--- title: "What is this process? macOS processes that use the network · Kilobat" url: "https://kilobat.app/processes" description: "55 macOS processes explained: nsurlsessiond, mDNSResponder, cloudd, apsd and more. Why each uses data, what is normal, and what breaks if you block it." --- What is this process? # Every process in your network list, explained. 55 processes you see in Activity Monitor, `nettop`, a firewall prompt or Kilobat: what each one is, why it uses the network, how much is normal, and what breaks if you block it. Also see the [hosts they connect to](https://kilobat.app/hosts). Search processes ## Sync and cloud storage iCloud, CloudKit and cloud storage apps: your files, photos and app data going up and down. - [bird](https://kilobat.app/processes/bird): Part of macOS. It runs iCloud Drive, so its traffic is your iCloud Drive files going up and down. - [cloudd](https://kilobat.app/processes/cloudd): Part of macOS. It syncs the iCloud data of apps that use CloudKit, so its traffic belongs to those apps. - [cloudphotod](https://kilobat.app/processes/cloudphotod): Part of macOS. It does all iCloud Photos sync, so its traffic is your photos and videos going up and down. - [Dropbox](https://kilobat.app/processes/dropbox): The Dropbox desktop app. It uploads and downloads your Dropbox files, and with LAN sync it finds other Dropbox computers on the local network. - [fileproviderd](https://kilobat.app/processes/fileproviderd): Part of macOS. It connects cloud storage apps built on File Provider to the Finder, so their file downloads and uploads can show under it. - [OneDrive](https://kilobat.app/processes/onedrive): Microsoft's OneDrive sync app. It uploads and downloads your OneDrive files. Microsoft says that it pauses on metered networks on its own. ## Updates and downloads macOS and app updates, system assets and background downloads that apps hand to macOS. - [appstoreagent](https://kilobat.app/processes/appstoreagent): Part of macOS. They download and update apps from the App Store, so app downloads show under them, not under the App Store app. - [AssetCache](https://kilobat.app/processes/assetcache): Part of macOS. It is Content Caching. It keeps Apple downloads on this Mac and gives them to other Apple devices on the same network. - [mobileassetd](https://kilobat.app/processes/mobileassetd): Part of macOS, not documented by Apple. Kilobat sees it download system assets such as Apple Intelligence models, voices, fonts and dictionaries. - [nsurlsessiond](https://kilobat.app/processes/nsurlsessiond): Part of macOS. It does background downloads and uploads that apps hand to macOS, so its traffic belongs to those apps. - [softwareupdated](https://kilobat.app/processes/softwareupdated): Part of macOS. It checks for and downloads macOS updates, security responses and system files. ## Nearby devices AirDrop, Handoff, AirPlay, Bonjour and your other Apple devices on the same network. - [AirPlayXPCHelper](https://kilobat.app/processes/airplayxpchelper): Part of macOS, not documented by Apple. Its name and its launchd services point to AirPlay, the streaming of video and audio between Apple devices and TVs. - [netbiosd](https://kilobat.app/processes/netbiosd): Part of macOS. It registers and browses NetBIOS names for Windows-style file sharing. Its traffic stays on the local network. - [rapportd](https://kilobat.app/processes/rapportd): Part of macOS. It connects this Mac to your other Apple devices on the local network for Handoff, phone calls and other Continuity features. - [remotepairingd](https://kilobat.app/processes/remotepairingd): Part of macOS and Xcode's device support. They find and talk to paired iPhones and iPads, mostly on the local network. - [screensharingd](https://kilobat.app/processes/screensharingd): Part of macOS. It accepts Screen Sharing and VNC connections from other computers, so another person can see and control this Mac. - [sharingd](https://kilobat.app/processes/sharingd): Part of macOS. It runs AirDrop, Handoff, Instant Hotspot discovery and the shared computers in the Finder. AirDrop transfers can show under it. - [smbd](https://kilobat.app/processes/smbd): Part of macOS. It is the SMB file server for File Sharing, so its traffic is other computers reading and writing this Mac's shared folders. - [sshd](https://kilobat.app/processes/sshd): Part of macOS. It is the SSH server for Remote Login, so other computers can log in to this Mac with SSH or copy files with SFTP. - [wifip2pd](https://kilobat.app/processes/wifip2pd): Part of macOS. It manages peer-to-peer Wi-Fi, the direct link that AirDrop and other nearby-device features use. ## Core networking DNS, Wi-Fi, addresses, time, VPN and the connection itself. - [airportd](https://kilobat.app/processes/airportd): Part of macOS. airportd manages the Wi-Fi interface, and WiFiAgent does Wi-Fi tasks for it in your session. They run Wi-Fi itself, not internet traffic. - [configd](https://kilobat.app/processes/configd): Part of macOS. It keeps the Mac's network configuration and gets its IP addresses with DHCP, so it sends small amounts of traffic to the router. - [mDNSResponder](https://kilobat.app/processes/mdnsresponder): Part of macOS. It handles system DNS lookups for apps and runs Bonjour on the local network, so its traffic can include other apps' name lookups. - [nesessionmanager](https://kilobat.app/processes/nesessionmanager): Part of macOS. They run Network Extension sessions, such as VPNs and content filters, and host their plug-ins, so VPN traffic can show under them. - [networkserviceproxy](https://kilobat.app/processes/networkserviceproxy): Part of macOS. It is the transparent proxy for Apple system services and can carry iCloud Private Relay traffic, so other apps' browsing can show under it. - [symptomsd](https://kilobat.app/processes/symptomsd): Part of macOS, barely documented. Apple says only that it provides services for the Symptom Framework. It runs as the networking user and reacts to network changes. - [timed](https://kilobat.app/processes/timed): Part of macOS. It keeps the clock correct with NTP, so it sends small requests to a time server such as time.apple.com. ## Security and accounts Certificates, Gatekeeper, the keychain, your Apple Account and Find My. - [akd](https://kilobat.app/processes/akd): Part of macOS, not documented by Apple. It is the AuthKit daemon, and its launchd services cover Apple Account sign-in and Sign in with Apple. - [findmydeviced](https://kilobat.app/processes/findmydeviced): Part of macOS. findmydeviced runs Find My Mac. searchpartyd is another Find My daemon that Apple doesn't describe in its man page. - [locationd](https://kilobat.app/processes/locationd): Part of macOS. It runs Location Services, finding where the Mac is for the apps you allowed. - [secd](https://kilobat.app/processes/secd): Part of macOS. It controls access to keychain items. With iCloud Keychain on, your passwords and other synced items travel between your devices. - [syspolicyd](https://kilobat.app/processes/syspolicyd): Part of macOS. It runs the system policy that includes Gatekeeper, which checks new and changed apps for known malware and revoked certificates. - [trustd](https://kilobat.app/processes/trustd): Part of macOS. It checks certificates for every app, and asks certificate authorities whether a certificate was revoked. Its connections are small. ## Apple services Siri, search suggestions, Messages, FaceTime, the App Store and Apple Intelligence. - [apsd](https://kilobat.app/processes/apsd): Part of macOS. It keeps one connection open to Apple's push notification service, so apps and iCloud can tell the Mac that something changed. - [assistantd](https://kilobat.app/processes/assistantd): Part of macOS. It is the Siri daemon, so Siri requests and dictation that need Apple's servers can show under it. - [callservicesd](https://kilobat.app/processes/callservicesd): Part of macOS. callservicesd keeps the state of calls, and CommCenter lets the Mac make and receive phone calls through your iPhone. - [com.apple.WebKit.Networking](https://kilobat.app/processes/webkit-networking): Part of macOS. It is WebKit's network process, which does all network access for Safari and for apps that show web pages, so their browsing shows under it. - [identityservicesd](https://kilobat.app/processes/identityservicesd): Part of macOS. It is the client of the Apple Identity Service, which finds the keys and devices of the people you message or call. - [imagent](https://kilobat.app/processes/imagent): Part of macOS, not documented by Apple. It is the agent behind the Messages app, in the IMCore framework, so iMessage traffic can show under it. - [parsecd](https://kilobat.app/processes/parsecd): Part of macOS. It handles Siri, Spotlight and Safari suggestions and Look Up, so it connects to Apple while you search or type. - [privatecloudcomputed](https://kilobat.app/processes/privatecloudcomputed): Part of macOS. It encrypts and sends Apple Intelligence requests that need a larger model to Apple's Private Cloud Compute servers. - [ScreenTimeAgent](https://kilobat.app/processes/screentimeagent): Part of macOS. It supports Screen Time, which can sync your usage and limits across your devices through iCloud. - [siriactionsd](https://kilobat.app/processes/siriactionsd): Part of macOS. It runs and syncs the shortcuts you make in the Shortcuts app, so iCloud sync of shortcuts can show under it. - [suggestd](https://kilobat.app/processes/suggestd): Part of macOS. It reads content from Mail, Messages and other apps on the Mac to suggest contacts and events. Apple doesn't document much network use. ## Diagnostics, analytics and ads Crash reports, analytics you opted in to and Apple's advertising privacy settings. - [adprivacyd](https://kilobat.app/processes/adprivacyd): Part of macOS. It manages advertising privacy for Apple's own ads in the App Store, Apple News and Stocks, including your opt-out from personalized ads. - [analyticsd](https://kilobat.app/processes/analyticsd): Part of macOS. It collects diagnostics and usage data on the Mac for users who opted in to sharing analytics. - [SubmitDiagInfo](https://kilobat.app/processes/reportcrash): Part of macOS. ReportCrash saves crash reports on the Mac. SubmitDiagInfo sends diagnostic and usage information to Apple, but only if you opted in. ## Apps and helpers Updaters and helpers from other makers: Microsoft, Google, Dropbox, Zoom, Electron apps and command-line tools. - [Autoupdate](https://kilobat.app/processes/sparkle-autoupdate): Part of Sparkle, an open-source update framework that many Mac apps include. It installs an update after the app downloads it. - [Electron Helper](https://kilobat.app/processes/electron-helpers): Part of an app built on Electron. Electron apps run their windows and their network work in helper processes, so the app's traffic shows under “App Helper”. - [Google Chrome Helper](https://kilobat.app/processes/chrome-helper): Part of Google Chrome. Chrome runs its tabs, extensions and network service in helper processes, so your browsing shows under Google Chrome Helper. - [GoogleUpdater](https://kilobat.app/processes/googleupdater): Google's updater for Chrome and other Google apps on the Mac. It checks for updates about every few hours and downloads new versions. - [Microsoft AutoUpdate](https://kilobat.app/processes/microsoft-autoupdate): Microsoft's updater for Office, Teams and other Microsoft apps on the Mac. It checks for updates and, by default, downloads and installs them. - [node](https://kilobat.app/processes/node): The Node.js runtime, not part of macOS. It connects only when a script asks, such as npm installing packages, a dev server, an AI agent or an MCP server. - [ShipIt](https://kilobat.app/processes/shipit): Part of Squirrel.Mac, the updater that many Electron apps include. It installs an update that the app has already downloaded. - [zoom.us](https://kilobat.app/processes/zoom): The Zoom desktop app. During meetings it sends and receives audio and video; Zoom also updates itself if automatic updates are on. Kilobat shows the same short answers in the app: click ⓘ on a connection. Checked on 1 November 2026.