Core networking

What is nesessionmanager?

Q: Why does my VPN traffic show under neagent?

The man page says that neagent hosts Network Extension plug-ins, such as a VPN app's provider. The VPN runs inside it.

nesessionmanager, neagent and nehelper are the Network Extension framework of macOS. They start VPNs and content filters, host their plug-ins and keep their configuration.

Process: nesessionmanagerAlso seen as: neagent, nehelperMade by AppleApplies to: macOS 14 Sonoma and later. Checked on macOS 27.2.Checked: 1 November 2026

Short answer

Part of macOS. They run Network Extension sessions, such as VPNs and content filters, and host their plug-ins, so VPN traffic can show under them.

Don’t block

Don't block them. VPNs and content filters, including Kilobat's firewall, can't run without them.

Path: /usr/libexec/nesessionmanager /usr/libexec/neagent /usr/libexec/nehelper
launchd label: com.apple.nesessionmanager com.apple.neagent com.apple.nehelper
Signing identifier: com.apple.nesessionmanager com.apple.neagent com.apple.nehelper

What it is

The man page says that nesessionmanager starts and stops Network Extension sessions. It also sets up the network configuration and policy for them. Sessions include VPNs and content filters.

The neagent man page calls it the “Host process for Network Extension plugins”, including NEProvider app extensions for VPNs and content filters.

The nehelper man page says that it vends the Network Extension configuration to clients and applies changes to it.

Kilobat's own firewall is a content filter, so it runs as a Network Extension too.

Apple Platform Security lists the VPN protocols that Macs support, including IKEv2/IPsec, L2TP/IPsec and Cisco IPsec, plus SSL-VPN through a client app.

Why it uses the network

VPN tunnels. A VPN built into macOS, or a VPN app's plug-in hosted by neagent, sends your tunnelled traffic to the VPN server.
Content filters. A content filter sees new connections to decide whether to allow them. Kilobat's filter is one.

How much is normal

With a VPN on, a lot of traffic under these processes is normal. It is your traffic, inside the tunnel.

Kilobat counts VPN traffic once, where the tunnel leaves the Mac, so it isn't counted twice.

Without a VPN or filter, they are quiet.

When it uses a lot, and why

A VPN that carries everything. A full-tunnel VPN sends all your internet traffic through the tunnel. The tunnel adds a little overhead too.
Reconnects. A VPN that drops and reconnects often repeats its handshake each time.

Is it safe to block?

Don’t block

Don't block them. VPNs and content filters, including Kilobat's firewall, can't run without them.

What breaks if you block it

VPN connections can't start, or stop carrying traffic.
Content filters, including Kilobat's network filter, stop working.
VPN and filter settings may fail to apply.

Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it.

Reduce its use

To stop a VPN, turn it off in the VPN app or in Apple menu › System Settings › VPN.
If two VPNs or filters conflict, see Little Snitch, LuLu and other network extensions conflict on a Mac.
Don't quit these processes in Activity Monitor. A running VPN can drop.

See how much it uses

Open Activity Monitor from Applications › Utilities. Click Network.
Type nesessionmanager in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started.
In Terminal, watch only this process. Press d to show the change per second, and q to quit. nettop cuts names to 15 characters.
```
nettop -p 'nesessionmanage' -P
```

With Kilobat

In the Kilobat app list, search for nesessionmanager. Its row shows the live rate and what it moved today.
In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online.
In Terminal, ask the same question. Add --json for scripts and agents.
```
kilobat explain 'nesessionmanager'
```

Show its traffic over one day.

kilobat bandwidth 'nesessionmanager' day

Through MCP, an AI agent asks explain_connection with the process name. It gets the same facts.

The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the network filter, Protection and the hotspot data saver.

Questions

Why does my VPN traffic show under neagent?

The man page says that neagent hosts Network Extension plug-ins, such as a VPN app's provider. The VPN runs inside it.

Does Kilobat run as a Network Extension?

Yes. Kilobat's firewall is a content filter, a kind of Network Extension session that macOS manages.

Sources

nesessionmanager(8), neagent(8) and nehelper(8), man pages installed with macOS 27.2
launchd property lists com.apple.nesessionmanager, com.apple.neagent and com.apple.nehelper, macOS 27.2
Apple Platform Security: VPN security
Apple Support: Set up a VPN connection on Mac
Kilobat docs: The network filter

Checked on 1 November 2026.