Since early November, I’ve been seeing reports of High Sierra users being presented with a dialog box from the Firewall asking whether the user wants to accept incoming network connections to rapportd.

This is causing some confusion among troubleshooters as there’s a fairly notorious process with the same name associated with IBM’s (badly-performing) Trusteer software. This latter often causes system slow downs and the general recommendation is to remove it unless you absolutely can’t live without it.

However, the rapportd process responsible for the dialog has nothing to do with IBM’s Trusteer and is, in fact, an Apple daemon introduced in 10.12. According to the man page, Apple’s rapportd is a daemon providing support for the Rapport connectivity framework. Although rapportd is bundled with 10.12, it appears to have only become active in 10.13.

Issuing

lsof -i -P | grep -i rapport

at the command line doesn’t return any hits on my 10.12 machine, but High Sierra reveals that Apple’s rapportd process is listening for network connections on port 49158. Further investigations have found that rapportd is connected to Apple’s HomeKit framework, a home automation platform for controlling smart home products with iOS apps and Siri voice commands, and is likely related to Airplay 2.

To verify which rapportd process you’re dealing with, jump into Terminal and paste this command:

ps aux | grep rapportd

Alternatively, if you’re a DetectX Swift user, you can search for it in the Profiler view (Command-F evokes the Find inspector bar):

If the search or find reveals a process address as /usr/libexec/rapportd, that’s your Apple friend and you can safely allow the connection. Searches for rapportd also might produce any of the following paths, all of which are legitimate:

/System/Library/LaunchDaemons/com.apple.rapportd.plist
/System/Library/Sandbox/Profiles/com.apple.rapportd.sb
/usr/libexec/rapportd
/usr/share/man/man8/rapportd.8

On the other hand, if you see a path address for

/Library/Rapport/bin/rapportd.app/Contents/MacOS/rapportd

or searches reveal

/Library/LaunchAgents/trusteer.rapport.rapportd.plist

that’s the IBM app you’re looking at. Whether you want to allow that or uninstall that will depend on both your mac’s performance and whether you need the software or not.

Hope that helps to clear up some of the confusion!

🙂