[BUG] Cisco AnyConnect 4.10 high CPU usage on MacOS

[akseli uusitalo]

We have recently received reports that our client has problems with the AnyConnect VPN on their Apple devices so that it has extremely high CPU usage of over 90%. This due to obvious reasons hinders their ability to work.

They are using AnyConnect version 4.10.06079. With operating systems ranging from MacOS 12 to older ones. So this problem affects several users.

A similar bug was fixed in previous versions according to the release notes, but alas this problem still seems to persist.

Is this related to the AnyConnect Socket filters installed with the VPN?
Any tips on how to fix or ways to circumvent?

edit: Customer specified the problems began after Apple deployed MacOS update 12.6

Best Regards.
Akseli Uusitalo

[akseli uusitalo · Accepted solution]

[Temporary solution]
Customer has informed me they were able to temporary solve this for AnyConnect version 4.10.05095. Temporary meaning, it fixed it for now.

"temporary solution:

• run: “sudo /Applications/Cisco/Cisco\ AnyConnect\ Socket\ Filter.app/Contents/MacOS/Cisco\ AnyConnect\ Socket\ Filter -deactivateExt”
  (issue socket filters often come back)
• throw “Cisco AnyConnect Socket Filter.app” in the bin. That seems to remove the socket filters permanently
  "
  
  

If anyone has the same issue this is worth a shot.

[gabriel denk]

Names have been changed in the latest version of the VPN software.  The command to deactivate the extension is now as follows:

sudo /Applications/Cisco/Cisco\ Secure\ Client\ -\ Socket\ Filter.app/Contents/MacOS/Cisco\ Secure\ Client\ -\ Socket\ Filter -deactivateExt

This nasty thing showed up again after an automatic update (to Secure Client 5.0.03072).

[gabriel denk]

Thank you so much, @akseli uusitalo!  This problem has been plaguing me for months!  Not only does the bug eat up lots of CPU cycles, it also causes certain kinds of operations to fail entirely.  The simplest way to reproduce the problem is to run Angry IP Scanner and try to scan a 256-address IP block.  Once the bug has settled in (takes anywhere from 2 hours to 5 days after a reboot in my experience), the scan will take minutes instead of seconds and will fail to identify any of the open ports on the hosts.  It happens when there are lots of threads in play.  A single ping works fine, but ping 30 hosts from a thread pool and you get timeouts and failures regardless of the speed of the network or the responsiveness of the hosts.  (See my post on Stack Overflow for lots of details.)

[gabriel denk]

By the way, this bug persisted through an upgrade to version 5.0.00556 (from 4.x) of the VPN software.

[Luna99923]

Any update on this? Is this a Cisco or Apple issue?  We are running Secure Client 5.0.00556 and running into the same issues (high CPU, network outages on wired/wireless) MacOS Ventura for most users.  We have informed user's to delete the socket filter from the Cisco folder and reboot to resolved the issue.