What is rapportd on Mac?
rapportd is how your Mac, iPhone, iPad and Apple TV find and talk to each other on your local network. It’s the reason for that “Do you want rapportd to accept incoming network connections?” prompt. Allowing it is safe if it’s the Apple one in /usr/libexec.
Updated
- Process
rapportd- Comes from
- macOS
- Safe?
- Safe. Apple Continuity daemon; allow it, unless the path isn’t /usr/libexec/rapportd.
What rapportd does
rapportd (/usr/libexec/rapportd, identifier com.apple.rapportd) has been part of macOS since High Sierra. Its man page describes it as the daemon that enables Phone Call Handoff and other communication between Apple devices. In practice it maintains the secure, authenticated channel your devices use for:
- Handoff and Universal Clipboard (with sharingd)
- Universal Control and Sidecar
- iPhone call and SMS relay
- controlling an Apple TV from your iPhone, and parts of HomeKit
- the Apple Watch unlock and approval features
It discovers peers using Bonjour on your local network and Bluetooth LE nearby, then talks to them over Wi-Fi.
Why it shows up
- The firewall prompt: if the macOS firewall is on, rapportd needs to accept connections from your other devices, so you see a prompt, sometimes after every update.
- Network activity on big networks: in offices or dorms, it sees many Bonjour devices.
- CPU: usually tiny. Spikes when Universal Control is active or devices keep connecting and disconnecting.
How to make it calm down
If you use Continuity features, allow it and you’re done. To stop the prompts without allowing, or to cut its activity:
- Turn off Handoff in System Settings › General › AirDrop & Handoff.
- Turn off Universal Control under System Settings › Displays › Advanced (“Allow your pointer and keyboard to move between any nearby Mac or iPad”).
- Check firewall entries in System Settings › Network › Firewall › Options.
To see what it’s connected to:
lsof -nP -a -c rapportd -i
When to worry
This is the one process on this list with a well-known name clash. Check the path:
ps -o pid,user,command -p $(pgrep rapportd)
codesign -dv --verbose=2 /usr/libexec/rapportd 2>&1 | grep -E 'Identifier|Authority'
Apple’s shows Identifier=com.apple.rapportd and Authority=Software Signing. If you see a rapportd under /Library/Rapport/, that’s IBM Trusteer Rapport. It isn’t malware, but if you didn’t knowingly install it for your bank, remove it with its uninstaller. Any rapportd elsewhere (home folder, /tmp, /Users/Shared) should be treated as suspicious.
Seeing it in Stat Space
Stat Space’s process inspector shows the executable path, signer, Team ID and notarization for any process, which settles the Apple-vs-Trusteer question in one tap. With Pro, “who’s phoning home” lists the remote hosts each app is talking to, so you can confirm rapportd is only talking to devices on your own network.
Questions
Should I allow rapportd to accept incoming connections?
Yes, if the path is /usr/libexec/rapportd. Denying it can break Handoff, Universal Control, AirPlay to Mac and iPhone call relay.
Is rapportd related to Trusteer Rapport?
No. IBM Trusteer Rapport is banking security software some banks recommend. It installs its own rapportd under /Library/Rapport. Apple’s rapportd is part of macOS.
Why is rapportd connecting to so many IP addresses?
It discovers devices on your local network over Bonjour. On a large shared network, it may see and try many peers.
Know what your Mac is doing, without adding to it.
Free, no account. Pro is $9.99 once for the first 100 buyers.