airportd

executablemacOS3.0 MBx86_64, arm64

Wi-Fi daemon — configures wireless interfaces, manages roaming, and reports diagnostics

Controls Wi-Fi hardware through low-level 802.11 driver interfaces and DriverKit communication. Manages network configuration, wireless authentication, roaming decisions, and peer-to-peer connectivity (AWDL/AirDrop). Accesses Wi-Fi credentials from NVRAM and system keychain, applies regulatory domain settings, and monitors location and country detection data without user prompts. Submits extensive Wi-Fi and diagnostic telemetry to Apple's analytics pipeline via 18 network endpoints. Runs with hardened runtime and Secure Enclave key access.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 3.0 MB
UUID: 8C594879-D258-330E-BD79-80AC62539BDD
Analyzed: 2026-04-08T05:56:02Z
CDHash: 795f08e49a21a2fcd69d55a26890df11feaa4d9fe61d63db45eeaf04fa2bf8a8

Capabilities

LocationAccess location as a system bundle (no user prompt)

com.apple.locationd.effective_bundle [object Object]

LocationObserve location updates passively

com.apple.locationd.spectator [object Object]

LocationAccess WiFi-based location without user consent

com.apple.wifi.bypass-location-services [object Object]

LocationLocation services access

/System/Library/Frameworks/CoreLocation.framework/Versions/A/CoreLocation

LocationLocation services access

/System/Library/Frameworks/_LocationEssentials.framework/Versions/A/_LocationEssentials

KeychainRead and use keychain encryption keys

com.apple.keystore.access-keychain-keys [object Object]

KeychainAccess Secure Enclave sealed keys (SIK)

com.apple.keystore.sik.access [object Object]

KeychainRead and write system keychain items

com.apple.private.system-keychain [object Object]

KeychainKeychain access group membership

keychain-access-groups

com.apple.cfnetwork wifianalyticsd com.apple.identities

NetworkModify system network configuration

com.apple.networkd.modify_settings [object Object]

NetworkPrivileged network daemon access

com.apple.networkd_privileged [object Object]

NetworkNetwork access during dark wake (display off)

com.apple.private.dark-wake-network-reachability [object Object]

NetworkListen for incoming network connections

com.apple.security.network.server [object Object]

NetworkModern networking framework (NWConnection)

/System/Library/Frameworks/Network.framework/Versions/A/Network

NetworkNetwork configuration and reachability

/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

NetworkRaw packet capture library

/usr/lib/libpcap.A.dylib

StorageRead and write system NVRAM variables

com.apple.private.iokit.system-nvram-allow [object Object]

StorageRead and write WiFi pre-shared keys in NVRAM

com.apple.private.security.nvram.wifi-psks [object Object]

StoragePrivate storage area access

com.apple.private.security.storage.os_eligibility.readonly [object Object]

StorageAccess WiFi credential storage

com.apple.private.security.storage.wifi [object Object]

StorageException: access additional file paths

com.apple.security.exception.files.absolute-path.read-only

/private/var/db/os_eligibility/eligibility.plist

HardwareCommunicate with paired Apple devices

com.apple.CompanionLink [object Object]

HardwareRead raw WiFi BSSID (router MAC address)

com.apple.private.corewifi.bssid [object Object]

HardwareRead WiFi country code

com.apple.private.corewifi.countrycode [object Object]

HardwareInternal CoreWiFi access (undocumented)

com.apple.private.corewifi.internal [object Object]

HardwareRead device WiFi MAC address

com.apple.private.corewifi.mac-addr [object Object]

HardwareAct as WiFi user agent

com.apple.private.corewifi.user-agent [object Object]

HardwareDirect DriverKit driver communication

com.apple.private.driverkit.driver-access

com.apple.private.wifi.driverkit

HardwareWiFi regulatory domain management

/System/Library/PrivateFrameworks/RegulatoryDomain.framework/Versions/A/RegulatoryDomain

HardwareLow-level 802.11 driver interface

/System/Library/PrivateFrameworks/IO80211.framework/Versions/A/IO80211

HardwareWiFi peer-to-peer (AWDL/AirDrop)

/System/Library/PrivateFrameworks/WiFiPeerToPeer.framework/Versions/A/WiFiPeerToPeer

HardwareWiFi configuration (private)

/System/Library/PrivateFrameworks/CoreWiFi.framework/Versions/A/CoreWiFi

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

HardwarePacket capture control

/System/Library/PrivateFrameworks/CoreCaptureControl.framework/Versions/A/CoreCaptureControl

HardwareIOKit power/performance reporting

/usr/lib/libIOReport.dylib

HardwareWiFi interface control

/System/Library/Frameworks/CoreWLAN.framework/Versions/A/CoreWLAN

IpcRestricted application group access

com.apple.private.security.restricted-application-groups

group.com.apple.wifi group.com.apple.wifi.logs

IpcQuery process state from RunningBoard

com.apple.runningboard.process-state [object Object]

IpcShared application group container access

com.apple.security.application-groups

IpcException: access additional Mach services

com.apple.security.exception.mach-lookup.global-name

com.apple.CompanionLink com.apple.countryd.update

IpcCommunicate with WiFi peer-to-peer daemon

com.apple.wifip2pd [object Object]

IpcAirDrop/sharing services

/System/Library/PrivateFrameworks/Sharing.framework/Versions/A/Sharing

AnalyticsSubmit data to WiFi analytics pipeline

com.apple.private.wifianalytics [object Object]

AnalyticsSubmit symptom diagnostic reports

com.apple.symptom_diagnostics.report [object Object]

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

AnalyticsSymptom/diagnostic reporting framework

/System/Library/PrivateFrameworks/Symptoms.framework/Versions/A/Frameworks/ManagedEvent.framework/Versions/A/ManagedEvent

AnalyticsWiFi-specific analytics pipeline

/System/Library/PrivateFrameworks/WiFiAnalytics.framework/Versions/A/WiFiAnalytics

AnalyticsWireless diagnostic reporting

/System/Library/PrivateFrameworks/WirelessDiagnostics.framework/Versions/A/WirelessDiagnostics

SecurityHardened runtime process

com.apple.developer.hardened-process [object Object]

SecurityPerform WiFi authentication

com.apple.wlan.authentication [object Object]

SecuritySecurity framework extensions

/System/Library/Frameworks/SecurityFoundation.framework/Versions/A/SecurityFoundation

SecurityKeychain, certificates, code signing

/System/Library/Frameworks/Security.framework/Versions/A/Security

SystemRead country detection data

com.apple.countryd.access [object Object]

SystemContribute to country detection data

com.apple.countryd.contribute [object Object]

SystemControl display via SkyLight (window server)

com.apple.private.SkyLight.displaycontrol [object Object]

SystemMonitor display events via SkyLight

com.apple.private.SkyLight.event.monitor [object Object]

SystemRead Lockdown Mode status

com.apple.private.lockdownmoded.read [object Object]

SystemAccess MDM configuration profiles

com.apple.private.managedclient.configurationprofiles [object Object]

SystemAccess WiFi cloud assets

com.apple.wifi.cloudasset-access [object Object]

SystemBackground task scheduling

/System/Library/PrivateFrameworks/BackgroundSystemTasks.framework/Versions/A/BackgroundSystemTasks

SystemLockdown Mode status

/System/Library/PrivateFrameworks/LockdownMode.framework/Versions/A/LockdownMode

Entitlements43

com.apple.CompanionLinktrue

com.apple.countryd.accesstrue

com.apple.countryd.contributetrue

com.apple.developer.hardened-processtrue

com.apple.keystore.access-keychain-keystrue

com.apple.keystore.sik.accesstrue

com.apple.locationd.effective_bundletrue

com.apple.locationd.spectatortrue

com.apple.networkd.modify_settingstrue

com.apple.networkd_privilegedtrue

com.apple.private.SkyLight.displaycontroltrue

com.apple.private.SkyLight.event.monitortrue

com.apple.private.corewifi.bssidtrue

com.apple.private.corewifi.countrycodetrue

com.apple.private.corewifi.internaltrue

com.apple.private.corewifi.mac-addrtrue

com.apple.private.corewifi.user-agenttrue

com.apple.private.dark-wake-network-reachabilitytrue

com.apple.private.driverkit.driver-access

com.apple.private.wifi.driverkit

com.apple.private.iokit.system-nvram-allowtrue

com.apple.private.lockdownmoded.readtrue

com.apple.private.managedclient.configurationprofilestrue

com.apple.private.security.nvram.wifi-pskstrue

com.apple.private.security.restricted-application-groups

group.com.apple.wifi group.com.apple.wifi.logs

com.apple.private.security.storage.os_eligibility.readonlytrue

com.apple.private.security.storage.wifitrue

com.apple.private.system-keychaintrue

com.apple.private.wifianalyticstrue

com.apple.private.wifid.host.networktrue

com.apple.private.wifid.interface.managementtrue

com.apple.private.wifivelocitytrue

com.apple.runningboard.process-statetrue

com.apple.security.application-groups

com.apple.security.exception.files.absolute-path.read-only

/private/var/db/os_eligibility/eligibility.plist

com.apple.security.exception.mach-lookup.global-name

com.apple.CompanionLink com.apple.countryd.update

com.apple.security.network.servertrue

com.apple.security.temporary-exception.iokit-user-client-class

IOUserUserClient IO80211APIUserClient

com.apple.symptom_diagnostics.reporttrue

com.apple.wifi.bypass-location-servicestrue

com.apple.wifi.cloudasset-accesstrue

com.apple.wifip2pdtrue

com.apple.wlan.authenticationtrue

keychain-access-groups

com.apple.cfnetwork wifianalyticsd com.apple.identities

Interesting Strings

Bundle IDs(201)

com.apple.private.corewifi.bssid com.apple.private.wifi.driverkit0/ com.apple.wifi.cloudasset-access !com.apple.private.system-keychain !com.apple.security.network.server

File Paths(55)

/AppleInternal/Library/BuildRoots/4~B_xEugCiNbLFH8XsUKBGkwLPMO3d8SdKQIlwi1E/Library/Caches/com.apple.xbs/Sources/AirPort_executables/Tools/airportd/CWXPCSubsystem.m /AppleInternal/Library/BuildRoots/4~B_xEugCiNbLFH8XsUKBGkwLPMO3d8SdKQIlwi1E/Library/Caches/com.apple.xbs/Sources/AirPort_executables/Tools/airportd/airportProcessCommand.m /AppleInternal/Library/BuildRoots/4~B_xEugCiNbLFH8XsUKBGkwLPMO3d8SdKQIlwi1E/Library/Caches/com.apple.xbs/Sources/AirPort_executables/Tools/airportd/airportdCommandLine.m /AppleInternal/Library/BuildRoots/4~B_xEugCiNbLFH8XsUKBGkwLPMO3d8SdKQIlwi1E/Library/Caches/com.apple.xbs/Sources/AirPort_executables/Tools/airportd/airportdMain.m /AppleInternal/Library/BuildRoots/4~B_xEugCiNbLFH8XsUKBGkwLPMO3d8SdKQIlwi1E/Library/Caches/com.apple.xbs/Sources/AirPort_executables/Tools/airportd/airportdPreferences.m

iokit_constants(55)

APPLE80211KEY_AWDL_INFO_ASSISTED_DISCOVERY_FOLLOW APPLE80211KEY_AWD_TRAP_TYPE APPLE80211KEY_RANGING_FOLLOW_MODE APPLE80211KEY_RANGING_FOLLOW_MODE_BAND APPLE80211KEY_ROAM_PROF_2G

telemetry(120)

$com.apple.symptom_diagnostics.report %s: FAILED to submit datapath diagnostics message with key: %@. Error: %@%s: Failed to submit task with error: %@-[CWAnalyticsManager _initPrivate]-[CWAnalyticsManager submit11axLinkChangeData:]

URLs & Endpoints(5)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd"><string>com.apple.compilers.llvm.clang.1_0</string>https://www.apple.com/appleca/0

Network Surfaceentitled

Networking Frameworks

CoreFoundation Foundation Network SecurityFoundation

Endpoints(18)

Hostnameairportd.chip-reset.skip

Hostnameairportd.chip-reset.non-fatal

Hostnameairportd.health-check.fault

Hostnameairportd.health-check.crash

Hostnameairportd.health-check.threshold.sec

Hostnameairportd.freed-list.enable

Ipv6ff:ff:ff:ff:ff:ff

Hostnameairportd.tcpka-tko-mitigation.interval

Hostnameairportd.tcpka-tko-mitigation.limit

Ipv6FF:FF:FF:FF:FF:FF

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Hostnamemacosx26.1.internal

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

DNA Capability Vector

Location

5

Keychain

4

Network

7

Storage

5

Hardware

15

IPC

6

Analytics

6

Security

4

System

9

Behavioral Profile

URL Endpoints

5

Telemetry Strings

120

File Paths

55

Bundle IDs

201

IOKit Constants

55

Library Functions

0

Structural HashesSHA-256

Coded3bbfc85b948e86b1ee53301696345ee335476589b8fb9473c5288b532bbcd9b

Imports953931d96d50f5a358274cddb9912aab672c6821121305ee5f31edcb1dcbe5b5

Frameworksdb6b67a97ee5cc2279baa442d3f3d6a75d31837e2abf946788f04bde724b93b6

Classes698e13f4477ca648b15ba669c22e38478dc215cc4ab8478f488880cfa9dab96c

Entitlementsbe650f8d37ce1c7b6a60e9d75679cc52ed1874384583d359caddfb6d957fb168

Symbols35411bdddb8663096d3a68464a2633e041e0d2041f20747021697afb1f062e99

Static Libraries0 / 2767 functions identified

Functions(2767)

0x100001b60-[CWAnalyticsManagerActionFrameEventData init]

0x100001bd0-[CWAnalyticsManagerActionFrameEventData dealloc]

0x100001c58-[CWAnalyticsManagerActionFrameEventData oui]

0x100001c60-[CWAnalyticsManagerActionFrameEventData setOui:]

0x100001c68-[CWAnalyticsManagerActionFrameEventData environmentType]

0x100001c70-[CWAnalyticsManagerActionFrameEventData setEnvironmentType:]

0x100001c78-[CWAnalyticsManagerActionFrameEventData categoryCode]

0x100001c80-[CWAnalyticsManagerActionFrameEventData setCategoryCode:]

0x100001c88-[CWAnalyticsManagerActionFrameEventData actionCode]

0x100001c90-[CWAnalyticsManagerActionFrameEventData setActionCode:]

0x100001c98-[CWAnalyticsManagerActionFrameEventData dialogToken]

0x100001ca0-[CWAnalyticsManagerActionFrameEventData setDialogToken:]

0x100001ca8-[CWAnalyticsManagerActionFrameEventData status]

0x100001cb0-[CWAnalyticsManagerActionFrameEventData setStatus:]

0x100001cb8-[CWAnalyticsManagerActionFrameEventData frameType]

0x100001cc0-[CWAnalyticsManagerActionFrameEventData setFrameType:]

0x100001cc8-[CWAnalyticsManagerActionFrameEventData btmDisassociationTimeout]

0x100001cd0-[CWAnalyticsManagerActionFrameEventData setBtmDisassociationTimeout:]

0x100001cd8-[CWAnalyticsManagerActionFrameEventData btmValidityInterval]

0x100001ce0-[CWAnalyticsManagerActionFrameEventData setBtmValidityInterval:]

Imports817 symbols from 29 dylibs

libSystem.B.dylib152 CoreFoundation118 CoreWLAN85 CoreWiFi83 WiFiAnalytics83

Exports1

_mh_execute_header0x0

Similar Binaries1,470 comparable

WirelessRadioManagerd

networkserviceproxy

nesessionmanager