Why is CFNetworkAgent using the network?

Last updated: 2026-08-08

What it is

CFNetworkAgent is a helper process included by Apple with the CFNetwork framework in macOS. Its verified job is to download and execute proxy auto-configuration, or PAC, scripts. For a particular URL, a PAC script returns a decision: connect directly, use a named proxy server, or consider a list of connection options.

This matches the contents of the system binary. The verified executable is located inside the macOS CFNetwork framework, has an Apple platform signature, and identifies itself as com.apple.cfnetwork.CFNetworkAgent. Its symbols refer to JavaScriptCore, PAC queries and results, proxy types, DNS-related PAC functions, WPAD URLs, and URL sessions. The accompanying PAC support file also implements functions including dnsResolve, isResolvable, and isInNet.

CFNetworkAgent is therefore part of proxy selection, not normally the proxy that carries an application’s traffic. It may help decide how another connection should be made, but it does not usually transfer the web pages, downloads, media, or other files that the application ultimately requests.

Why it talks to the network

CFNetworkAgent needs network access when macOS or an application asks CFNetwork to determine a route from an automatic proxy configuration. If “Automatic proxy configuration” is enabled, it may retrieve a PAC file from an HTTP or HTTPS address specified by an administrator. Applications using CFNetwork can then ask for the appropriate connection choice for a target URL.

A second possible trigger is “Auto proxy discovery.” In that mode, the system may use DHCP or DNS to discover Web Proxy Auto-Discovery, commonly called WPAD, and then retrieve a wpad.dat file. These discovery and retrieval steps can produce short network requests even before an application connects to its intended destination.

Running a PAC script can create additional DNS traffic. PAC functions such as dnsResolve, isResolvable, and isInNet depend on name resolution, so CFNetworkAgent may look up hostnames named by the script. Those queries can be part of the script’s direct-versus-proxy decision; the presence of a DNS request alone does not identify a separate content transfer.

The process’s usual network counterparts are therefore PAC or WPAD file servers and DNS resolution services. They are not necessarily the websites an application ultimately opens. If the PAC configuration uses a local file URL, obtaining that file does not require a network connection.

How much traffic is normal

Normal CFNetworkAgent activity ranges from no traffic at all to very small, brief bursts. The transferred material is mainly a text PAC file plus DNS or WPAD control queries. Under ordinary conditions, that is far less traffic than loading web pages, downloading software updates, or streaming media.

There is no reliable fixed range in kilobytes or megabytes. A specific number has not been verified, so it would be misleading to treat one as a normal limit. The actual total depends on the PAC file’s size, how often the file is retrieved again, and how many DNS lookups its script performs.

A short burst is therefore consistent with its known role, but traffic volume alone cannot explain every event. If the amount seems unusual, measure the process over time and compare the timestamps with changes to proxy, VPN, school, or workplace network configuration rather than assuming that every connection contains application data.

Can you turn it off

The practical recommendation is to keep CFNetworkAgent available. Apple does not provide a system setting that independently turns off this process.

Blocking CFNetworkAgent can make PAC- or WPAD-based automatic proxy selection fail or take longer. On a company, school, or VPN-managed network, applications that depend on the automatic configuration may then lose connectivity. Depending on the configuration, an application might instead fall back to a direct connection. Neither outcome is guaranteed universally.

Blocking the process does not necessarily disable every form of networking or every proxy. Manual proxy settings and direct connections are separate cases, and whether they continue to work depends on the particular network and application configuration.

If you know that you do not use automatic proxies, you can review System Settings > Network > the network service in use > Details > Proxies and turn off “Auto proxy discovery” and “Automatic proxy configuration.” That changes those network settings; it is not a global CFNetworkAgent off switch. Configuration profiles, VPN software, or applications may still invoke the related CFNetwork APIs.

What people get wrong

• “CFNetworkAgent is a virus, adware, or a third-party VPN.” The verified file is inside the macOS system framework directory, has an Apple platform signature, and uses Apple’s com.apple.cfnetwork.CFNetworkAgent identifier. Those facts identify the examined binary as an Apple system component.

• “CFNetworkAgent forwards all browser traffic to Apple.” Its verified responsibilities are retrieving and executing PAC configuration, returning proxy choices, and resolving names when a PAC script requires it. There is no evidence in the supplied research that it is an Apple telemetry service or that it carries all application content.

• “Disabling CFNetworkAgent will noticeably speed up the Mac or save lots of data.” There is no reliable basis for that promise. Normal activity is usually absent or very small, while blocking it can introduce failures or timeout delays where automatic proxy configuration is required.

• “Blocking CFNetworkAgent immediately breaks every proxy and the entire network.” That is too broad. The primary risk concerns automatic decisions made through PAC or WPAD. Manual proxies and direct connections may continue to work, depending on how the network and application are configured.

• “DNS traffic from CFNetworkAgent proves that it tracks browsing history.” PAC scripts can use the DNS result for a target host to choose a direct route or a proxy. Those lookups are consistent with standard PAC behavior, and the queries alone do not establish telemetry or tracking.

Seeing what it actually used

If you are investigating an unexpected total, the next step is to measure CFNetworkAgent separately instead of estimating from overall network activity. Bytetally’s per-process statistics can show its upload and download usage over the period you select. Compare the resulting timestamps and totals with proxy, VPN, or managed-network activity before deciding whether anything is abnormal.

Related processes

Common questions