--- title: "networkserviceproxy: what it is, why it uses so much data, and whether to block it · Kilobat" url: "https://kilobat.app/processes/networkserviceproxy" description: "networkserviceproxy is the macOS proxy for Apple services, including iCloud Private Relay. Why Safari traffic can show under it, and what breaks if you block it." --- Core networking # What is networkserviceproxy? `networkserviceproxy` is a transparent network proxy for Apple system services. With iCloud Private Relay on, Safari browsing and DNS lookups can go through it, so their bytes show under it. Process: `networkserviceproxy` · Made by Apple · Applies to: macOS 14 Sonoma and later. iCloud Private Relay needs an iCloud+ subscription. Checked on macOS 27.2. · Checked: 1 November 2026 ## Short answer Part of macOS. It is the transparent proxy for Apple system services and can carry iCloud Private Relay traffic, so other apps' browsing can show under it. Block with care Blocking it can break iCloud Private Relay and Apple services that use its proxy. To stop the relay, turn off Private Relay instead. Path `/usr/libexec/networkserviceproxy` launchd label `com.apple.networkserviceproxy` Signing identifier `com.apple.networkserviceproxy` ## What it is The man page calls it the “Transparent network proxy for Apple system services”. The control plane of the NetworkServiceProxy framework runs inside it. The man page says that it downloads the NetworkServiceProxy configuration from the internet and processes feedback from its clients. In some cases, it is also the data plane for specific clients. The program is `/usr/libexec/networkserviceproxy`, started for each user as `com.apple.networkserviceproxy`. Apple doesn't name Private Relay in the man page. Apple's host list names `mask.icloud.com`, `mask-h2.icloud.com` and `mask-api.icloud.com` for iCloud Private Relay. ## Why it uses the network - **Configuration.** The man page says that it downloads its configuration from the internet. - **Proxied traffic.** When it is the data plane for a client, that client's traffic passes through it. Apple Platform Security says that Private Relay covers Safari browsing and all DNS lookups. ## How much is normal With Private Relay off, its traffic is usually small. With Private Relay on, browsing in Safari can show under it. The amount is about what you browse. Apple says that Private Relay uses an ingress proxy run by Apple and an egress proxy run by a content provider. ## When it uses a lot, and why - **Browsing with Private Relay on.** Pages, images and video loaded in Safari go through the relay. A video stream in Safari adds up. - **Many DNS lookups.** Apple says that Private Relay includes all DNS name resolution requests. ## Is it safe to block? Block with care Blocking it can break iCloud Private Relay and Apple services that use its proxy. To stop the relay, turn off Private Relay instead. What breaks if you block it - iCloud Private Relay can't connect, so Safari may fail to load pages while it is on. - Apple system services that use the proxy may fail. Apple doesn't list them. Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it. ## Reduce its use 1. To turn off Private Relay, choose Apple menu › System Settings. Click your name, then iCloud, then Private Relay. 2. To skip it on one network, open that network's Details in Wi-Fi settings. Turn off Limit IP address tracking. See [Limit IP address tracking on a Mac](https://kilobat.app/guides/limit-ip-address-tracking). 3. If a site fails only with Private Relay, see [iCloud Private Relay breaks some websites](https://kilobat.app/guides/icloud-private-relay-sites). 4. Don't quit `networkserviceproxy` in Activity Monitor. macOS starts it again. ## See how much it uses 1. Open Activity Monitor from Applications › Utilities. Click Network. 2. Type `networkserviceproxy` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started. 3. In Terminal, watch only this process. Press d to show the change per second, and q to quit. nettop cuts names to 15 characters. ``` nettop -p 'networkservicep' -P ``` ## With Kilobat 1. In the Kilobat app list, search for `networkserviceproxy`. Its row shows the live rate and what it moved today. 2. In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online. 3. In Terminal, ask the same question. Add `--json` for scripts and agents. ``` kilobat explain 'networkserviceproxy' ``` 4. Show its traffic over one day. ``` kilobat bandwidth 'networkserviceproxy' day ``` 5. Through MCP, an AI agent asks `explain_connection` with the process name. It gets the same facts. The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the [network filter](https://kilobat.app/docs/blocking#filtering), [Protection](https://kilobat.app/docs/blocking#protection) and the [hotspot data saver](https://kilobat.app/save-hotspot-data). ## Hosts it contacts Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac. - [mask.icloud.com](https://kilobat.app/hosts/mask-icloud-com): The iCloud Private Relay hosts. With Private Relay on, Safari browsing and DNS lookups go through them. - [mask-api.icloud.com](https://kilobat.app/hosts/mask-api-icloud-com): An iCloud Private Relay host on TCP 443. Unlike the relay hosts, Apple says that it supports proxies. ## Questions **Why does Safari's traffic show under networkserviceproxy?** With Private Relay on, Safari's connections go through the relay. The proxy, not Safari, then sends the bytes. **Does Private Relay hide my traffic from Apple?** Apple says that no single party, not even Apple, can correlate your IP address and your browsing. ## Sources - networkserviceproxy(8), man page installed with macOS 27.2 - launchd property list com.apple.networkserviceproxy, macOS 27.2 - [Apple Platform Security: iCloud Private Relay security](https://support.apple.com/guide/security/icloud-private-relay-security-secad8ce3233/web) - [Apple Support: About iCloud Private Relay](https://support.apple.com/en-us/102602) - [Apple Support: Use iCloud Private Relay on Mac](https://support.apple.com/guide/mac-help/mchlecadabe0/mac) - [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555) Checked on 1 November 2026. ## Related - [mDNSResponder](https://kilobat.app/processes/mdnsresponder): Part of macOS. It handles system DNS lookups for apps and runs Bonjour on the local network, so its traffic can include other apps' name lookups. - [com.apple.WebKit.Networking](https://kilobat.app/processes/webkit-networking): Part of macOS. It is WebKit's network process, which does all network access for Safari and for apps that show web pages, so their browsing shows under it. - [iCloud Private Relay breaks some websites](https://kilobat.app/guides/icloud-private-relay-sites) - [Limit IP address tracking on a Mac](https://kilobat.app/guides/limit-ip-address-tracking)