I turned off all iCloud drive stuff and it seems something else is using it. I don't have photo sharing and photo syncing on between my Mac and iPhone. And I've turned off whatever I can. But still nsurlsessiond downloads over 400 MBs every time it runs; which sometimes is triggered with a restart of the system.

I did a sample process on it; but I have no idea what it means.


That daemon is invoked and services download need for called from many apps and many services on macOS. (And iOS and tvOS and watchOS)

I haven't found an easy way to get summary details or statistics from the session manager, but since it works on a queue to upload or download things, my guess is you have one or more job(s) timing out.

Here are some ways to pick apart the activity on your system:

sudo lsof | grep nsurl
ps -ef|grep nsurl
sudo fs_usage -w | grep nsurl

The first lists open files and sorts for matches of “nsurl”. The second lists all processes and sorts again. The third lists file system activity.

That will let you monitor things and see which of the several nsurl daemons is running when you measure 400 mb of transfer. You can also get a dump of the system activity with sysdiagnose nsurlsessiond

If you determine that it's really iCloud Documents, you'll likely need brctl log -w to watch that subsystem instead of monitoring the worker threads that do the lifting.

| improve this answer | |
  • 4
    Thanks a lot Mike. You're awesome. Can you just please tell me what each of those 3 commands you said, does? I entered them and I get list of files (assuming it's the files used by the process). But I don't understand what each column represents. I don't know what REG, CHR or 1,3 means. And I'm not sure if the last columns are the bytes sent/received by the process. Is there some sort of guide about this? – Milad Sep 12 '15 at 6:17
  • @Milad Welcome to Ask Different. There are many guides. Why not take one of the commands (maybe the ps one to start) and ask a new question. Before posting it, check the related questions and read through How to Ask and show where your research failed you in learning what the command does. Ping me here with a link and I'll see what I can do. Answering follow on questions in comments is hard and doesn't help the site – bmike Sep 12 '15 at 13:01
  • 1
    Adding more info on this thread. I had iCloud setup to Optimize the space on my Mac. When I turned Bootcamp off, it started to download all my stuff from iCloud to Mac. I wouldn't find that information without this thread, kudos to bmike! – user202054 Sep 19 '16 at 23:29

In my case I have found that:

When backing up WhatsApp (on iOS - iPhone) chats to iCloud, it copies the backup into every machine that uses iCloud. The backup is placed into a hidden folder, on my machine (OS X 10.11.4) it is in the

/Users/UUUUUUU/Library/Mobile Documents/57T923XXXX~net~whatsapp~WhatsApp/Accounts/NNNNNNNNN/backup

folder, where UUUUUUU is my username and NNNNNNNNN is my phone number.

Unfortunately the backup file for the media is in one huge archive (mine is > 560MB) so every time WhatsApp backs up, the WHOLE file is re-downloaded, from what I can see. This is what nsurlsessiond is doing.

If you run the brctl log -w command mentioned above, you will see something along these lines:

received a push for container 57T923XXXX~net~whatsapp~WhatsApp
[note]    2.335 [2016-05-04 12:44:54.114] cloudkit.operation.callback    sync-down.container-metadata BRCContainerMetadataSyncDownOperation.m:229
fetched 0 containers metadata from the cloud
[note]    2.375 [2016-05-04 12:44:54.154] sqlite.serverTruth             zone.server               BRCServerZone.m:771
received 25 edited items from the cloud for 57T923XXXX.net.whatsapp.WhatsApp
[note]    2.427 [2016-05-04 12:44:54.207] bird.scheduler.Apply Changes   accountsession       BRCAccountSession.m:1473
we will now download new documents automatically because the account contains less than 5 GB
[note]    2.536 [2016-05-04 12:44:54.316] sqlite.clientTruth             fs.downloader          BRCFSDownloader.m:1469
downloading 11 documents in 57T923XXXX.net.whatsapp.WhatsApp

Deleting the WhatsApp 'documents' (i.e. backups) via the iCloud storage management console in iOS or Mac OS X deletes the files from the Mobile Documents folder and thereafter there is no more activity from nsurlsessiond.

Hope this helps.

| improve this answer | |
  • following Cory Klein's solution below, that entire folder disappeared completely. – nyxee Mar 13 '18 at 12:47

For Googlers that just want to stop the bandwidth usage, do what the OP did and turn off services that may be causing problems:


  1. System Preferences -> iCloud
  2. Uncheck:
    • iCloud Drive
    • Photos

Spotlight Suggestions

  1. System Preferences -> Spotlight
  2. Uncheck "Spotlight Suggestions"

If you find something else hogging bandwidth on your machine then leave it in the comments and I'll add it here.

| improve this answer | |
  • this looks like the current solution. I think my iPhone and maybe Mac have a tendency to download so OS updates automatically. I see something below but it doesnt cover the iphone.. can you please say something small about spotlight suggestions.. – nyxee Mar 13 '18 at 12:44

This was a really helpful post:


For me, it was "auto update" from the App Store. Going to "system preferences - App store - disable updates", saved my hundreds of Mb per day in bandwidth. (and made everything faster)

| improve this answer | |
  • Welcome to Ask Different! We're trying to find the best answers and those answers will provide info as to why they're the best. Explain why you think the link you provided will answer the question. Links can change and become outdated so we prefer the answers to not just be a link. See How to Answer on how to provide a quality answer. - From Review - – fsb Sep 13 '16 at 20:46

In my case nsurlsessiond was using over 5MB/s of download bandwidth. I noticed this because web pages were loading very slowly, and thanks to the iStat Menus application in my Menu Bar.

I tried other methods to work out the source of the data usage, however I didn't find much useful information that wouldn't require further digging (and I didn't want to disable iCloud Backup or iCloud Photos).

The Activity Monitor application was able to provide me a quick overview of where the data was coming in and where it was going.

Open the Activity Monitor app and navigate to the Network tab, then sort by Rcvd Bytes and wait (the network tab only display cumulative results since you navigated to the tab). Here you will likely see nsurlsessiond topping the list.

Now navigate to the Disk tab in Activity Monitor and sort by Bytes Written. Ignoring kernel_task (which encapsulates a lot of functions and is rarely worth trying to debug), in my case Photos Agent was at the top of the list (which came as no surprise since I recorded a lot of video media on my iPhone the day before).

I deleted some recently captured media from my iPhone that I didn't need to keep, and waited a little while longer for the sync to complete, then the process settled down.

If you can't afford to wait for the process to settle down, and you don't need to use the Photos app, you can try stopping the process that triggers Photos Agent to sync photos from iCloud:

for i in com.apple.photolibraryd com.apple.photoanalysisd com.apple.cloudphotosd
   launchctl stop $i
| improve this answer | |
  • Nice script to unload / stop some processes that can chew bandwidth and CPU. – bmike Sep 30 at 19:03

Apart from the iCloud settings in settings. In my case, it was the Message sync, in Message > Preferences > iMessage and there "activate Message for iCloud" that was the source of the problem.

Everything else had always been deactivated.

| improve this answer | |

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .