What is sntp on macOS, and why is it using the network?

Last updated: 2026-07-31

What it is

sntp is a command-line Simple Network Time Protocol client included with macOS. Its executable is /usr/bin/sntp. The identifier com.apple.sntp comes from the executable’s Apple code signature; it is not the bundle identifier of an ordinary application.

The tool has a narrow job: when a user, script, or another process explicitly launches sntp and supplies a time server, it queries that server for the time. It is therefore an on-demand utility rather than a daemon that must remain running in the background. Once the requested work is complete, there is no reason for a normal invocation to stay active as a permanent service.

This distinction matters when sntp appears in a process or network monitor. Its presence does not mean that macOS has assigned it responsibility for continuous automatic clock synchronization. On current macOS systems, routine automatic time synchronization is handled by timed. Seeing sntp means that something invoked this separate command-line client.

Why it talks to the network

sntp uses the network only after somebody calls /usr/bin/sntp and gives it the hostname or IP address of a time server. The caller might be a person using the command line, a script, or another process. The researched facts do not establish one universal caller because the program can be launched explicitly by different sources.

If the supplied destination is a hostname, macOS first performs DNS resolution. sntp then sends a time query to the caller-selected NTP or SNTP server over UDP port 123. The destination is not necessarily an Apple server. It may instead be a server chosen by an organization, an administrator, a script author, or the user.

A process name alone cannot reveal the destination or explain who launched it. If command-line arguments and network endpoints were not recorded, the server used by a particular invocation remains unverified. The caller also remains unverified in that situation. It would be misleading to infer a specific domain, operator, or launch source merely from seeing com.apple.sntp in a network record.

How much traffic is normal

A normal single invocation usually consists of a small number of short-lived, small UDP time queries. Its traffic is ordinarily far below the data transferred by loading a typical web page. That is a qualitative comparison, not a fixed allowance or guaranteed measurement.

Apple has not published a verifiable cumulative traffic range for this tool. There is therefore no supported daily or monthly figure that applies to every Mac. Long-term usage depends on how often a user, script, or process invokes sntp, so any specific daily or monthly total is unverified without measurements from the particular machine.

A brief, tiny burst fits the tool’s known function. Sustained activity or a large accumulated total does not fit the usual single-query pattern and deserves investigation. The useful evidence would be the frequency of launches, the parent process, command-line arguments, and the destination server—not an invented “normal” megabyte threshold.

Can you turn it off

The practical verdict is to keep sntp. Apple does not provide a System Settings switch for disabling /usr/bin/sntp, so there is no legitimate settings path to follow for a process-level shutdown.

The “Set time and date automatically” option controls the system’s automatic network time behavior. It is not an sntp disable switch and cannot prevent a script or another process from explicitly launching /usr/bin/sntp. Turning that option off therefore does not prove that sntp can no longer appear.

Manually removing or blocking the executable is unsupported. Doing so may break management scripts or time-diagnostic tools that rely on it. Routine automatic synchronization does not require sntp to remain resident, because timed handles that work; this is not, however, a reason to modify or remove the on-demand client.

What people get wrong

1. “sntp is the always-running macOS automatic time service.” It is not. sntp is an on-demand command-line client launched for an explicit query. The resident service responsible for routine automatic synchronization on current macOS is timed.

2. “sntp and sntpd are the same process.” They are different programs with different roles. sntp is a client that asks a time server for the time. sntpd is a separate server daemon capable of providing time service, and the independently checked com.apple.sntpd launch item was marked disabled by default.

3. “Turning off ‘Set time and date automatically’ disables sntp.” That setting controls automatic system time synchronization, not whether /usr/bin/sntp may be executed. A script can still call the client explicitly, so the setting is not a process-level block.

4. “Blocking sntp will save a noticeable amount of data.” A normal query creates only a small, short burst of protocol traffic. Blocking it is unlikely to produce meaningful savings under ordinary use. If the observed traffic is continuous or unexpectedly large, investigate the parent process, arguments, launch frequency, and target server instead of assuming the utility’s normal behavior is responsible.

5. “com.apple.sntp network activity must be telemetry or malware.” The identifier belongs to Apple’s macOS-provided /usr/bin/sntp, and its verified purpose is querying network time. That does not make unexplained repetition irrelevant: frequent unexpected launches are a reason to determine what is invoking it. Without captured arguments or endpoints, the caller and the particular server must remain labeled unverified.

Seeing what it actually used

Start by using Bytetally’s per-process statistics to measure how much traffic sntp actually transferred and whether it appeared as an isolated burst or a repeated pattern. If the total is persistent or unexpectedly large, narrow down the relevant time window, then investigate the parent process, command-line arguments, and destination endpoint. Keep any caller or server that was not captured marked as unverified.

Related processes

Common questions