os x el capitan 870

Since OS X 10.8.x Apple has progressively been moving away from AFP to a more agnostic network protocol.  Slowly transitioning services from AFP to Samba, then moving from Samba to SMB2/SMB3 to maintain compatibility with Microsoft.  This transition has been a bit rocky for some Apple users.  With multiple versions of the Mac operating systems being littered with SMB compatibility issues: ranging from performance penalties, authentication issues, and the inability to mount volumes using SMB2/SMB3, forcing some users to mount with the slower CIFS protocol, further affecting performance.

A lot of the SMB issues appeared to have been resolved with El Capitan, but if you’ve updated to OS X 10.11.5 and higher your SMB performance may once again be impacted.

With 10.11.5 and higher, Apple is now forcing “client signing” by default for SMB connections.  This was most likely done as an added security measure due to a security bug in the SMB protocol identified by Microsoft and Samba.  Microsoft documentation regarding “client signing” states that enabling this can degrade performance by as much as 15% percent, however this performance impact seems to grow exponentially with the available bandwidth.

As you can see from the chart below, there is a performance hit with enabling client signing, and depending on your connection speed and SMB protocol used (SMB2/SMB3) the performance hit can be substantial.


To resolve this performance issue you can force OS X to disable client signing over SMB by using the /etc/nsmb.conf file that contains the following. 


After a reboot, your SMB mount will no longer require client signing and performance should be restored.

*If your NAS is connected to the Internet, you may want to keep signing on due to potential security issues, even at the cost of poor performance.  If this is the case, you may want to adjust your workflow so that your SMB shares are offline, and don't require SMB signing to protect against badlock attacks.