Why is Control Center using the network on my Mac?

Last updated: 2026-07-31

What it is

Control Center is a user-level system process included with macOS. Its bundle identifier is com.apple.controlcenter, and its executable belongs to the system-provided ControlCenter application. It runs the Control Center in the menu bar, handles commonly used system controls, and displays privacy-use indicators.

On supported Macs, the same process also contains the interface and receiving components for AirPlay Receiver. That connection explains the most clearly verified network activity associated with Control Center. It is not a third-party network utility, and it is not the macOS software update process.

Control Center is also a launchd-managed part of the user interface. Quitting it does not turn a feature off in a supported or lasting way: the system will normally start it again. Trying to remove or permanently disable it can affect Control Center itself, menu bar status items, and privacy indicators.

Why it talks to the network

The main directly verified network role is AirPlay Receiver. When that feature is enabled, Control Center can listen on TCP ports 5000 and 7000, both of which Apple officially identifies as ports used by AirPlay. In this state, the Mac is waiting for a permitted Apple device to request a connection. Waiting is not the same as actively moving media or uploading data.

When you actually receive a screen, video, or audio stream through AirPlay, Control Center establishes control and media-transfer sessions with the sending device. The other device will usually be associated with the same Apple Account, be reachable on the same local network, or be a nearby device allowed by the Mac’s AirPlay settings. This is user-initiated media traffic rather than evidence that Control Center is independently sending an unknown background upload.

AirPlay service discovery commonly involves mDNSResponder, so discovery traffic may be attributed to that process instead of Control Center. Public information does not reliably establish other outbound network purposes for Control Center. It would therefore be misleading to assign it additional servers, domains, or background transfer roles without direct evidence.

How much traffic is normal

When AirPlay is not being used, Control Center should normally show only negligible listening or discovery-related activity. A socket in the LISTEN state means that a service is ready to accept a connection. It does not show that a connection has been accepted, that a payload is moving, or that anything is being uploaded to the internet.

The picture changes while this Mac is receiving AirPlay. A screen, video, or audio stream creates sustained, user-initiated media traffic that is clearly larger than idle control activity. The total varies with the kind of content, its quality, and how long the session lasts.

Apple has not published a reliable per-process traffic range for Control Center. There is therefore no verified number of megabytes that can serve as a universal “normal” limit. A specific byte total without observing the actual Mac and time period would be unverified.

Can you turn it off

You can turn off the optional receiving feature without trying to disable the whole process. Go to:

System Settings > General > AirDrop & Handoff > AirPlay Receiver

The exact panel wording may vary with the macOS language or release, but the relevant setting is AirPlay Receiver. Turning it off means this Mac will no longer appear as an AirPlay receiving target and cannot accept a screen, video, or audio sent from another device.

Control Center itself will continue to run because it also supplies the menu bar controls, system switches, and privacy indicators. Turning off AirPlay Receiver also does not normally prevent this Mac from sending AirPlay to an Apple TV, speaker, or another supported destination. The switch controls receiving content on this Mac, not every AirPlay capability.

Apple provides no supported setting for disabling the entire Control Center process. Repeatedly force-quitting it is not a durable traffic-control method because launchd normally starts it again, and forcefully disabling it can break parts of the macOS interface.

What people get wrong

• “Control Center listens on TCP 5000 and 7000, so it must be malware or a backdoor.” Those ports alone do not support that conclusion. Control Center is an Apple system component, and Apple’s official port documentation assigns both ports to AirPlay.

• “If a port is listening, Control Center must be continuously uploading data.” A listening socket only waits for an incoming connection. It does not prove that a session exists, that payload bytes are moving, or that information is leaving the local network.

• “Deleting, permanently disabling, or repeatedly force-quitting Control Center is a safe way to save bandwidth.” Control Center is a core, launchd-managed user-interface process and will normally restart. Forcing it out of service can interfere with Control Center, menu bar status items, and privacy-use indicators. If AirPlay receiving is the concern, the supported AirPlay Receiver setting is the relevant control.

• “Turning off AirPlay Receiver turns off every AirPlay feature on the Mac.” The setting controls whether other devices can send their screen, video, or audio to this Mac. It normally does not remove the Mac’s ability to send AirPlay to devices such as an Apple TV or speaker.

Seeing what it actually used

If the activity still looks unusual, the next step is to measure Control Center itself over the relevant time period instead of judging it from an open port. Use Bytetally’s per-process statistics to compare an idle period with a period when the Mac is receiving AirPlay. That comparison shows whether the recorded traffic follows an AirPlay session without inventing a universal byte threshold.

Related processes

Common questions