What Mac System Traffic Is Normal? A Guide to the Names You Will See
The first time you look at what your Mac connects to, most of the names will be unfamiliar and none of them will be apps you installed. That is normal. macOS does a great deal of its network work through small background programs with technical names, and telling those apart from something worth worrying about is the whole skill.
Here is the list you will actually meet, what each one does, and which ones will break your Mac if you block them.
The ones you will see constantly
mDNSResponder is how your Mac looks up website names, and how it finds printers and other devices on your local network. It appears against almost everything, because almost everything starts with a name lookup. It is also why some tools attribute a connection to mDNSResponder rather than to the app that actually wanted it, which is a common source of confusion.
trustd checks that certificates are valid. Every time you visit a secure website or open an app, this is what verifies the signature. Blocking it causes slow, mysterious failures across the whole system.
nsurlsessiond carries out background downloads and uploads on behalf of other apps. It is the delivery service, not the customer, so seeing it connect somewhere means some app asked it to.
cloudd and bird are iCloud. They sync documents, photos and settings. If you use iCloud, they will be busy.
softwareupdated and Software Update check for and fetch macOS updates.
apsd is Apple Push Notification Service. It holds a long-lived connection to Apple so notifications and iMessage arrive.
timed and ntpd keep your clock accurate. This matters more than it sounds: a wrong clock breaks certificate validation, which breaks most secure connections.
configd manages network configuration itself.
What must never be blocked
Some of these have consequences serious enough to name explicitly.
| Program | If you block it |
|---|---|
trustd | Certificate checks fail. Apps launch slowly or not at all, secure sites break |
mDNSResponder | Name lookups stop. Effectively, no internet |
timed, ntpd | The clock drifts, and eventually secure connections start failing for no visible reason |
softwareupdated | Your Mac stops receiving security updates |
configd | Network configuration breaks |
The pattern is worth internalising: the dangerous blocks are the ones whose failure mode is delayed and confusing. Blocking software updates does not break anything today. It breaks something in eight months, and nothing will connect the two events.
This is why a firewall app worth using warns you before you block a system service, and names what will stop working. MiniFirewall shows that warning with Cancel as the default button, so the accidental press does the safe thing, and lets you proceed anyway if you meant it.
What is safe to block, if you want to
Analytics and diagnostics. macOS sends usage and crash information to Apple, and you can turn this off properly in System Settings, Privacy & Security, Analytics & Improvements. Using the setting is better than blocking it.
Siri and Apple Intelligence, if you do not use them. Again, the settings are the cleaner route.
Individual apps’ analytics. This is where a firewall genuinely earns its place. When a third-party app contacts an analytics company, blocking that destination usually costs you nothing and there is often no setting to do it with.
The rule of thumb
Ask whether the destination matches the program’s job.
softwareupdated contacting swscan.apple.com is exactly what that program is for. A note-taking app contacting an advertising network is not what that app is for. You do not need to know anything technical to make that judgement, only what the thing is supposed to do.
Apple’s own domains, apple.com, icloud.com, mzstatic.com, apple-dns.net and similar, are the normal background of any Mac. Volume there is not a signal.
Why does my Mac connect at night?
Because it is doing maintenance. macOS schedules updates, backups, iCloud sync and index maintenance for when you are not using the machine, which is deliberate and helpful.
Traffic overnight is only interesting if the destination is unusual. An app you have not opened in months contacting a server at three in the morning is worth a look. softwareupdated doing the same thing is your Mac working correctly.
How do I hide all this and just see my own apps?
Any tool intended for non-technical use should offer this, because the system noise genuinely does drown out everything else. In MiniFirewall, a filter that hides macOS system traffic is on by default at every launch, so what you see first is your own apps.
One deliberate exception is worth knowing: a blocked row is never hidden by that filter. Hiding ordinary Apple traffic is a convenience. Hiding the row that proves your block is working would be a lie, so it does not happen.
Sources
- Apple, Share analytics with Apple
- Apple, Guard your privacy on Mac
- Apple, If your Mac needs network access for Apple services, on the addresses macOS itself uses