13

I have recently installed an SSD in my iMac and restored my backup using SuperDuper!. Since then, xpcproxy seems to randomly download stuff and uses all my bandwidth for minutes on end. What would be the reason?

I am running the latest version of El Capitan (yesterday's update).

Improve this question
  • 1
    How are you determining that xpcproxy is randomly downloading stuff? XPC is an inter-process communication mechanism. So under normal circumstances, you will see data passing through xpcproxy, but it will be moving between two processes on your machine, rather than going to or from the internet. – calum_b Mar 22 '16 at 11:03
  • 1
    I use iStat menu and it shows xpcproxy is using all my bandwidth. You're right, it might be something else using it through it, but it never happened until I restore my superduper clone. – user2747220 Mar 22 '16 at 12:27
  • Same thing is happening on my system right now. OS X 10.11.6 – dhchdhd Aug 17 '16 at 4:14
9

In my case, it was nsurlsessiond (by sudo lsof | grep -i nsurl)

Fired up Charles with https MITM'ing, but didn't find anything talking to Apple (but it wasn't making any new connections to intercept).

It seemed to go away after a little while.

EDIT: After sleeping and waking it up with Charles running, xpcproxy showed it was downloading pictures from iCloud ([redacted].icloud-content.com).

(xpc services need some better monitoring tools and/or they're not well-known.)

Improve this answer
3

Here is how I found out which app was causing all this bandwidth:

(I was downloading roughly 300k)

I started Wireshark for a couple of seconds. Then sorted the resulting list by source ip. Now I looked which ip was listed most often (therefore sending the most traffic to me).

That got me an IP address which I looked up who owns it: https://db-ip.com/all/162.222.43 Turns out the address was owned by CrashPlan. So I fired up CrashPlan and saw that is was doing some synchronisation.

Improve this answer
3

I've also observed it running on Yosemite. As for what xpcproxy actually is, it's part of the OS X anti-malware software, according to this Apple forum post, which also warns not to mess with system processes such as this.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .