Core networking

What is airportd?

Q: Is WiFiAgent a virus?

No. It is in /System/Library/CoreServices, signed by Apple, and it has a man page.

airportd manages the Mac's wireless interfaces. WiFiAgent is its helper in your login session. They join networks and scan for them; the internet traffic over Wi-Fi belongs to your apps.

Process: airportdAlso seen as: WiFiAgentMade by AppleApplies to: macOS 14 Sonoma and later. Checked on macOS 27.2.Checked: 1 November 2026

Short answer

Part of macOS. airportd manages the Wi-Fi interface, and WiFiAgent does Wi-Fi tasks for it in your session. They run Wi-Fi itself, not internet traffic.

Don’t block

Don't block or stop them. They run Wi-Fi itself, so blocking them saves no data and can break joining networks.

Path: /usr/libexec/airportd /System/Library/CoreServices/WiFiAgent.app/Contents/MacOS/WiFiAgent
launchd label: com.apple.airportd com.apple.wifi.WiFiAgent
Signing identifier: com.apple.airport.airportd com.apple.wifi.WiFiAgent

What it is

The man page says that “airportd manages wireless interfaces” and should not be invoked directly. The program is /usr/libexec/airportd, started for the system as com.apple.airportd.

The WiFiAgent man page calls it the “Wi-Fi User agent”. It performs Wi-Fi tasks on behalf of airportd and must not be invoked directly.

WiFiAgent is an app in /System/Library/CoreServices, started for each user as com.apple.wifi.WiFiAgent.

Why it uses the network

Joining networks. Joining a Wi-Fi network, and signing in to it with a password or WPA, is work for these processes.
Scanning. To show nearby networks and to roam, the Mac scans Wi-Fi channels. A scan is radio work, not internet data.
Your session. Prompts for Wi-Fi passwords and other Wi-Fi tasks in your session run in WiFiAgent.

How much is normal

Little or no internet traffic of their own is normal. Activity Monitor counts the apps' traffic, not Wi-Fi management.

Seeing them in a process list is normal on every Mac with Wi-Fi.

High CPU in airportd can come with frequent scans or a network that drops. It isn't data use.

When it uses a lot, and why

A network that drops. Each reconnect makes them join again. See Mac Wi-Fi disconnects after sleep.
Many saved networks nearby. The Mac compares nearby networks with the ones it knows. See Mac joins the wrong Wi-Fi network.

Is it safe to block?

Don’t block

Don't block or stop them. They run Wi-Fi itself, so blocking them saves no data and can break joining networks.

What breaks if you block it

The Mac may fail to join or stay on Wi-Fi networks.
Wi-Fi password prompts and other Wi-Fi tasks in your session may not appear.

Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it.

Reduce its use

There is nothing to reduce. Their work is the Wi-Fi connection itself.
If Wi-Fi drops often, use Wireless Diagnostics. Hold Option, click the Wi-Fi menu, then choose Open Wireless Diagnostics.
Remove saved networks that you don't use. Choose Apple menu › System Settings › Wi-Fi, then click Advanced.
Don't quit them in Activity Monitor. Wi-Fi stops until macOS starts them again.

See how much it uses

In Terminal, show the current Wi-Fi link, with its signal, channel and rate.
```
kilobat wifi status
```
Open Activity Monitor from Applications › Utilities. Click CPU, then search for airportd.

With Kilobat

In the Kilobat app list, search for airportd. Its row shows the live rate and what it moved today.
In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online.
In Terminal, ask the same question. Add --json for scripts and agents.
```
kilobat explain 'airportd'
```
Show its traffic over one day.
```
kilobat bandwidth 'airportd' day
```
Through MCP, an AI agent asks explain_connection with the process name. It gets the same facts.

The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the network filter, Protection and the hotspot data saver.

Questions

Is WiFiAgent a virus?

No. It is in /System/Library/CoreServices, signed by Apple, and it has a man page.

Why does airportd use CPU?

Scans and reconnects are its work. Apple doesn't document how often it scans.

Sources

airportd(8) and WiFiAgent(8), man pages installed with macOS 27.2
launchd property lists com.apple.airportd and com.apple.wifi.WiFiAgent, macOS 27.2
Apple Support: Use Wireless Diagnostics on your Mac
Apple Support: Wi-Fi settings on Mac

Checked on 1 November 2026.