Since early November, I’ve been seeing reports of High Sierra users being presented with a dialog box from the Firewall asking whether the user wants to accept incoming network connections to
This is causing some confusion among troubleshooters as there’s a fairly notorious process with the same name associated with IBM’s (badly-performing) Trusteer software. This latter often causes system slow downs and the general recommendation is to remove it unless you absolutely can’t live without it.
rapportd process responsible for the dialog has nothing to do with IBM’s Trusteer and is, in fact, an Apple daemon introduced in 10.12. According to the man page, Apple’s
rapportd is a daemon providing support for the Rapport connectivity framework. Although
rapportd is bundled with 10.12, it appears to have only become active in 10.13.
lsof -i -P | grep -i rapport
at the command line doesn’t return any hits on my 10.12 machine, but High Sierra reveals that Apple’s
rapportd process is listening for network connections on port 49158. Further investigations have found that
rapportd is connected to Apple’s HomeKit framework, a home automation platform for controlling smart home products with iOS apps and Siri voice commands, and is likely related to Airplay 2.
To verify which
rapportd process you’re dealing with, jump into Terminal and paste this command:
ps aux | grep rapportd
Alternatively, if you’re a DetectX Swift user, you can search for it in the Profiler view (Command-F evokes the Find inspector bar):
If the search or find reveals a process address as
/usr/libexec/rapportd, that’s your Apple friend and you can safely allow the connection. Searches for
rapportd also might produce any of the following paths, all of which are legitimate:
On the other hand, if you see a path address for
or searches reveal
that’s the IBM app you’re looking at. Whether you want to allow that or uninstall that will depend on both your mac’s performance and whether you need the software or not.
Hope that helps to clear up some of the confusion!