macOS firewall (alf) socketfilterfw doesn't seem to be running properly on macOS catalina 10.15.2 ...

Any ideas on how to troubleshoot / debug the built-in macOS application layer firewall?

  • I've edited your post to make the terminal output more readable. Not sure the formatting/line breaks are correct in all places, can you please cross-check?
    – nohillside
    Jan 20, 2020 at 7:56
  • Also: what exactly is your question (I'm sure it's in there somewhere, I just didn't see it)?
    – nohillside
    Jan 20, 2020 at 7:57
  • Welcome to Ask Different. I would put all your work in the answer. Then you can make the question three or four sentences long....
    – bmike
    Jan 20, 2020 at 23:19

1 Answer 1


Check ALF launch daemon is running

$ sudo launchctl list | grep alf
275 0   com.apple.alf

$ ps -ax | grep socketfilterfw
0   529   0:00.01 /usr/libexec/ApplicationFirewall/socketfilterfw

have restarted a few times and reloaded launchdaeamons with launchctl unload and load with:

unload firewall for editing

$ sudo launchctl unload /System/Library/LaunchAgents/com.apple.alf.useragent.plist
$ sudo launchctl unload /System/Library/LaunchDaemons/com.apple.alf.agent.plist
$ sudo pkill -HUP socketfilterfw

load firewall

$ sudo launchctl load /System/Library/LaunchDaemons/com.apple.alf.agent.plist
$ sudo launchctl load /System/Library/LaunchAgents/com.apple.alf.useragent.plist


socketfilterfw  setting fw.verbose fails
socketfilterfw  cannot open file at line 43353 of [378230ae7f]
socketfilterfw  os_unix.c:43353: (2) open(/var/db/DetachedSignatures) - No such file or directory


com.apple.xpc.launchd[1] (com.apple.xpc.launchd.domain.pid.socketfilterfw.467): - -Failed to bootstrap path: path = /usr/libexec/ApplicationFirewall/socketfilterfw, error = 108: Invalid path

socketfilterfw config

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
Firewall is enabled. (State = 2) 

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getloggingopt
Log Option is brief 

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getblockall
Firewall is set to block all non-essential incoming connections 

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getallowsigned
Automatically allow built-in signed software DISABLED

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode
Stealth mode enabled 

viewing alf.log and appfirewall.log -- empty

$ cat "/private/var/log/appfirewall.log" | wc -l
$ cat "/private/var/log/alf.log" | wc -l

running /usr/libexec/ApplicationFirewall/socketfilterfw manually

sudo /usr/libexec/ApplicationFirewall/socketfilterfw -l (-l for "Do logging and run in daemon mode." )
The value of the token is 15675822025110658885 

kill running FW

Changetrustmode sw_msg_hdr len: 8 type: changetrustmode (13)


WriteRules sw_msg_hdr len: 88 type: proc_rules (1)  proc_name:  proc_id: 0 rule_type: 7 rules: tc: 0x1010 tl: 0x100 tb: 0x100 uc: 0x1010 ub: 0x100

WriteRules sw_msg_hdr len: 88 type: proc_rules (1)
 proc_name: httpd proc_id: 0 rule_type: 2 rules: tc: 0x11 tl: 0x100 tb: 0x100 uc: 0x11 ub: 0x100


ALF: total number of exceptions = 9
ALF app_paths = 0x53600650 app_bundleid = 0x0
ALF: insert bundleid 0x0 alias 0x0 path /usr/libexec/configd to list
ALF app_paths = 0x536007c0 app_bundleid = 0x0
ALF: insert bundleid 0x0 alias 0x0 path /usr/sbin/mDNSResponder to list
ALF app_paths = 0x53600830 app_bundleid = 0x0
ALF: insert bundleid 0x0 alias 0x0 path /usr/sbin/racoon to list
ALF app_paths = 0x536008a0 app_bundleid = 0x0
ALF: total number of explicits = 7
Changelogmode sw_msg_hdr len: 8 type: changelogmode (12)  flag: 0x1
Changelogopt sw_msg_hdr len: 8 type: changelogopt (15)
Adding SCDynamicStoreCreateRunLoopSource to runloop
alfCallback name = com.apple.alf object = FirewallDaemonstarted
zsh: killed     sudo /usr/libexec/ApplicationFirewall/socketfilterfw -l

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .