the moment we uninstall the agent, the network/Internet is back.
To further isolate the issue, is it possible to try and install a free firewall LittleSnitch, which also includes a network extension? If possible, please do so after Elastic Endpoint is uninstalled, then install LittleSnitch and observe the network, then uninstall it after done.
This happens to be my Mac in question. I have used two different USB NIC devices with the exact same result. DHCP or static assignment both fail. The USB NICs are totally INOP with the Elastic Agent installed. Remove the agent and both devices function normally.
Thanks for quick replies. Could you help to collect several things for troubleshooting?
While LittleSnitch is installed and running with only the aforementioned external NIC:
the screenshot of System Preference->Network that shows all the network connections
The screenshot of System Preference->Network->click "Advanced..." button->TCP/IP
First made a screenshot, then click "Renew DHCP Lease", after screen refresh, take another screenshot.
In a Terminal console, type command:
systemextensionsctl list
Please collect the command output.
While Elastic Endpoint is installed and running with only the aforementioned external NIC::
the screenshot of System Preference->Network that shows all the network connections
The screenshot of System Preference->Network->click "Advanced..." button->TCP/IP
First made a screenshot of the tab, then click "Renew DHCP Lease", after screen refresh, take another screenshot.
In a Terminal console, type command:
systemextensionsctl list
Please collect the command output.
In a Terminal console, type command:
ifconfig
Please collect the command output.
In a Terminal console, type command:
sudo sysdiagnose
Hit Enter if prompted. The command will show the location of output package. Please collect that package.
We may setup other channel to discussion further troubleshooting and exchange data. We'll also try to reproduce the same in-house.
Thanks for all the feedback and assistance!
Hi @teamomni and @chris.gaeth
From above description, it seems the same external NIC card that has issues on M1 processor works perfectly on Intel processor, even when the macOS running on those systems are the same version 12. Could you confirm that's the case?
We have tried to reproduce the issue in house with M1 system and a few external NICs available, so far we are not able to reproduce the same.
Thanks
Yamin
That is accurate; the external USB-C to Ethernet port cable works on the Intel based MacBooks that are running the exact same OS version. They are older models (2019 I believe) but still macOS 12.0.1, and we are swapping the external cable around so that we know it is not the cable's issue either.
That's interesting. Our network extension doesn't have specific logic to handle M1 processor. Network traffics from either processors are handled with the same logic. Also our network extension doesn't block any network traffic on loading stage. Instead, per our testing result shows, macOS drops all network connection and reset networks when it's loading 3rd party network extensions. Our network extension only relies on macOS's support to pass network traffics to us. We suspect it is an macOS issue.
@teamomni and @chris.gaeth
Do you have any other external ethernet NICs that can be tested so to conclude this is not a general issue with all external ethernet NICs but a specific one with specific NIC(s)?
Apache, Apache Lucene, Apache Hadoop, Hadoop, HDFS and the yellow elephant
logo are trademarks of the
Apache Software Foundation
in the United States and/or other countries.
