networkserviceproxy
executablemacOS2.8 MBx86_64, arm64
System networking daemon — manages network configuration, VPN, and DNS policies
Operates as a privileged system daemon controlling network connectivity, VPN tunnels, and DNS resolution policies. Configures WiFi hardware, monitors network reachability, and enforces content filtering and DNS proxying rules. Accesses the Secure Enclave for sealed keys and manages certificate-based authentication for VPN and identity services. Submits diagnostic telemetry to Apple and communicates with 73 network endpoints through XPC services. Reads and writes to protected storage areas and location services data without user prompts.AI
Fingerprint
- Platform
- macOS
- Type
- executable
- Arch
- x86_64, arm64
- Min OS
- 26.1.0
- SDK
- 26.1.0
- File Size
- 2.8 MB
- UUID
- 3185323A-3CF4-323A-84DF-FBBBD370CF32
- Analyzed
- 2026-04-09T09:57:40Z
- CDHash
- c38079ec8aaeb401a145b51d051eda2b2837c484f589c14811b63d6e8596a1b2
Capabilities
LocationAccess location as a system bundle (no user prompt)
com.apple.locationd.effective_bundle[object Object]LocationLocation services access
/System/Library/Frameworks/CoreLocation.framework/Versions/A/CoreLocationLocationLocation services access
/System/Library/Frameworks/_LocationEssentials.framework/Versions/A/_LocationEssentialsNetworkCore networking (HTTP, FTP, DNS)
/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetworkNetworkNetwork configuration and reachability
/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfigurationNetworkModern networking framework (NWConnection)
/System/Library/Frameworks/Network.framework/Versions/A/NetworkNetworkVPN, content filter, DNS proxy APIs
/System/Library/Frameworks/NetworkExtension.framework/Versions/A/NetworkExtensionStoragePrivate storage area access
com.apple.private.security.storage.networkserviceproxy[object Object]StorageException: access additional file paths
com.apple.security.exception.files.absolute-path.read-writeHardwareWiFi configuration (private)
/System/Library/PrivateFrameworks/CoreWiFi.framework/Versions/A/CoreWiFiHardwareDirect hardware/driver communication
/System/Library/Frameworks/IOKit.framework/Versions/A/IOKitIpcProtocol buffer serialization
/System/Library/PrivateFrameworks/ProtocolBuffer.framework/Versions/A/ProtocolBufferAnalyticsApple unified analytics submission
/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalyticsSecurityKeychain, certificates, code signing
/System/Library/Frameworks/Security.framework/Versions/A/SecuritySecurityApple ID authentication
/System/Library/PrivateFrameworks/AuthKit.framework/Versions/A/AuthKitSystemProcess lifecycle management
/System/Library/PrivateFrameworks/RunningBoardServices.framework/Versions/A/RunningBoardServicesFrameworks36
TransparencyAppleMediaServicesRTCReportingCFNetworkProtocolBufferCryptoKitPrivateCoreAnalyticslibmdns.dylibCoreServicesUserNotificationsAppKitCoreDatalibnetworkextension.dylibRunningBoardServicesTrialCaptiveNetworkSystemConfigurationCoreWiFiCloudSubscriptionFeaturesCoreMLNetworkCoreLocationNetworkServiceProxySecuritylibmrc.dylibIOKitNetworkExtensionDeviceIdentityRemoteServiceDiscoveryAuthKitFoundationlibobjc.A.dyliblibSystem.B.dylibCoreFoundation_LocationEssentialsSoftLinking
Entitlements36
Interesting Strings
Bundle IDs(235)
File Paths(45)
$/private/var/mobile/Library/Logs/awd/System/Library/CoreServices/Captive Network Assistant.app/Contents/MacOS/Captive Network Assistant/System/Library/Frameworks/AppKit.framework/Versions/C/AppKit/System/Library/Frameworks/CFNetwork.framework/Versions/A/CFNetwork/System/Library/Frameworks/CoreData.framework/Versions/A/CoreData
telemetry(41)
Network Surfaceentitled
Networking Frameworks
Endpoints(73)
Hostnamenetcts.cdn-apple.com
Hostnamecloudflare.com
Hostnamefastly-edge.com
Hostnameakamaized.net
Hostnamemask-api.icloud.com
Hostnamedummy-api.foobar.com
Hostnamedummy-canary.foobar.com
Hostnamedummy.exp.vendorA-masque.net
Hostnamedummy-h2.foobar.com
Hostnamedummy.vendorB.com
Hostnameodoh.vendorA-dns.com
Ipv40.0.0.0
Ipv4255.255.255.255
Hostnameuse-application-dns.net
Hostnameapple.com
Hostnamecdn-apple.com
Hostnameicloud.com
Hostnamemzstatic.com
Hostnameicloud.com.cn
Hostnamegoogleapis.com
Hostnamegstatic.com
Hostnamegateway.icloud.com
Hostnamesetup.icloud.com
Hostnamecorp.apple.com
Ipv60:8:16
Hostnamewww.apple.com
Hostnamemacosx26.1.internal
Hostnamecrl.apple.com
API Usage
DNA Capability Vector
Location
3
Keychain
2
Network
6
Storage
2
Hardware
2
IPC
1
Analytics
2
Security
2
System
1
Behavioral Profile
URL Endpoints
47
Telemetry Strings
41
File Paths
45
Bundle IDs
235
IOKit Constants
0
Library Functions
0
Structural HashesSHA-256
Static Libraries0 / 2187 functions identified
Functions(2187)
0x100001ca0sub_100001ca0
0x100001fc4sub_100001fc4
0x1000020b4-[NSPPrivacyProxyTokenRegistration tokenLowWaterMarkReachedForAgent:]
0x1000021f4sub_1000021f4
0x100002204sub_100002204
0x10000220csub_10000220c
0x10000231csub_10000231c
0x10000236csub_10000236c
0x1000023b4-[NSPPrivacyProxyTokenRegistration reportErrorForAgent:error:withOptions:]
0x100002530sub_100002530
0x100002660sub_100002660
0x1000026b8sub_1000026b8
0x100002708sub_100002708
0x100002d24sub_100002d24
0x100002e1c-[NSPPrivacyProxyTokenRegistration .cxx_destruct]
0x100002e68+[NSPPrivacyProxyLocationMonitor sharedMonitor]
0x100002ebcsub_100002ebc
0x100002f14-[NSPPrivacyProxyLocationMonitor init]
0x1000030b8sub_1000030b8
0x1000030c8-[NSPPrivacyProxyLocationMonitor geohashFromLocation:]
Imports602 symbols from 34 dylibs
Exports1
_mh_execute_header0x0