Updates and downloads

What is softwareupdated?

Q: Can I see what it is downloading?

Run softwareupdate --list in Terminal. It lists the updates that macOS found.

softwareupdated is the macOS Software Update daemon. It checks for macOS updates and downloads them. The Automatic Updates options in System Settings decide when it downloads without asking.

Process: softwareupdatedMade by AppleApplies to: macOS 14 Sonoma and later. Checked on macOS 27.2.Checked: 1 November 2026

Short answer

Part of macOS. It checks for and downloads macOS updates, security responses and system files.

Don’t block

Don't block it for long. The Mac stops getting macOS and security updates. On a hotspot, turn off automatic downloads instead.

Path: /System/Library/CoreServices/Software Update.app/Contents/Resources/softwareupdated
launchd label: com.apple.softwareupdated
Signing identifier: com.apple.softwareupdated

What it is

The man page calls it “the main daemon responsible for running software updates”. The program is inside the Software Update app in /System/Library/CoreServices.

System Settings › General › Software Update and the softwareupdate command both use it.

Apple Platform Security says that every update of a Mac with Apple silicon needs a network connection to Apple. Apple's installation server signs each update for the specific device.

For over-the-air updates, Apple says that only the components needed for the update download, not the whole operating system.

Why it uses the network

Checks for updates. macOS checks for new updates in the background. A check is small.
Downloads of updates. With “Download new updates when available” on, it downloads macOS updates without asking.
Security responses and system files. Apple lists “Install Security Responses and system files” as a separate automatic option. Background Security Improvements, from macOS 26.1, are lightweight security releases between updates.

How much is normal

Checks are small and short. Large downloads after Apple releases an update are expected.

A macOS update can be several gigabytes.

On a hotspot, one update can use a large part of a data plan. That's when to change the settings below.

When it uses a lot, and why

A new macOS release. With automatic downloads on, the update downloads as soon as macOS finds it, often in the background.
You click Update Now. With automatic downloads off, the whole update downloads when you start it. Do this on your usual network.
Content Caching on the network. Apple says that a Mac with Content Caching can keep software updates, so other devices don't download them again. They still need to contact Apple to complete the update.

Is it safe to block?

Don’t block

Don't block it for long. The Mac stops getting macOS and security updates. On a hotspot, turn off automatic downloads instead.

What breaks if you block it

macOS updates and upgrades can't download or install. Apple's server must sign each update.
Security responses and system data files stop arriving, so security fixes fall behind.
Software Update in System Settings and the softwareupdate command can't check for updates.

Blocking means a firewall rule that refuses its connections. Don’t quit or disable a macOS process to save data: macOS starts it again, and other features depend on it.

Reduce its use

Choose Apple menu › System Settings › General › Software Update. Click the Info button next to Automatic Updates.
Turn off “Download new updates when available”. Click Done.
Install the updates later, on your usual network. Software Update still shows them.
Keep security updates current. Turn the option on again when you are back on an unmetered network.
Don't quit softwareupdated in Activity Monitor. macOS starts it again.

See how much it uses

Open Activity Monitor from Applications › Utilities. Click Network.
Type softwareupdated in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved since it started.
In Terminal, watch only this process. Press d to show the change per second, and q to quit.
```
nettop -p 'softwareupdated' -P
```

With Kilobat

In the Kilobat app list, search for softwareupdated. Its row shows the live rate and what it moved today.
In Connections, click the ⓘ button on one of its rows. The popover shows this page’s short answer, without going online.
In Terminal, ask the same question. Add --json for scripts and agents.
```
kilobat explain 'softwareupdated'
```
Show its traffic over one day.
```
kilobat bandwidth 'softwareupdated' day
```
Through MCP, an AI agent asks explain_connection with the process name. It gets the same facts.

The live view and the explanations are free. History in the app needs Kilobat Pro. Blocking needs Pro and the network filter: see the network filter, Protection and the hotspot data saver.

Hosts it contacts

Apple and the maker document these hosts for this feature. A process can also contact others; Kilobat’s Connections tab shows what it actually opens on your Mac.

mesu.apple.comApple's host for software update catalogs, the lists of updates that devices check against.Apple →swscan.apple.comAn Apple host for macOS updates, listed in Apple's software update section.Apple →swdist.apple.comAn Apple host for macOS updates, listed in Apple's software update section.Apple →swdownload.apple.comAn Apple host for macOS update downloads. Apple says that it works through proxies.Apple →swcdn.apple.comApple's host for macOS update downloads. Big transfers from it are macOS updates.Apple →updates.cdn-apple.comApple's hosts for software update downloads, over HTTPS and plain HTTP, for all Apple platforms.Apple →gs.apple.comAn Apple host that devices need during setup and for operating system updates. Apple lists it in both sections of its host list.Apple →gdmf.apple.comApple's software update catalog host. Device management services also ask it which updates are available.Apple →xp.apple.comAn Apple host that Apple lists in the software update section of its host list, without saying what it does.Apple →*.aaplimg.comAn Apple domain behind Apple's content delivery. Many apple.com hosts resolve to names under it, so connections show up with it.Apple →*.cdn-apple.comAn Apple content delivery domain. Apple lists it for iCloud services; update and sign-in hosts sit under it too.Apple →

Questions

Does Low Data Mode stop Software Update?

Apple describes Low Data Mode only as a way to reduce data use. To be sure, turn off “Download new updates when available”.

Is it safe to turn off automatic downloads?

Yes, for a short time. You lose no updates. Install them when you are back on your usual network.

Can I see what it is downloading?

Run softwareupdate --list in Terminal. It lists the updates that macOS found.

Sources

softwareupdated(8) and softwareupdate(8), man pages installed with macOS 27.2
Apple Support: Software Update settings on Mac
Apple Support: Keep your Mac up to date
Apple Platform Security: Secure software updates
Apple Platform Security: Background Security Improvements
Apple Support: Use Apple products on enterprise networks

Checked on 1 November 2026.