What Is rapportd on Mac and Why Does It Want Network Access
rapportd is a macOS background process that helps your Apple devices talk to each other. Its manual page calls it the daemon that "enables Phone Call Handoff and other communication features between Apple devices". The real file is /usr/libexec/rapportd, it runs under your own account, and it normally uses almost no CPU. A firewall prompt or a line in a network monitor is usually just this process listening for your other devices, so it is not a sign of trouble by itself.
What you are looking at
Run these to see the process and the ports it listens on:
ps -axo user,pid,%cpu,rss,args | grep '[r]apportd'
lsof -nP -a -c rapportd -i
On the Mac used for this page it took 0.0% CPU and about 20 MB of memory, and it listened on several TCP ports, one of them 49152. Port numbers can differ from Mac to Mac. macOS starts it from two launchd jobs:
/System/Library/LaunchDaemons/com.apple.rapportd.plist
/System/Library/LaunchAgents/com.apple.rapportd-user.plist
Listening is what lets a nearby device find this Mac. It does not mean someone else is connected, and it does not say what is being sent.
Why you might notice it
| You see | What it usually means | Try |
|---|---|---|
| A firewall app asks about rapportd | It wants to accept connections from your devices | Allow it if the path is /usr/libexec/rapportd |
| It appears in a network monitor | Device-to-device traffic | Check the amount before anything else |
| Brief CPU use after waking or joining Wi-Fi | Devices finding each other | Nothing |
| Sustained CPU for many minutes | Something keeps retrying | Restart the Mac, then test with Handoff off |
| Wi-Fi stutters with nearby devices | Possibly AirDrop or Handoff radio work | See Wi-Fi stutter and AWDL |
Apple does not publish a list of what rapportd sends, so treat claims about exact contents with care. To see its connections right now:
nettop -l 1 -p rapportd -x
Can you turn it off
There is no supported switch for the process itself. What you can control is the feature most people want to change: open System Settings › General › AirDrop & Continuity (AirDrop & Handoff on earlier macOS) and turn off Allow Handoff between this Mac and your iCloud devices. The process may keep running after that, since other features can use it. Turning Handoff off is still a fair test: if the load or the traffic stops, you have your answer. If nothing changes, turn it back on, because features such as phone call Handoff depend on this communication.
Ending the process in Activity Monitor is harmless as a test, but launchd starts it again, so it fixes nothing lasting.
Is it malware
The real file is signed by Apple and sits at /usr/libexec/rapportd, on the system volume. You can check the signature:
codesign -dvv /usr/libexec/rapportd 2>&1 | grep -E 'Identifier|Authority'
A process with this name running from your home folder, /tmp or /Users/Shared deserves a closer look. The correct path means the program is genuine, and it does not tell you which of your devices it is talking to.
What not to do
- Do not delete the file or its launchd jobs. They are on the protected system volume, and getting past that protection would weaken the Mac for no gain.
- Do not block it in a firewall as a first move. Many reports tie that to Handoff and related features no longer working between devices.
- Do not use
launchctlcommands from forum posts to disable it. You lose features without knowing what caused the symptom. - Do not read a port number as evidence of a hack. It is listening, and that is its job.
Where Mole fits
Mole lists rapportd in Status with its CPU and memory when it is busy, and the table's search finds it when it is not. Why is this running? in its menu shows the executable, what started it and its listening ports, which is a quick check of what this page describes. Mole treats it as a system network service and offers no way to stop it. The per-app Network list, opened by clicking the network rates in the menu bar, can show it as well. Mole does not change your Handoff, AirDrop or firewall settings, though its WiFi Low Latency switch, if you turn it on, can make AirDrop and Handoff unavailable until you turn it off. For more background, see common Mac processes.
FAQ
What is rapportd on Mac?
It is a system process for communication between Apple devices, including Phone Call Handoff. It runs from /usr/libexec/rapportd.
Why does rapportd want to accept incoming connections?
It listens so that your other Apple devices can reach this Mac. If the path is /usr/libexec/rapportd, the program is Apple's, and blocking it may affect Handoff.
Can I disable rapportd?
There is no supported way to disable the process. You can turn off Handoff in System Settings › General › AirDrop & Continuity, though the process may keep running.
Why is rapportd using CPU or network?
Short bursts when devices find each other are normal. If the CPU use lasts, restart the Mac and test with Handoff off to see if it is the cause.
Is rapportd a virus?
The file at /usr/libexec/rapportd is part of macOS. Check the path, and check the signature with codesign if you want to be sure.