Update 2016-10-05: After a comment suggesting that it wasn’t working on macOS Sierra, I tested it on a fresh Sierra installation and got similar performance improvements. It works.

Update 2016-09-19: This originally happened on OS X 10.11.5, but is still relevant for macOS Sierra 10.12.

The Issue

After recently upgrading to OS X 10.11.5, I noticed some SMB file transfers were taking a lot longer than usual. Instead of the normal 100MB/sec transfer speeds I typically see between my Macbook Pro and my Synology NAS on a gigabit (wired) network, I was seeing something closer to 30MB/sec.

Turns out I’m not the only one with this issue. Searching Google for “10.11.5 slow smb” returns pages full of results of people reporting the same issue. Most of them say “switch to AFP and the problem goes away.” That’s nice but I specifically use SMB because I have a share that’s accessed by Linux, Mac, and Windows - and so SMB is the right solution to keep file naming consistent.

The issue seems to come down to Apple’s SMB forcing default enabling of “client signing” which ruins performance.

One smart person (or conspiracy theorist) guesses that this was a change made by Apple based on the Badlock SMB issue in order to mitigate Man-In-The-Middle attacks. Regardless of the reason, it’s a really shitty thing to do to break transfer speeds on a well used protocol without at least acknowledging the problem or suggesting workarounds.

The Fix

Buried in one thread on the Apple Discussion Forum is a suggestion to use the /etc/nsmb.conf file to disable client signing on the client end.

[default]
signing_required=no

After unmounting & remounting the SMB share, I verified this returns transfer speeds to normal.

How to Fix It In One Command

Open up a terminal and enter this command.

printf "[default]\nsigning_required=no\n" | sudo tee /etc/nsmb.conf >/dev/null

Then unmount and remount any SMB shares.

Implications

Client signing does provide additional security, but who’s kidding who - nobody should be running SMB over the internet or on any untrusted network in the first place.