What Is rapportd? The Apple Processes Listening on Your Mac

Published: 12 November 2026
Tested on: macOS 27.2
Author: Christoph Schröder

rapportd is Apple's Continuity daemon, the process behind Handoff. It is part of macOS, and so are most other unfamiliar names in a port list: ControlCenter on TCP 5000 and 7000 is AirPlay Receiver, and mDNSResponder on UDP 5353 is Bonjour and DNS. If you don't want one of these ports open, turn off the feature in System Settings. Killing the process doesn't help, because launchd starts it again. To see what is listening right now:

lsof +c 0 -nP -iTCP -sTCP:LISTEN
lsof +c 0 -nP -iUDP

+c 0 prints full process names. Without it, identityservicesd is cut to identitys.

Apple processes and the ports they use

Process	What it's for	Ports	Switch in System Settings
`rapportd`	Handoff, Continuity	a random high TCP port, sometimes UDP 3722	General › AirDrop & Continuity › Allow Handoff
`ControlCenter`	AirPlay Receiver	TCP 5000, 7000	General › AirDrop & Continuity › AirPlay Receiver
`sharingd`	AirDrop, Handoff, Instant Hotspot	UDP, no port	General › AirDrop & Continuity
`identityservicesd`	iMessage and FaceTime identity	UDP, no port	none
`replicatord`	iPhone widgets, iPhone Mirroring	one high UDP port	Desktop & Dock › iPhone Widgets
`mDNSResponder`	Bonjour and DNS	UDP 5353, sometimes 53	none
Chromium browsers	finding Cast devices	UDP 5353	quit the browser
`launchd`	holds sockets for sharing services	TCP 22, 445, 5900	General › Sharing
`smbd`	File Sharing	TCP 445	General › Sharing › File Sharing
`screensharingd`	Screen Sharing	TCP 5900	General › Sharing › Screen Sharing
`netbiosd`	NetBIOS names	UDP 137, 138	none
`cupsd`	printing	TCP 631, localhost only	General › Sharing › Printer Sharing opens it to the network

Setting names are from macOS 27.2. Before macOS 26 the pane is called AirDrop & Handoff.

In lsof's last column, *:59034 means all interfaces, so other devices can try to connect. 127.0.0.1:631 is reachable only from this Mac. UDP *:* is a socket with no port, which nothing can reach. A line with -> is a connection, not a listener.

What is rapportd?

Its man page calls it the daemon "that enables Phone Call Handoff and other communication features between Apple devices." It listens on one TCP port on all interfaces, and the port changes: 49178 one week, 57833 the next. Sometimes it also holds UDP 3722. Without -P, lsof prints that as xserveraid, the name /etc/services gives port 3722, which has nothing to do with rapportd.

The switch is "Allow Handoff between this Mac and your iCloud devices". Universal Clipboard, Universal Control and Sidecar depend on it. If the firewall asks whether rapportd may accept incoming connections, allow it if you use any of those.

ControlCenter on ports 5000 and 7000

That is AirPlay Receiver, which is often on. It is the usual reason Flask or a Docker container can't get port 5000.

mDNSResponder, and Chrome on UDP 5353

man mDNSResponder describes Apple's "Multicast and Unicast DNS daemon". It answers Bonjour queries on UDP 5353, which is how your Mac finds printers and AirPlay devices, and every hostname lookup goes through it, so leave it running. It sometimes listens on port 53 as well, which can block a container that wants that port (docker/for-mac#7008).

Chromium browsers open UDP 5353 themselves to find Cast devices. A single Brave Browser Helper can hold a dozen sockets on *:5353. Several processes sharing that port is normal.

launchd on port 22, 445 or 5900

Those are Remote Login, File Sharing and Screen Sharing. launchd holds the socket and starts sshd, smbd or screensharingd on the first connection. All three are off until you turn them on in General › Sharing, and turning them off closes the port.

netbiosd has no switch. On macOS 27.2 it holds UDP 137 and 138 on all interfaces even with File Sharing off.

Why doesn't lsof show mDNSResponder?

Without sudo, lsof lists only your own processes. rapportd, ControlCenter and sharingd run as you. mDNSResponder, netbiosd, launchd and cupsd run as root or a system account, so they need sudo lsof. Apple's nettop shows them without it:

nettop -L 1 -n -J state

mDNSResponder.274,,
udp4 *:5353<->*:*,,
udp6 *.5353<->*.*,,
netbiosd.680,,
udp4 *:138<->*:*,,
udp4 *:137<->*:*,,

The output here is trimmed to two daemons. netstat -an is no help on macOS 27, where it can print no ports at all.

Checking that a process is really Apple's

Check where the process runs from and who signed it:

ps -o user=,comm= -p "$(pgrep -x rapportd)"
codesign -dvv /usr/libexec/rapportd 2>&1 | grep Authority

alex      /usr/libexec/rapportd
Authority=macOS Software Signing
Authority=Apple Code Signing Certification Authority
Authority=Apple Root CA

Apple's daemons carry this chain. A process with one of these names that runs from your home folder, or is signed by someone else, deserves a closer look.

Portis shows all of these in one table without sudo, root's daemons included, with an orange dot on the ports the network can reach. It can end only your own processes, so mDNSResponder and the other root daemons are listed but can't be killed from it. The switch in System Settings is the right tool for those anyway.