Why is configd using the network on my Mac?

Last updated: 2026-07-31

What it is

configd is the macOS System Configuration Daemon. Apple installs it at /usr/libexec/configd, and the Apple-provided process carries the code identifier com.apple.configd.

Its job is to maintain both the current and intended configuration state of the system. It publishes changes through the SystemConfiguration dynamic store so that applications and other system components can learn when relevant settings have changed. It also loads several configuration agents inside the process rather than limiting itself to one narrow task.

For networking, configd helps manage network interfaces, IPv4 and IPv6 addresses, the default route, and the DNS and proxy settings currently in effect. That scope is broader than simply watching Wi-Fi or assigning an IP address. At the same time, configd is not a general-purpose network proxy: it does not carry ordinary application data merely because it maintains the system’s proxy, DNS, and routing state.

Why it talks to the network

Network activity from configd usually follows a change in network state. Common triggers include starting the Mac, joining or switching a Wi-Fi or Ethernet network, waking from sleep, detecting a link-state change, renewing a DHCP lease, or manually requesting a DHCP lease renewal.

During those events, the IPConfiguration agent running inside configd may send or receive DHCP, BOOTP, or DHCPv6 control messages. It can also receive IPv6 router advertisements and perform address-conflict detection on the local link. The verified communication partners are mainly the DHCP or DHCPv6 server for the current network, the router, and nodes on the same local link.

configd also writes active DNS, default-route, and proxy information into system state. That fact should not be mistaken for evidence that it personally contacts every DNS resolver, proxy server, or website used by applications. Maintaining configuration and carrying application traffic are different jobs.

How much traffic is normal

Under stable network conditions, configd may be nearly silent. When the network changes, a short burst of small control messages is normal. Its traffic should ordinarily be far below the amount needed to load a typical webpage, and it should not resemble a download or video stream.

Apple has not published one normal byte range that applies to every network. The observed total depends on how often the Mac joins networks, roams between access points, wakes from sleep, encounters link changes, or renews leases. A specific universal allowance in kilobytes or megabytes is therefore unverified and would be misleading.

Traffic that appears unusually large is better examined over time than judged from one isolated event. A brief increase beside a network transition has a different meaning from sustained transfer while the network remains unchanged.

Can you turn it off

The practical answer is to keep configd running. Apple provides no System Settings switch for turning it off, so there is no settings path to follow.

launchd manages configd as a KeepAlive system daemon. Simply terminating the process will normally cause it to start again. Disabling it through unsupported methods can prevent an IP address from being obtained or renewed, leave default-route, DNS, or proxy state stale, break network switching, and stop applications from receiving reliable network-state change notifications.

System Settings can disable a particular network service or protocol. That is not the same as disabling configd, which coordinates configuration across the system.

What people get wrong

“configd uses the network, so it must be malware or a third-party tracker” is not a sound conclusion. The process at /usr/libexec/configd with identifier com.apple.configd is an Apple-supplied platform system daemon. A similarly named executable found elsewhere should still be verified on its own; the name alone does not establish identity.

“configd uploads or records everything I browse” has no supporting basis in the verified findings. Its confirmed networking work belongs to the control plane: address assignment, router information, local-link checks, and network configuration. It is not the forwarding path for webpages, downloads, or ordinary application transfers.

“Disabling configd is a harmless way to make the Mac faster or save bandwidth” is also incorrect. Normal control traffic from the daemon is small, while removing it can break or freeze essential network configuration. In addition, launchd is designed to keep the service running.

“configd only manages Wi-Fi” and “configd only assigns IP addresses” are both incomplete descriptions. Its work also covers interfaces such as Ethernet and includes link state, the primary network service, IPv4 and IPv6 configuration, default routes, DNS state, proxy state, and some PPP configuration.

Finally, seeing traffic attributed to configd does not by itself mean that the Mac is contacting an Apple server. Verified DHCP, DHCPv6, router-advertisement, and address-conflict-detection traffic normally occurs on the local network. Whether components associated with captive-portal detection on current macOS versions produce external requests attributed to configd, and what endpoint range they might use, remains unverified.

Seeing what it actually used

If the total still looks unexpected, the next step is to measure configd over the period in question and compare the timestamps with Wi-Fi or Ethernet changes, wake events, and lease renewals. Bytetally’s per-process statistics can show the recorded traffic for configd without requiring a guessed “normal” byte limit. Look for the difference between a brief control burst and sustained transfer before drawing a conclusion.

Related processes

Common questions