symptomsd (Symptoms Daemon (Network Diagnostics)) is a safe macOS network process. symptomsd is the macOS network diagnostics daemon that monitors network quality and connectivity health. It collects data about network interface performance, connection failures, DNS resolution times, and overall network path quality. This data is used by macOS to make intelligent decisions about network interface selection (Wi-Fi vs Ethernet vs cellular) and to power the built-in network diagnostics tools. symptomsd running in the background with low resource usage is normal. Be concerned if it shows unusually high network activity that doesn't correspond to your usage, or sustained high CPU when connected to a stable network — this could indicate network-level attacks or a compromised DNS configuration causing rapid failed lookups.
Symptoms Daemon (Network Diagnostics)
symptomsd is the macOS network diagnostics daemon that monitors network quality and connectivity health. It collects data about network interface performance, connection failures, DNS resolution times, and overall network path quality. This data is used by macOS to make intelligent decisions about network interface selection (Wi-Fi vs Ethernet vs cellular) and to power the built-in network diagnostics tools.
Elevated CPU usage during network transitions (Wi-Fi to Ethernet and vice versa)
Excessive network probing on metered connections
Background data usage for connectivity checks and diagnostics
High CPU when connected to unreliable or congested networks
Open Network Diagnostics (System Settings > Network > click the '...' or 'Details' button). If your connection is unstable, symptomsd works harder to monitor quality. Fix the underlying network issue (move closer to Wi-Fi router, replace Ethernet cable, etc.).
Go to System Settings > Network and remove any network interfaces you don't use (old VPN configurations, unused Bluetooth PAN). Each interface adds monitoring overhead for symptomsd.
Turn Wi-Fi off and back on, or unplug and replug Ethernet. If symptomsd is stuck in a monitoring loop, resetting the active network interface forces it to re-evaluate connectivity from scratch.
Delete /Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist and /Library/Preferences/SystemConfiguration/NetworkInterfaces.plist, then restart. This resets all network configuration and forces a fresh setup.
symptomsd running in the background with low resource usage is normal. Be concerned if it shows unusually high network activity that doesn't correspond to your usage, or sustained high CPU when connected to a stable network — this could indicate network-level attacks or a compromised DNS configuration causing rapid failed lookups.
CoreLock monitors network connection patterns and can detect when symptomsd's diagnostics reveal suspicious network behavior. It correlates network quality data with active connections to identify potential man-in-the-middle attacks or DNS poisoning that cause abnormal network diagnostic activity.
Download CoreLock Freewifid is the macOS daemon that manages all Wi-Fi operations. It controls the Wi-Fi hardware, handles scanning for availa...
rapportd is the macOS daemon that handles local device discovery and communication for features like Universal Clipboard...
nsurlsessiond is the macOS background daemon that handles URL-based download and upload tasks on behalf of applications....
symptomsd is macOS's network health monitoring daemon. It continuously evaluates the quality and reliability of your network connections, measures latency, tracks packet loss, and helps macOS decide which network interface to prefer when multiple are available. It also provides data for the built-in network diagnostics tools.
symptomsd sends small probe packets to evaluate network path quality and connectivity. This is normal diagnostic behavior that helps macOS maintain optimal network performance. The data usage is minimal (a few KB) but may show up in network monitoring tools.
Yes. symptomsd is a standard Apple system process for network diagnostics. It is code-signed by Apple, runs as a system daemon, and only communicates with Apple's network quality assessment servers. It helps macOS make intelligent networking decisions and is protected by System Integrity Protection.
Download CoreLock to identify suspicious processes, detect threats, and keep your Mac running smoothly.
Download CoreLock FreeAvailable for macOS and Windows