6

I'm seeing 5 processes with network activity ( sending/receiving bytes ). I'm not sure whether these are normal occurrences?

List of processes

  • apsd
  • ntpd
  • mDNSResponder
  • trustd
  • netbiosd

I researched a few of those and some were associated to file sharing via windows or bonjour, however I don't have any other PCs on my network to even begin sharing files with.

Improve this question
3

2 Answers 2

Reset to default
7

apsd - Used for FaceTime push notifications

ntpd - Used to synchronize clock

mDNSResponder - Part of the Bonjour protocol, used to scan your network for other Bonjour-enabled devices (printers, computers, etc...)

trustd - Used for validating SSL certificates

netbiosd - Used when interacting with Microsoft shared drives

This is all normal activity. However, if you are worried about security, you can disable the services you don't plan on using.

Edit: You might not want to disable ntpd and trustd as they are necessary for basic functionality such as browsing websites.

Improve this answer
6
  • 2
    I would not disable any of those services, save netbiosd since they cover some pretty important functionality and security. Things will break if time isn’t kept up and security certificates can’t be evaluated. even the last, I would want to have a good reason to disable it since the effort would be a lot higher than the payback in most cases for me (at least)
    – bmike ♦
    Commented Oct 29, 2019 at 16:45
  • 1
    @bmike Correct, ntpd and trustd are necessary for basic functionality. But the rest can be disabled if you know you won't need to use the service, even though it might be overkill.
    – slightly_toasted
    Commented Oct 29, 2019 at 16:51
  • 5
    mDNSResponder includes localhost only service discovery (dns-sd). Disabling it can affect applications that never send traffic over the network.
    – Graham Miln
    Commented Oct 29, 2019 at 17:11
  • 2
    ntpd is safe to disable in the short term: most computer clocks don't drift by more than a few seconds a day, and most security doesn't complain until your clock is off by an hour or more (the big exception is Kerberos, which requires no more than five minutes of offset).
    – Mark
    Commented Oct 29, 2019 at 23:20
  • Do you, @bmike or anyone know if netbiosd connections can be initiated by a router (Netgear) with a fileserver ("readyshare") feature? I have this USB drive on the router set to mount in login items on the Mac but the outgoing netbiosd alert doesn't pop up every time, that I've noticed. I have zero Windows machines on the network and I sorta narrowed it to the router fileshare - EDIT: [but] I cannot replicate it.
    – armipunk
    Commented Dec 8, 2019 at 14:14
2

Originally, in Mac OS X 10.2 in 2002, the central purpose of mDNSResponder was to respond to Multicast DNS requests. Nowadays mDNSResponder is responsible for Unicast DNS as well as Multicast DNS, for both hostname lookups and service discovery. It also manages other networking functions, like “Wake for network access”. Disabling mDNSResponder would break a number of networking functions, not least the ability to use DNS hostnames in URLs when using a web browser, and would most likely render the device unbootable.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .