Suspicious activity? Why is wifivelocityd calling traceroute?

After I upgraded to MacOS Ventura, I see connection requests from wifivelocityd trying to run

/usr/sbin/traceroute -n -m 6 -i en1 -w 2 -q 1 captive.apple.com

Why would a utility designed for wifi connectivity need to know they path/number of hops to any server (Apple or otherwise) beyond the wifi access point? Why should I allow this connection?

iMac (24-inch, M1, 2021, 2 ports)

Posted on Mar 7, 2023 04:48 AM

Reply
Question marked as Top-ranking reply

Posted on Mar 7, 2023 06:13 AM

Hi Leroy,


I know traceroute well. My question is why is the WiFiVelocity daemon calling traceroute in the first place? This is the suspicious part. wifivelocityd is an

XPC helper for performing system context actions for the WiFiVelocity framework

Per Apple's own definition of XPC

XPC Services API provides a lightweight mechanism for basic interprocess communication at the libSystem level. 

XPC | Apple Developer Documentation

Further, com.apple.wifivelocity has an entry

'comment' : 'Used by the WiFiVelocity framework to restrict XPC services',


So, why would this XPC service, designed to support wifi connections not Internet connections, make a call to a network utility to see if it can phone home? Doesn't make sense.


Bottom line is, what functionality is not working by blocking this network activity?

Similar questions

3 replies
Question marked as Top-ranking reply

Mar 7, 2023 06:13 AM in response to leroydouglas

Hi Leroy,


I know traceroute well. My question is why is the WiFiVelocity daemon calling traceroute in the first place? This is the suspicious part. wifivelocityd is an

XPC helper for performing system context actions for the WiFiVelocity framework

Per Apple's own definition of XPC

XPC Services API provides a lightweight mechanism for basic interprocess communication at the libSystem level. 

XPC | Apple Developer Documentation

Further, com.apple.wifivelocity has an entry

'comment' : 'Used by the WiFiVelocity framework to restrict XPC services',


So, why would this XPC service, designed to support wifi connections not Internet connections, make a call to a network utility to see if it can phone home? Doesn't make sense.


Bottom line is, what functionality is not working by blocking this network activity?

Mar 7, 2023 05:15 AM in response to mikepl

mikepl wrote:

After I upgraded to MacOS Ventura, I see connection requests from wifivelocityd trying to run
/usr/sbin/traceroute -n -m 6 -i en1 -w 2 -q 1 captive.apple.com
Why would a utility designed for wifi connectivity need to know they path/number of hops to any server (Apple or otherwise) beyond the wifi access point? Why should I allow this connection?


I see no issue here.

This is a unix executable baked into the macOS.


you can see this from Terminal, copy and paste:

ls -a /usr/libexec



are you having some associated issue?



you can read more from Terminal:

man wifivelocityd | more





The current stable release of Ventura including bug fixes, security updates is macOS Ventura 13.2.1


Keep your Mac up to date - Apple Support

Keep your Mac up to date - Apple Support



If you suspect a vulnerability here you can share you feedback with Apple

Report a security or privacy vulnerability - Apple Support




This thread has been closed by the system or the community team. You may vote for any posts you find helpful, or search the Community for additional answers.

Suspicious activity? Why is wifivelocityd calling traceroute?

Welcome to Apple Support Community
A forum where Apple customers help each other with their products. Get started with your Apple Account.