# External NIC Blocked by Elastic Agent **URL:** \ **Category:** Endpoint Security\ **Created:** [December 2, 2021, 1:51pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772 "2021-12-02T13:51:15Z")\ **Posts on this page:** 20\ **Page:** 1
**Author:** ![teamomni](https://avatars.discourse-cdn.com/v4/letter/t/278dde/32.png) [@teamomni](https://discuss.elastic.co/u/teamomni)\ **Post date:** [December 2, 2021, 1:51pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/1 "2021-12-02T13:51:15Z")
We recently received our first MacBook Pro with an M1 ARM based processor and the external NIC appears to be blocked by the "ElasticEndpoint" that is running in the Network window. Our other MacBook Pros which are all Intel chip based currently use a USB-C to Ethernet port to hard wire to the network work without any issues. All MacBooks Pros that we are testing the Elastic Agents on are running the same MacOS version 12 and USB-C to Ethernet port cables. None have an issue joining our Elastic Cloud via Fleet which has been done while connected through WiFi. The external NIC does get a DHCP IPv4 address from the router on all of them (WiFi is then turned off), but after that point only the notebook with the M1 is blocked from reaching out to the network. The M1 notebook is not even capable of pinging itself at 127.0.0.1. Is there a known issue with the M1 processor and Elastic Agent not functioning together? Thank you ---
**Author:** ![Yamin\_Tian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yamin_tian/32/80373_2.png) [@Yamin\_Tian](https://discuss.elastic.co/u/Yamin_Tian)\ **Post date:** [December 2, 2021, 6:06pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/2 "2021-12-02T18:06:22Z")
There's no known issue regarding Elastic Endpoint blocking traffic associated with NICs. However in the past we've seen a few cases where network stopped functioning with any network extension in the place, not necessarily just the one from Elastic Endpoint. They turned out to be macOS issues, and those cases have been cleared out by applying latest macOS patches. ---
**Author:** ![teamomni](https://avatars.discourse-cdn.com/v4/letter/t/278dde/32.png) [@teamomni](https://discuss.elastic.co/u/teamomni)\ **Post date:** [December 2, 2021, 6:24pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/3 "2021-12-02T18:24:59Z")
I know that the MacBook with the problem is up to date with all of the current patches, like the rest. It is very new, so to the best of my knowledge there is nothing else installed in there that is not already on the rest (like the preinstalled applications). ---
**Author:** ![Will\_Yu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/will_yu/32/89428_2.png) [@Will\_Yu](https://discuss.elastic.co/u/Will_Yu)\ **Post date:** [December 2, 2021, 6:27pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/4 "2021-12-02T18:27:39Z")
Would you be able to provide the make/model of the external NIC? I was able to test with an M1 Macbook with a Belkin USB-C ethernet adapter and there did not seem to be the issue that is being described in the OP. ---
**Author:** ![teamomni](https://avatars.discourse-cdn.com/v4/letter/t/278dde/32.png) [@teamomni](https://discuss.elastic.co/u/teamomni)\ **Post date:** [December 2, 2021, 6:30pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/5 "2021-12-02T18:30:32Z")
There have been two different models tested; a HooToo hub (don't have the model number on hand) and a Cable Matters, Model No. 201013. ---
**Author:** ![Yamin\_Tian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yamin_tian/32/80373_2.png) [@Yamin\_Tian](https://discuss.elastic.co/u/Yamin_Tian)\ **Post date:** [December 2, 2021, 6:31pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/6 "2021-12-02T18:31:20Z")
Just add to all of above points. It seems there are discussion about the same issue: [MacBook Pro M1 is not detecting Ethernet … - Apple Community](https://discussions.apple.com/thread/252081092) ---
**Author:** ![teamomni](https://avatars.discourse-cdn.com/v4/letter/t/278dde/32.png) [@teamomni](https://discuss.elastic.co/u/teamomni)\ **Post date:** [December 2, 2021, 6:39pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/7 "2021-12-02T18:39:16Z")
We think that discussion case is different from ours because any USB-C hub/Ethernet port work fine when the agent is not installed. The moment we install the agent, the network/Internet connection is lost; the moment we uninstall the agent, the network/Internet is back. ---
**Author:** ![Yamin\_Tian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yamin_tian/32/80373_2.png) [@Yamin\_Tian](https://discuss.elastic.co/u/Yamin_Tian)\ **Post date:** [December 2, 2021, 6:46pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/8 "2021-12-02T18:46:09Z")
To further isolate the issue, is it possible to try and install a free firewall [LittleSnitch](https://www.obdev.at/products/littlesnitch/download.html), which also includes a network extension? If possible, please do so after Elastic Endpoint is uninstalled, then install LittleSnitch and observe the network, then uninstall it after done. ---
**Author:** ![chris.gaeth](https://avatars.discourse-cdn.com/v4/letter/c/90ced4/32.png) [@chris.gaeth](https://discuss.elastic.co/u/chris.gaeth)\ **Post date:** [December 2, 2021, 6:47pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/9 "2021-12-02T18:47:39Z")
![Screen Shot 2021-12-02 at 13.45.10](https://us1.discourse-cdn.com/elastic/original/3X/a/d/ad1d73b7c4c48b88700311ac91ebcd6da67d67b4.png) This happens to be my Mac in question. I have used two different USB NIC devices with the exact same result. DHCP or static assignment both fail. The USB NICs are totally INOP with the Elastic Agent installed. Remove the agent and both devices function normally. ---
**Author:** ![chris.gaeth](https://avatars.discourse-cdn.com/v4/letter/c/90ced4/32.png) [@chris.gaeth](https://discuss.elastic.co/u/chris.gaeth)\ **Post date:** [December 2, 2021, 6:56pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/10 "2021-12-02T18:56:00Z")
Installed and ran fine. No issues. Disabled WiFI. USB NIC pulled DCHP and everything ran fine. ---
**Author:** ![Yamin\_Tian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yamin_tian/32/80373_2.png) [@Yamin\_Tian](https://discuss.elastic.co/u/Yamin_Tian)\ **Post date:** [December 2, 2021, 7:24pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/11 "2021-12-02T19:24:39Z")
Thanks for quick replies. Could you help to collect several things for troubleshooting? While LittleSnitch is installed and running with only the aforementioned external NIC: 1. the screenshot of System Preference-\>Network that shows all the network connections 2. The screenshot of System Preference-\>Network-\>click "Advanced..." button-\>TCP/IP First made a screenshot, then click "Renew DHCP Lease", after screen refresh, take another screenshot. 3. In a Terminal console, type command: systemextensionsctl list Please collect the command output. While Elastic Endpoint is installed and running with only the aforementioned external NIC:: 4. the screenshot of System Preference-\>Network that shows all the network connections The screenshot of System Preference-\>Network-\>click "Advanced..." button-\>TCP/IP First made a screenshot of the tab, then click "Renew DHCP Lease", after screen refresh, take another screenshot. 5. In a Terminal console, type command: systemextensionsctl list Please collect the command output. 6. In a Terminal console, type command: ifconfig Please collect the command output. 7. In a Terminal console, type command: sudo sysdiagnose Hit `Enter` if prompted. The command will show the location of output package. Please collect that package. We may setup other channel to discussion further troubleshooting and exchange data. We'll also try to reproduce the same in-house. Thanks for all the feedback and assistance! ---
**Author:** ![Will\_Yu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/will_yu/32/89428_2.png) [@Will\_Yu](https://discuss.elastic.co/u/Will_Yu)\ **Post date:** [December 2, 2021, 7:32pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/12 "2021-12-02T19:32:05Z")
Additionally, can we get the make and model of the external USB NIC? Thank you! ---
**Author:** ![Yamin\_Tian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yamin_tian/32/80373_2.png) [@Yamin\_Tian](https://discuss.elastic.co/u/Yamin_Tian)\ **Post date:** [December 2, 2021, 8:03pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/13 "2021-12-02T20:03:08Z")
I've also tested with a external USB adapter(Trendnet) on M1 with the Elastic Endpoint running and the network worked ---
**Author:** ![Yamin\_Tian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yamin_tian/32/80373_2.png) [@Yamin\_Tian](https://discuss.elastic.co/u/Yamin_Tian)\ **Post date:** [December 7, 2021, 4:54pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/14 "2021-12-07T16:54:34Z")
> [@teamomni](#): > > All MacBooks Pros that we are testing the Elastic Agents on are running the same MacOS version 12 and USB-C to Ethernet port cables. Hi @teamomni and @chris.gaeth From above description, it seems the same external NIC card that has issues on M1 processor works perfectly on Intel processor, even when the macOS running on those systems are the same version 12. Could you confirm that's the case? We have tried to reproduce the issue in house with M1 system and a few external NICs available, so far we are not able to reproduce the same. Thanks Yamin ---
**Author:** ![teamomni](https://avatars.discourse-cdn.com/v4/letter/t/278dde/32.png) [@teamomni](https://discuss.elastic.co/u/teamomni)\ **Post date:** [December 7, 2021, 5:13pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/15 "2021-12-07T17:13:02Z")
That is accurate; the external USB-C to Ethernet port cable works on the Intel based MacBooks that are running the exact same OS version. They are older models (2019 I believe) but still macOS 12.0.1, and we are swapping the external cable around so that we know it is not the cable's issue either. ---
**Author:** ![Yamin\_Tian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yamin_tian/32/80373_2.png) [@Yamin\_Tian](https://discuss.elastic.co/u/Yamin_Tian)\ **Post date:** [December 7, 2021, 5:51pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/16 "2021-12-07T17:51:33Z")
That's interesting. Our network extension doesn't have specific logic to handle M1 processor. Network traffics from either processors are handled with the same logic. Also our network extension doesn't block any network traffic on loading stage. Instead, per our testing result shows, macOS drops all network connection and reset networks when it's loading 3rd party network extensions. Our network extension only relies on macOS's support to pass network traffics to us. We suspect it is an macOS issue. ---
**Author:** ![Yamin\_Tian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yamin_tian/32/80373_2.png) [@Yamin\_Tian](https://discuss.elastic.co/u/Yamin_Tian)\ **Post date:** [December 7, 2021, 6:19pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/17 "2021-12-07T18:19:53Z")
@teamomni and @chris.gaeth Do you have any other external ethernet NICs that can be tested so to conclude this is not a general issue with all external ethernet NICs but a specific one with specific NIC(s)? ---
**Author:** ![chris.gaeth](https://avatars.discourse-cdn.com/v4/letter/c/90ced4/32.png) [@chris.gaeth](https://discuss.elastic.co/u/chris.gaeth)\ **Post date:** [December 7, 2021, 6:40pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/18 "2021-12-07T18:40:30Z")
No. Please supply make and models of ones you tested with successfully. ---
**Author:** ![Yamin\_Tian](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/yamin_tian/32/80373_2.png) [@Yamin\_Tian](https://discuss.elastic.co/u/Yamin_Tian)\ **Post date:** [December 7, 2021, 6:52pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/19 "2021-12-07T18:52:15Z")
We tested belkin F2CU040 and trendnet tu2-et100 ---
**Author:** ![Will\_Yu](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/will_yu/32/89428_2.png) [@Will\_Yu](https://discuss.elastic.co/u/Will_Yu)\ **Post date:** [December 9, 2021, 9:58pm UTC](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772/20 "2021-12-09T21:58:31Z")
I was also able to get my hands on a Cable Matters Model 201013, and was unable to reproduce the issue on my M1 Macbook Pro running macOS 12. [Next page](https://discuss.elastic.co/t/external-nic-blocked-by-elastic-agent/290772.md?page=2)