What is this process?
Every process in your network list, explained.
55 processes you see in Activity Monitor, nettop, a firewall prompt or Kilobat: what each one is, why it uses the network, how much is normal, and what breaks if you block it. Also see the hosts they connect to.
Sync and cloud storage
iCloud, CloudKit and cloud storage apps: your files, photos and app data going up and down.
birdPart of macOS. It runs iCloud Drive, so its traffic is your iCloud Drive files going up and down.Block with careclouddPart of macOS. It syncs the iCloud data of apps that use CloudKit, so its traffic belongs to those apps.Don’t blockcloudphotodPart of macOS. It does all iCloud Photos sync, so its traffic is your photos and videos going up and down.Block with careDropboxThe Dropbox desktop app. It uploads and downloads your Dropbox files, and with LAN sync it finds other Dropbox computers on the local network.Block with carefileproviderdPart of macOS. It connects cloud storage apps built on File Provider to the Finder, so their file downloads and uploads can show under it.Don’t blockOneDriveMicrosoft's OneDrive sync app. It uploads and downloads your OneDrive files. Microsoft says that it pauses on metered networks on its own.Block with careUpdates and downloads
macOS and app updates, system assets and background downloads that apps hand to macOS.
appstoreagentPart of macOS. They download and update apps from the App Store, so app downloads show under them, not under the App Store app.Block with careAssetCachePart of macOS. It is Content Caching. It keeps Apple downloads on this Mac and gives them to other Apple devices on the same network.Safe to blockmobileassetdPart of macOS, not documented by Apple. Kilobat sees it download system assets such as Apple Intelligence models, voices, fonts and dictionaries.Block with carensurlsessiondPart of macOS. It does background downloads and uploads that apps hand to macOS, so its traffic belongs to those apps.Block with caresoftwareupdatedPart of macOS. It checks for and downloads macOS updates, security responses and system files.Don’t blockNearby devices
AirDrop, Handoff, AirPlay, Bonjour and your other Apple devices on the same network.
AirPlayXPCHelperPart of macOS, not documented by Apple. Its name and its launchd services point to AirPlay, the streaming of video and audio between Apple devices and TVs.Block with carenetbiosdPart of macOS. It registers and browses NetBIOS names for Windows-style file sharing. Its traffic stays on the local network.Safe to blockrapportdPart of macOS. It connects this Mac to your other Apple devices on the local network for Handoff, phone calls and other Continuity features.Block with careremotepairingdPart of macOS and Xcode's device support. They find and talk to paired iPhones and iPads, mostly on the local network.Block with carescreensharingdPart of macOS. It accepts Screen Sharing and VNC connections from other computers, so another person can see and control this Mac.Safe to blocksharingdPart of macOS. It runs AirDrop, Handoff, Instant Hotspot discovery and the shared computers in the Finder. AirDrop transfers can show under it.Block with caresmbdPart of macOS. It is the SMB file server for File Sharing, so its traffic is other computers reading and writing this Mac's shared folders.Safe to blocksshdPart of macOS. It is the SSH server for Remote Login, so other computers can log in to this Mac with SSH or copy files with SFTP.Safe to blockwifip2pdPart of macOS. It manages peer-to-peer Wi-Fi, the direct link that AirDrop and other nearby-device features use.Block with careCore networking
DNS, Wi-Fi, addresses, time, VPN and the connection itself.
airportdPart of macOS. airportd manages the Wi-Fi interface, and WiFiAgent does Wi-Fi tasks for it in your session. They run Wi-Fi itself, not internet traffic.Don’t blockconfigdPart of macOS. It keeps the Mac's network configuration and gets its IP addresses with DHCP, so it sends small amounts of traffic to the router.Don’t blockmDNSResponderPart of macOS. It handles system DNS lookups for apps and runs Bonjour on the local network, so its traffic can include other apps' name lookups.Don’t blocknesessionmanagerPart of macOS. They run Network Extension sessions, such as VPNs and content filters, and host their plug-ins, so VPN traffic can show under them.Don’t blocknetworkserviceproxyPart of macOS. It is the transparent proxy for Apple system services and can carry iCloud Private Relay traffic, so other apps' browsing can show under it.Block with caresymptomsdPart of macOS, barely documented. Apple says only that it provides services for the Symptom Framework. It runs as the networking user and reacts to network changes.Block with caretimedPart of macOS. It keeps the clock correct with NTP, so it sends small requests to a time server such as time.apple.com.Don’t blockSecurity and accounts
Certificates, Gatekeeper, the keychain, your Apple Account and Find My.
akdPart of macOS, not documented by Apple. It is the AuthKit daemon, and its launchd services cover Apple Account sign-in and Sign in with Apple.Don’t blockfindmydevicedPart of macOS. findmydeviced runs Find My Mac. searchpartyd is another Find My daemon that Apple doesn't describe in its man page.Block with carelocationdPart of macOS. It runs Location Services, finding where the Mac is for the apps you allowed.Block with caresecdPart of macOS. It controls access to keychain items. With iCloud Keychain on, your passwords and other synced items travel between your devices.Don’t blocksyspolicydPart of macOS. It runs the system policy that includes Gatekeeper, which checks new and changed apps for known malware and revoked certificates.Don’t blocktrustdPart of macOS. It checks certificates for every app, and asks certificate authorities whether a certificate was revoked. Its connections are small.Don’t blockApple services
Siri, search suggestions, Messages, FaceTime, the App Store and Apple Intelligence.
apsdPart of macOS. It keeps one connection open to Apple's push notification service, so apps and iCloud can tell the Mac that something changed.Don’t blockassistantdPart of macOS. It is the Siri daemon, so Siri requests and dictation that need Apple's servers can show under it.Safe to blockcallservicesdPart of macOS. callservicesd keeps the state of calls, and CommCenter lets the Mac make and receive phone calls through your iPhone.Block with carecom.apple.WebKit.NetworkingPart of macOS. It is WebKit's network process, which does all network access for Safari and for apps that show web pages, so their browsing shows under it.Don’t blockidentityservicesdPart of macOS. It is the client of the Apple Identity Service, which finds the keys and devices of the people you message or call.Don’t blockimagentPart of macOS, not documented by Apple. It is the agent behind the Messages app, in the IMCore framework, so iMessage traffic can show under it.Block with careparsecdPart of macOS. It handles Siri, Spotlight and Safari suggestions and Look Up, so it connects to Apple while you search or type.Safe to blockprivatecloudcomputedPart of macOS. It encrypts and sends Apple Intelligence requests that need a larger model to Apple's Private Cloud Compute servers.Block with careScreenTimeAgentPart of macOS. It supports Screen Time, which can sync your usage and limits across your devices through iCloud.Block with caresiriactionsdPart of macOS. It runs and syncs the shortcuts you make in the Shortcuts app, so iCloud sync of shortcuts can show under it.Block with caresuggestdPart of macOS. It reads content from Mail, Messages and other apps on the Mac to suggest contacts and events. Apple doesn't document much network use.Block with careDiagnostics, analytics and ads
Crash reports, analytics you opted in to and Apple's advertising privacy settings.
adprivacydPart of macOS. It manages advertising privacy for Apple's own ads in the App Store, Apple News and Stocks, including your opt-out from personalized ads.Block with careanalyticsdPart of macOS. It collects diagnostics and usage data on the Mac for users who opted in to sharing analytics.Safe to blockSubmitDiagInfoPart of macOS. ReportCrash saves crash reports on the Mac. SubmitDiagInfo sends diagnostic and usage information to Apple, but only if you opted in.Safe to blockApps and helpers
Updaters and helpers from other makers: Microsoft, Google, Dropbox, Zoom, Electron apps and command-line tools.
AutoupdatePart of Sparkle, an open-source update framework that many Mac apps include. It installs an update after the app downloads it.Safe to blockElectron HelperPart of an app built on Electron. Electron apps run their windows and their network work in helper processes, so the app's traffic shows under “App Helper”.Block with careGoogle Chrome HelperPart of Google Chrome. Chrome runs its tabs, extensions and network service in helper processes, so your browsing shows under Google Chrome Helper.Don’t blockGoogleUpdaterGoogle's updater for Chrome and other Google apps on the Mac. It checks for updates about every few hours and downloads new versions.Block with careMicrosoft AutoUpdateMicrosoft's updater for Office, Teams and other Microsoft apps on the Mac. It checks for updates and, by default, downloads and installs them.Block with carenodeThe Node.js runtime, not part of macOS. It connects only when a script asks, such as npm installing packages, a dev server, an AI agent or an MCP server.Block with careShipItPart of Squirrel.Mac, the updater that many Electron apps include. It installs an update that the app has already downloaded.Safe to blockzoom.usThe Zoom desktop app. During meetings it sends and receives audio and video; Zoom also updates itself if automatic updates are on.Block with careKilobat shows the same short answers in the app: click ⓘ on a connection. Checked on 1 November 2026.