What is backupd on Mac, and why is it using the network?

Last updated: 2026-08-08

What it is

backupd is the Apple-provided daemon that creates Time Machine backups and manages backup history. It is part of macOS, carries the identifier com.apple.backupd, and runs from /System/Library/CoreServices/TimeMachine/backupd.

macOS starts backupd when it is needed. Users are not expected to launch it manually, and forcibly disabling it is not a supported way to manage Time Machine. If backupd appears in a process or network monitor, its presence alone does not mean that a backup is being uploaded continuously.

The destination matters. When Time Machine backs up to a directly connected disk, the backup data does not travel over the network. Network transfer begins only when the configured Time Machine destination is reached through the network.

Why it talks to the network

backupd needs a network connection when Time Machine is configured to use a network backup destination. A connection may be triggered by an automatic backup, by choosing “Back Up Now,” or by starting a backup with tmutil. During that work, backupd connects to and writes data to the configured destination.

Supported destination types can include a Time Machine-compatible SMB NAS, a Time Machine destination shared by another Mac, and an AirPort Time Capsule or older AFP destination that remains supported by the current system. The transfer is going to the destination selected by the user, not to an unspecified Apple cloud service.

Bonjour notifications can take part in discovering a network backup server. However, Apple’s public information does not establish that all discovery traffic is attributed directly to backupd; components such as mDNSResponder may handle some of it. Time Machine also reconnects to a network disk when restoring data, but it has not been verified that the resulting recovery traffic is recorded directly under backupd.

These attribution limits matter when reading a per-process network monitor. The bytes shown for backupd may not represent every packet involved in discovering or accessing a Time Machine destination, and unrelated discovery traffic should not automatically be assigned to it.

How much traffic is normal

There is no reliable universal traffic range for backupd. A normal amount cannot be reduced to a particular number of megabytes or gigabytes because it depends on the amount of data included in the backup and on what has changed since the previous backup.

The first backup to a network destination is commonly a long-running, high-volume transfer. Its size follows the actual amount of included data. Subsequent backups mainly process changes made after the previous backup, so they are usually smaller. They can still be large when photos, videos, virtual machines, or large databases have changed.

When no backup is running, traffic used to check for or discover a destination is normally much smaller than the backup payload itself. With a directly attached backup disk, the backup payload produces no network traffic.

A sudden large transfer is therefore not enough to identify a problem. Check whether Time Machine is performing its first backup, whether a backup is currently active, whether the destination is on the network, and whether large files have recently changed. Those facts provide more useful context than comparing the process against a fixed traffic threshold that has no reliable basis.

Can you turn it off

Forcibly terminating or disabling backupd is not recommended. launchd can start it again when macOS needs it, and killing it while a backup is active may interrupt that backup. Apple’s manual page also states that users should not run the daemon manually.

If the goal is to stop scheduled automatic backups, change the frequency here:

Apple menu  > System Settings > General > Time Machine > Options > Back Up Frequency > Manually

This setting stops timed automatic backups. It does not disable backupd; macOS can still launch the process when needed. You must start future backups yourself, and if you leave them undone for a long time, the available restore versions will become increasingly old.

Moderate traffic limiting may simply make a network backup take longer, but that is not guaranteed to be the only effect. A limit set too low can prevent backups from finishing within the expected time, leave restore points stale, and increase the risk of timeouts or failures. Apple does not provide or endorse a system setting that applies a process-specific bandwidth limit to backupd.

What people get wrong

• “backupd is malware or an Apple cloud uploader.” It is an Apple-signed Time Machine system process. It writes backup data to the destination configured by the user, and Time Machine does not use iCloud as a backup disk.

• “If backupd is running, it must be uploading continuously.” Process activity does not prove continuous network transfer. A backup to a directly connected disk does not send its payload over the network; substantial network use mainly occurs when backupd accesses a network Time Machine destination.

• “Every backup retransmits the entire Mac.” The first backup may be very large, but later backups mainly process data changed since the previous backup. Large changed files can still make an incremental backup substantial.

• “Heavy backupd traffic proves that macOS is collecting telemetry or monitoring me.” A network Time Machine backup can legitimately generate a large transfer. Check the configured destination and current backup status before interpreting the traffic.

• “Ending backupd or disabling com.apple.backupd is a safe system optimization.” launchd may start it again, and forcibly ending it can interrupt an active backup. Users are not supposed to launch or manage the daemon directly.

• “Throttling only makes the backup slower.” A moderate limit often extends the backup duration, but an excessively low limit can keep the backup from completing, allow restore points to grow old, or contribute to timeouts and failures. Apple offers no endorsed per-process throttling control for backupd.

• “Time Machine local snapshots are continuously uploaded to Apple.” Local snapshots remain on the source APFS disk. When a network backup runs, relevant changed data is written to the network destination selected by the user.

Seeing what it actually used

The next step is to compare backupd traffic in Bytetally with the time a backup ran and whether Time Machine was using a local or network destination. Check both upload and download totals instead of inferring behavior from the process merely being present. Remember that the exact share handled by discovery or file-system helper components has not been verified.

Related processes

Common questions