smbd

executablemacOS1.9 MBx86_64, arm64

Network diagnostics and reachability daemon — monitors connectivity and collects network telemetry

Monitors network status, connectivity, and reachability across interfaces to inform system and application behavior. Performs network diagnostics including interface probing, route evaluation, and connection testing. Communicates with six network endpoints and exposes multiple XPC services for system components and applications to query network state. Submits diagnostic and performance telemetry to Apple through unified analytics. Maintains hardware-level access for direct driver and interface communication.AI

Fingerprint

Platform: macOS
Type: executable
Arch: x86_64, arm64
Min OS: 26.1.0
SDK: 26.1.0
File Size: 1.9 MB
UUID: 8CE64C91-4CE4-30C9-A4EC-F4AD92D99F40
Analyzed: 2026-04-07T05:21:15Z
CDHash: 453429c59746c5440dfcae639a51dc69e527ed6b714bd6cba52fcafcbe61be58

Capabilities

NetworkNetwork configuration and reachability

/System/Library/Frameworks/SystemConfiguration.framework/Versions/A/SystemConfiguration

HardwareDirect hardware/driver communication

/System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

AnalyticsApple unified analytics submission

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics

Frameworks16

SMBClient DCERPC SystemConfiguration CoreFoundation IOKit ByteRangeLocking OpenDirectory GSS Heimdal libicucore.A.dylib libpam.2.dylib CoreAnalytics APFS DiskArbitration libc++.1.dylib libSystem.B.dylib

Entitlements5

application-identifier com.apple.smbd

com.apple.private.security.clear-library-validationtrue

com.apple.private.vfs.disallow-rw-for-o-evtonlytrue

com.apple.private.vfs.file-leasestrue

com.apple.private.vfs.filesec-accesstrue

Interesting Strings

Bundle IDs(39)

!com.apple.private.vfs.file-leases $com.apple.private.vfs.filesec-access //private/tmp/com.apple.smbd /System/Library/LaunchDaemons/com.apple.smbd.plist /com.apple.private.vfs.disallow-rw-for-o-evtonly

File Paths(18)

.plist /System/Library/Frameworks/CoreFoundation.framework/Versions/A/CoreFoundation /System/Library/Frameworks/DiskArbitration.framework/Versions/A/DiskArbitration /System/Library/Frameworks/GSS.framework/Versions/A/GSS /System/Library/Frameworks/IOKit.framework/Versions/A/IOKit

telemetry(19)

/System/Library/PrivateFrameworks/CoreAnalytics.framework/Versions/A/CoreAnalytics __GLOBAL__sub_I_smbd_analytics.cpp __ZN15smbd_statistics14smbd_analytics12addStatisticENS_9FieldTypeEj __ZN15smbd_statistics14smbd_analytics16g_smbd_analyticsE __ZN15smbd_statistics14smbd_analytics18sendTelemetryEventEv

URLs & Endpoints(4)

$http://crl.apple.com/codesigning.crl0 %http://www.apple.com/appleca/root.crl0 <!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">https://www.apple.com/appleca/0

Network Surface

Networking Frameworks

Endpoints(6)

Urlhttp://www.apple.com/DTDs/PropertyList-1.0.dtd">

Hostnamewww.apple.com

Urlhttp://www.apple.com/appleca/root.crl0

Urlhttp://crl.apple.com/codesigning.crl0

Hostnamecrl.apple.com

Urlhttps://www.apple.com/appleca/0

API Usage

DNA Capability Vector

Location

0

Keychain

0

Network

1

Storage

0

Hardware

1

IPC

0

Analytics

1

Security

0

System

0

Behavioral Profile

URL Endpoints

4

Telemetry Strings

19

File Paths

18

Bundle IDs

39

IOKit Constants

0

Library Functions

4

Structural HashesSHA-256

Codecc1f828bc97104675fbfb3bd5faaf1cfe2a395b90b5dc7152b74a0ebe5675b9d

Importsbd7b3189056a2005b1dda09c572cfa8a50c50210b2920aee6d2acbc04d1a6560

Frameworksd6f09edb061663a9baddc9305968bd6266cf46fa5f01ff293e448ff0d06c0067

Classese3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

Entitlements64a5e33d30cc247a48292dc6ca9fe74e840b0a8f239ee63d5f3300203f1b78f8

Symbolsbd7b3189056a2005b1dda09c572cfa8a50c50210b2920aee6d2acbc04d1a6560

C++ Classes5351e5b20abf53f700c5ce35424ac0e7d4dfb4418be11f30c91f1be8c91c92b6

Static Libraries4 / 1599 functions identified

Identified Libraries

flatbuffers 25.9.23 (2 fn)gmock 1.17.0 (1 fn)pcre2-16 10.47 (1 fn)

Functions(1599)

0x100000e90_Z24smb1_dispatch_write_andxR11smb_requestPhS1_

0x1000012c0_Z19smb1_dispatch_writeR11smb_requestPhS1_

0x1000015a4_ZL14file_query_eofRN8platform11counted_ptrIN5ntvfs4treeEEERNS0_INS1_11file_handleEEE

0x10000166c_ZL12file_set_eofRN8platform11counted_ptrIN5ntvfs4treeEEERNS0_INS1_11file_handleEEEyy

0x100001700_Z24smb2_dispatch_write_fileR11smb_requestPhS1_

0x100001b3csmb_session::find_handle(unsigned long long const&)

0x100001bf0platform::heap_buffer::grow_atleast(unsigned long)

0x100001c58platform::unlocked_table<unsigned long long, platform::counted_ptr<ntvfs::file_handle> >::find(unsigned long long const&) const

0x100001cb8_Z29smb1_dispatch_tree_disconnectR11smb_requestPhS1_

0x100001d24_ZL15disconnect_treeRK11smb_requesti

0x100001e08_Z29smb2_dispatch_tree_disconnectR11smb_requestPhS1_

0x100001f3c_Z26smb1_dispatch_tree_connectR11smb_requestPhS1_

0x100002270_ZL21connect_to_named_treeRK11smb_requestRK10oem_stringRi

0x100002868_ZL20reply_buffer_reserveR11smb_requestm

0x1000028bc_Z26smb2_dispatch_tree_connectR11smb_requestPhS1_

0x100002d3cOUTLINED_FUNCTION_0

0x100002d84_Z25smb1_dispatch_transactionR11smb_requestPhS1_

0x100003164_ZL16find_file_handleR11smb_requestt

0x1000031ac_ZL15pipe_transceiveRN8platform11counted_ptrIN5ntvfs4treeEEERNS0_INS1_11file_handleEEERKNS_12fixed_bufferERNS_11heap_bufferEj

0x100003388_ZL9pipe_waitRN8platform11counted_ptrIN5ntvfs4treeEEERK10oem_string

Imports570 symbols from 17 dylibs

libSystem.B.dylib326 libc++.1.dylib67 CoreFoundation49 DCERPC33 IOKit19

Similar Binaries1,470 comparable

smb-migrate-preferences