External SSD won't unmount due to socketfilterfw When trying to unmount my Samsung T3, which I store various applications like Mathematica on, I am told it is being used by some software socketfilterfw

$ diskutil unmount /dev/disk2s1
Volume External on disk2s1 failed to unmount: dissented by PID=304 
(/usr/libexec/ApplicationFirewall/socketfilterfw)


This also shows when unmounting using the GUI and checking in Console.app

I think socketfilterfw is involved in the firewall, however I'm not sure how to fix it or why it is happening, and whether or not it is safe for the SSD to force unmounting.

What options do I have?
The easiest and safest thing is to log out of the account on the Mac. (Apple Menu - log out)

This does two things:


All applications are told to quit and you can identify any apps that are stuck / hung.
All drives are safely unmounted as part of the normal log out process (unless you have an odd setup where you installed software that mounts the drive before the user logs in).


Once you have done that, you can either power off the Mac (to ensure all possibility that the drive is safely shut down and open files are not corrupted) or disconnect the drive.

Pulling a drive that's journaled and HFS+ (or the new APFS) is safe in that you won't corrupt the filesystem. What is at risk is each data file that's still open - so you would lose your word file, your iTunes library that lists playlists / ratings, etc.. (but not the songs themselves).

As to the socket filter - you might need to dig a bit in activity monitor or terminal to know why that was identified as using the device. It's probably relating to the apps you run off that device - Google Chrome will run updaters, perhaps Mathematica runs some licensing software that connects to the network (a school license server or back to the vendor). If you can make this error happen on a newly rebooted Mac several times - then it should be easy to look over each running app and trace why the filesystem is blocked and active.