I turned off all iCloud drive stuff and it seems something else is using it. I don't have photo sharing and photo syncing on between my Mac and iPhone. And I've turned off whatever I can. But still nsurlsessiond downloads over 400 MBs every time it runs; which sometimes is triggered with a restart of the system.

I did a sample process on it; but I have no idea what it means.

  • None of the solutions below worked for me, nsurlsessiond is still downloading stuff and wasting bandwidth with a vengeance. Jun 23, 2021 at 11:28

9 Answers 9


That daemon (or system process) is invoked and handles network download requests from many apps and many other services on macOS. (And iOS and tvOS and watchOS)

I haven't found an easy way to get summary details or statistics from the session manager, but since it works on a queue to upload or download things, my guess is you have one or more job(s) timing out.

Here are some ways to pick apart the activity on your system:

sudo lsof | grep nsurl
ps -ef|grep nsurl
sudo fs_usage -w | grep nsurl

The first lists open files and sorts for matches of “nsurl”. The second lists all processes and sorts again. The third lists file system activity.

That will let you monitor things and see which of the several nsurl daemons is running when you measure 400 mb of transfer. You can also get a dump of the system activity with sysdiagnose nsurlsessiond

If you determine that it's really iCloud Documents, you'll likely need brctl log -w to watch that subsystem instead of monitoring the worker threads that do the lifting.

  • 4
    Thanks a lot Mike. You're awesome. Can you just please tell me what each of those 3 commands you said, does? I entered them and I get list of files (assuming it's the files used by the process). But I don't understand what each column represents. I don't know what REG, CHR or 1,3 means. And I'm not sure if the last columns are the bytes sent/received by the process. Is there some sort of guide about this?
    – Milad
    Sep 12, 2015 at 6:17
  • @Milad Welcome to Ask Different. There are many guides. Why not take one of the commands (maybe the ps one to start) and ask a new question. Before posting it, check the related questions and read through How to Ask and show where your research failed you in learning what the command does. Ping me here with a link and I'll see what I can do. Answering follow on questions in comments is hard and doesn't help the site
    – bmike
    Sep 12, 2015 at 13:01
  • 1
    Adding more info on this thread. I had iCloud setup to Optimize the space on my Mac. When I turned Bootcamp off, it started to download all my stuff from iCloud to Mac. I wouldn't find that information without this thread, kudos to bmike!
    – user202054
    Sep 19, 2016 at 23:29
  • In this case it's downloading something from App Store. But none of these commands show the actual file. (lsof, ps, fs_usage). How can I find the downloaded file?
    – Elliott
    Oct 23, 2020 at 18:29

In my case I have found that:

When backing up WhatsApp (on iOS - iPhone) chats to iCloud, it copies the backup into every machine that uses iCloud. The backup is placed into a hidden folder, on my machine (OS X 10.11.4) it is in the

/Users/UUUUUUU/Library/Mobile Documents/57T923XXXX~net~whatsapp~WhatsApp/Accounts/NNNNNNNNN/backup

folder, where UUUUUUU is my username and NNNNNNNNN is my phone number.

Unfortunately the backup file for the media is in one huge archive (mine is > 560MB) so every time WhatsApp backs up, the WHOLE file is re-downloaded, from what I can see. This is what nsurlsessiond is doing.

If you run the brctl log -w command mentioned above, you will see something along these lines:

received a push for container 57T923XXXX~net~whatsapp~WhatsApp
[note]    2.335 [2016-05-04 12:44:54.114] cloudkit.operation.callback    sync-down.container-metadata BRCContainerMetadataSyncDownOperation.m:229
fetched 0 containers metadata from the cloud
[note]    2.375 [2016-05-04 12:44:54.154] sqlite.serverTruth             zone.server               BRCServerZone.m:771
received 25 edited items from the cloud for 57T923XXXX.net.whatsapp.WhatsApp
[note]    2.427 [2016-05-04 12:44:54.207] bird.scheduler.Apply Changes   accountsession       BRCAccountSession.m:1473
we will now download new documents automatically because the account contains less than 5 GB
[note]    2.536 [2016-05-04 12:44:54.316] sqlite.clientTruth             fs.downloader          BRCFSDownloader.m:1469
downloading 11 documents in 57T923XXXX.net.whatsapp.WhatsApp

Deleting the WhatsApp 'documents' (i.e. backups) via the iCloud storage management console in iOS or Mac OS X deletes the files from the Mobile Documents folder and thereafter there is no more activity from nsurlsessiond.

Hope this helps.

  • following Cory Klein's solution below, that entire folder disappeared completely.
    – nyxee
    Mar 13, 2018 at 12:47

For Googlers that just want to stop the bandwidth usage, do what the OP did and turn off services that may be causing problems:


  1. System Preferences -> iCloud
  2. Uncheck:
    • iCloud Drive
    • Photos

Spotlight Suggestions

  1. System Preferences -> Spotlight
  2. Uncheck "Spotlight Suggestions"

If you find something else hogging bandwidth on your machine then leave it in the comments and I'll add it here.

  • this looks like the current solution. I think my iPhone and maybe Mac have a tendency to download so OS updates automatically. I see something below but it doesnt cover the iphone.. can you please say something small about spotlight suggestions..
    – nyxee
    Mar 13, 2018 at 12:44
  • i dont know why but it worked for me once and after i restart my mac big sur VM, nsurlsessiond was downloading big again.
    – Emil
    Sep 22, 2021 at 19:05

This was a really helpful post:


For me, it was an "automatic update" from the App Store.

System Preferences > App Store / Software Update > Disable automatic updates saved me hundreds of megabytes per day in bandwidth. My machine becomes very slow when downloading updates.

  • Welcome to Ask Different! We're trying to find the best answers and those answers will provide info as to why they're the best. Explain why you think the link you provided will answer the question. Links can change and become outdated so we prefer the answers to not just be a link. See How to Answer on how to provide a quality answer. - From Review -
    – fsb
    Sep 13, 2016 at 20:46

In my case nsurlsessiond was using over 5MB/s of download bandwidth. I noticed this because web pages were loading very slowly, and thanks to the iStat Menus application in my Menu Bar.

I tried other methods to work out the source of the data usage, however I didn't find much useful information that wouldn't require further digging (and I didn't want to disable iCloud Backup or iCloud Photos).

The Activity Monitor application was able to provide me a quick overview of where the data was coming in and where it was going.

Open the Activity Monitor app and navigate to the Network tab, then sort by Rcvd Bytes and wait (the network tab only display cumulative results since you navigated to the tab). Here you will likely see nsurlsessiond topping the list.

Now navigate to the Disk tab in Activity Monitor and sort by Bytes Written. Ignoring kernel_task (which encapsulates a lot of functions and is rarely worth trying to debug), in my case Photos Agent was at the top of the list (which came as no surprise since I recorded a lot of video media on my iPhone the day before).

I deleted some recently captured media from my iPhone that I didn't need to keep, and waited a little while longer for the sync to complete, then the process settled down.

If you can't afford to wait for the process to settle down, and you don't need to use the Photos app, you can try stopping the process that triggers Photos Agent to sync photos from iCloud:

for i in com.apple.photolibraryd com.apple.photoanalysisd com.apple.cloudphotosd
   launchctl stop $i
  • Nice script to unload / stop some processes that can chew bandwidth and CPU.
    – bmike
    Sep 30, 2020 at 19:03

Apart from the iCloud settings in settings. In my case, it was the Message sync, in Message > Preferences > iMessage and there "activate Message for iCloud" that was the source of the problem.

Everything else had always been deactivated.


i just go to

System Preferences >> Apple ID >> iCloud

and uncheck all. problem solved. my case i think the iCloud Drive sync every bit of data to the server that's the problem i don't want to sync anything to iCloud so i just uncheck all


Taken from here:

If you want to stop it do

cd /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Library/Developer/CoreSimulator/Profiles/Runtimes/iOS.simruntime/Contents/Resources/RuntimeRoot/System/Library/UserEventPlugins/com.apple.nsurlsessiond.plugin
mv com.apple.nsurlsessiond.plugin Rename-com.apple.nsurlsessiond.plugin
cd /Applications/Xcode.app/Contents/Developer/Platforms/iPhoneOS.platform/Library/Developer/CoreSimulator/Profiles/Runtimes/iOS.simruntime/Contents/Resources/RuntimeRoot/usr/libexec
mv nsurlsessiond Rename-nsurlsessiond
  • Are there any drawbacks with this, e.g. things in Xcode not working any longer?
    – nohillside
    Sep 6, 2021 at 5:06
  • no drawbacks, I have already renamed it, for more detail please check: swiftdevcenter.com/… Sep 6, 2021 at 6:07
  • The linked site doesn't contain any details about sideeffects of this.
    – nohillside
    Sep 6, 2021 at 6:11
  • no side effects, I have done it in my two Xcode version 11.3 and 11.4 Sep 6, 2021 at 6:53


any one of the extensions might cause nsurlsessiond problem .

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .