--- title: "nesessionmanager, neagent and nehelper: what they are, and whether to block them · Kilobat" url: "https://kilobat.app/processes/nesessionmanager" description: "nesessionmanager, neagent and nehelper run VPNs and content filters on a Mac. Why VPN traffic can show under them, and what breaks if you block them." --- Core networking # What is nesessionmanager? `nesessionmanager`, `neagent` and `nehelper` are the Network Extension framework of macOS. They start VPNs and content filters, host their plug-ins and keep their configuration. Process: `nesessionmanager` · Also seen as: `neagent`, `nehelper` · Made by Apple · Applies to: macOS 14 Sonoma and later. Checked on macOS 27.2. · Checked: 1 November 2026 ## Short answer Part of macOS. They run Network Extension sessions, such as VPNs and content filters, and host their plug-ins, so VPN traffic can show under them. Don’t block Don't block them. VPNs and content filters, including Kilobat's firewall, can't run without them. Path `/usr/libexec/nesessionmanager` `/usr/libexec/neagent` `/usr/libexec/nehelper` launchd label `com.apple.nesessionmanager` `com.apple.neagent` `com.apple.nehelper` Signing identifier `com.apple.nesessionmanager` `com.apple.neagent` `com.apple.nehelper` ## What it is The man page says that `nesessionmanager` starts and stops Network Extension sessions. It also sets up the network configuration and policy for them. Sessions include VPNs and content filters. The `neagent` man page calls it the “Host process for Network Extension plugins”, including NEProvider app extensions for VPNs and content filters. The `nehelper` man page says that it vends the Network Extension configuration to clients and applies changes to it. Kilobat's own firewall is a content filter, so it runs as a Network Extension too. Apple Platform Security lists the VPN protocols that Macs support, including IKEv2/IPsec, L2TP/IPsec and Cisco IPsec, plus SSL-VPN through a client app. ## Why it uses the network - **VPN tunnels.** A VPN built into macOS, or a VPN app's plug-in hosted by `neagent`, sends your tunnelled traffic to the VPN server. - **Content filters.** A content filter sees new connections to decide whether to allow them. Kilobat's filter is one. ## How much is normal With a VPN on, a lot of traffic under these processes is normal. It is your traffic, inside the tunnel. Kilobat counts VPN traffic once, where the tunnel leaves the Mac, so it isn't counted twice. Without a VPN or filter, they are quiet. ## When it uses a lot, and why - **A VPN that carries everything.** A full-tunnel VPN sends all your internet traffic through the tunnel. The tunnel adds a little overhead too. - **Reconnects.** A VPN that drops and reconnects often repeats its handshake each time. ## Is it safe to block? Don’t block Don't block them. VPNs and content filters, including Kilobat's firewall, can't run without them. What breaks if you block it - VPN connections can't start, or stop carrying traffic. - Content filters, including Kilobat's network filter, stop working. - VPN and filter settings may fail to apply. Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it. ## Reduce its use 1. To stop a VPN, turn it off in the VPN app or in Apple menu › System Settings › VPN. 2. If two VPNs or filters conflict, see [Little Snitch, LuLu and other network extensions conflict on a Mac](https://kilobat.app/guides/network-extension-conflicts). 3. Don't quit these processes in Activity Monitor. A running VPN can drop. ## See how much it uses 1. Open Activity Monitor from Applications › Utilities. Click Network. 2. Type `nesessionmanager` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started. 3. In Terminal, watch only this process. Press d to show the change per second, and q to quit. nettop cuts names to 15 characters. ``` nettop -p 'nesessionmanage' -P ``` ## With Kilobat 1. In the Kilobat app list, search for `nesessionmanager`. Its row shows the live rate and what it moved today. 2. In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online. 3. In Terminal, ask the same question. Add `--json` for scripts and agents. ``` kilobat explain 'nesessionmanager' ``` 4. Show its traffic over one day. ``` kilobat bandwidth 'nesessionmanager' day ``` 5. Through MCP, an AI agent asks `explain_connection` with the process name. It gets the same facts. The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the [network filter](https://kilobat.app/docs/blocking#filtering), [Protection](https://kilobat.app/docs/blocking#protection) and the [hotspot data saver](https://kilobat.app/save-hotspot-data). ## Questions **Why does my VPN traffic show under neagent?** The man page says that `neagent` hosts Network Extension plug-ins, such as a VPN app's provider. The VPN runs inside it. **Does Kilobat run as a Network Extension?** Yes. Kilobat's firewall is a content filter, a kind of Network Extension session that macOS manages. ## Sources - nesessionmanager(8), neagent(8) and nehelper(8), man pages installed with macOS 27.2 - launchd property lists com.apple.nesessionmanager, com.apple.neagent and com.apple.nehelper, macOS 27.2 - [Apple Platform Security: VPN security](https://support.apple.com/guide/security/vpn-security-sec802e8ab55/web) - [Apple Support: Set up a VPN connection on Mac](https://support.apple.com/en-us/guide/mac-help/mchlp2963/mac) - [Kilobat docs: The network filter](https://kilobat.app/docs/blocking#filtering) Checked on 1 November 2026. ## Related - [networkserviceproxy](https://kilobat.app/processes/networkserviceproxy): Part of macOS. It is the transparent proxy for Apple system services and can carry iCloud Private Relay traffic, so other apps' browsing can show under it. - [mDNSResponder](https://kilobat.app/processes/mdnsresponder): Part of macOS. It handles system DNS lookups for apps and runs Bonjour on the local network, so its traffic can include other apps' name lookups. - [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet) - [Little Snitch, LuLu and other network extensions conflict on a Mac](https://kilobat.app/guides/network-extension-conflicts) - [A content filter blocks websites on a Mac](https://kilobat.app/guides/content-filter-blocking)