symptomsd

executablemacOS121.0 KBx86_64, arm64

WiFi diagnostics daemon — collects wireless metrics and submits health reports

Monitors WiFi network performance and device connectivity, reading raw router MAC addresses and accessing location data derived from WiFi scanning. Gathers diagnostic telemetry and submits symptom reports to Apple's analytics infrastructure via outgoing network connections. Maintains a private storage area for diagnostic caches and logs. Listens for incoming network connections and exposes an XPC service for other system components to query WiFi health metrics and diagnostic status.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 121.0 KB
UUID: EFFAA389-372F-3EC9-B49F-C604DD75BE12
Analyzed: 2026-04-09T10:07:14Z
CDHash: 1e0182609d225ab193e4220dca3187e24a840b11ed5df3f5bdd0340b335f4179

Capabilities

LocationAccess WiFi-based location without user consent

com.apple.wifi.bypass-location-services [object Object]

NetworkMake outgoing network connections

com.apple.security.network.client [object Object]

NetworkListen for incoming network connections

com.apple.security.network.server [object Object]

StoragePrivate storage area access

com.apple.private.security.storage.SymptomFramework [object Object]

StorageException: access additional file paths

com.apple.security.exception.files.absolute-path.read-only

/private/var/db/com.apple.countryd/

HardwareRead raw WiFi BSSID (router MAC address)

com.apple.private.corewifi.bssid [object Object]

IpcException: access additional Mach services

com.apple.security.exception.mach-lookup.global-name

com.apple.private.corewifi-xpc com.apple.biome.access.system

AnalyticsSubmit symptom diagnostic reports

com.apple.symptom_diagnostics.report [object Object]

AnalyticsSymptom/diagnostic reporting framework

/System/Library/PrivateFrameworks/Symptoms.framework/Versions/A/Frameworks/SymptomEvaluator.framework/Versions/A/SymptomEvaluator

Frameworks5

liblinkguard.dylib(weak)Symptoms Foundation libobjc.A.dylib libSystem.B.dylib

Entitlements35

application-identifier com.apple.symptomsd

aps-connection-initiatetrue

com.apple.awdd.manager-accesstrue

com.apple.networkd.advisory_sockettrue

com.apple.private.CoreAnalytics.ObserveEvents.allowtrue

com.apple.private.associated-domainstrue

com.apple.private.biome.client-identifier com.apple.symptomsd

com.apple.private.biome.read-write

Device.Networking.EdgeSelection

com.apple.private.coreservices.canmapbundleidtouuidtrue

com.apple.private.corewifitrue

com.apple.private.corewifi.bssidtrue

com.apple.private.ids.messaging

com.apple.private.alloy.autobugcapture

com.apple.private.ids.messaging.high-priority

com.apple.private.alloy.autobugcapture

com.apple.private.ids.messaging.urgent-priority

com.apple.private.alloy.autobugcapture

com.apple.private.logging.admintrue

com.apple.private.nehelper.privilegedtrue

com.apple.private.network.interface-controltrue

com.apple.private.network.statisticstrue

com.apple.private.networkserviceproxytrue

com.apple.private.security.storage.SymptomFrameworktrue

com.apple.private.xpc.launchd.per-user-lookuptrue

com.apple.security.exception.files.absolute-path.read-only

/private/var/db/com.apple.countryd/

com.apple.security.exception.mach-lookup.global-name

com.apple.private.corewifi-xpc com.apple.biome.access.system

com.apple.security.network.clienttrue

com.apple.security.network.servertrue

com.apple.symptom_analytics.configuretrue

com.apple.symptom_analytics.querytrue

com.apple.symptom_analytics.refreshtrue

com.apple.symptom_analytics.writertrue

com.apple.symptom_diagnostics.privatetrue

com.apple.symptom_diagnostics.reporttrue

com.apple.symptomsd.distributed.NDFtrue

com.apple.wifi.bypass-location-servicestrue

com.apple.wifi.eventstrue

com.apple.wifi.manager-accesstrue

Interesting Strings

Bundle IDs(82)

com.apple.private.corewifi.bssid !com.apple.security.network.client !com.apple.security.network.server !com.apple.symptom_analytics.query "com.apple.networkd.advisory_socket

File Paths(4)

#/private/var/db/com.apple.countryd/0w /System/Library/Frameworks/Foundation.framework/Versions/C/Foundation /System/Library/PrivateFrameworks/Symptoms.framework/Versions/A/Frameworks/SymptomEvaluator.framework/Versions/A/SymptomEvaluator <string>/private/var/db/com.apple.countryd/</string>

telemetry(16)

!com.apple.symptom_analytics.query "com.apple.symptom_analytics.writer #com.apple.symptom_analytics.refresh $com.apple.symptom_diagnostics.report %com.apple.symptom_analytics.configure

URLs & Endpoints(5)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://www.apple.com/appleca/0

Network Surfaceentitled

Networking Frameworks

Endpoints(8)

HostnameSymptoms-2158.40.9

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

DNA Capability Vector

Location

1

Keychain

0

Network

2

Storage

2

Hardware

1

IPC

1

Analytics

2

Security

0

System

0

Behavioral Profile

URL Endpoints

5

Telemetry Strings

16

File Paths

4

Bundle IDs

82

IOKit Constants

0

Library Functions

0

Structural HashesSHA-256

Code9499ec01db3859abb131ac5926e44e71b78ff35160e8e81ceb425816a0a3ff4d

Importsd7b24757348a92893d797b8f37a4c4ca953b10dd680e9d8fb57ac013fb805213

Frameworks06cbf6502dfe1046d78f0452d419b0a7615905bddc0449cf01522d3844fa010b

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlementsc1a47650769b5da898247d9b044f7deed74ca41c8ad6bde5407e4aa33978e26b

Symbolsd7b24757348a92893d797b8f37a4c4ca953b10dd680e9d8fb57ac013fb805213

Static Libraries0 / 7 functions identified

Functions(7)

0x1000008a0sub_1000008a0

0x1000008c4sub_1000008c4

0x10000094csub_10000094c

0x100000a54sub_100000a54

0x100000a58sub_100000a58

0x100000a5csub_100000a5c

0x100000a84sub_100000a84

Imports26 symbols from 4 dylibs

libSystem.B.dylib13 Symptoms9 libobjc.A.dylib3 liblinkguard.dylib1

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

assetsubscriptiond

diagnosticextensionsd

inputanalyticsd

perfpowermetricd

intelligentroutingd