Rapportd constantly asking for incoming connection on my iMac running macOS 13.7.3

For anything reported by, related to, detected by, blocked by, claimed to happen by, or otherwise involving or associated with this app, please contact the app vendor. They are your point of contact for this app, and for anything this app reports, alters, claims, or causes, including any undocumented or unsupported activities.

Or you can remove this Little Snitch app, and return to a configuration that operates as Apple expects.

If you want to persist wirh the app, allow all connections.

rapportd is a daemon associated with a macOS private framework, and is part of normal operations. The rapport framework is associated with Apple continuity and iCloud-related features, as well as with Siri and Bonjour activity based in the private framework headers.

A second and likely-unrelated-to-this-case rapportd is part of an IBM Trusteer package.

Beyond the country level, IP geolocation is inaccurate at best, assuming the add-on tool is reporting correct info.

I would, however, be cautious about posting public IPv6 addresses.

And I’d wonder if this IPv6 address is associated with your own host or your own local network, whether that network is run by Verizon or otherwise, or as is reported to be located in Virgina, New York, Maryland, or elsewhere.

If Security of the computer is of paramount importance ?

1 - The current version of Ventura is 13.7.8 >> About the security content of macOS Ventura 13.7.8

2 - If, as you have discovered, Little Snitch has intercepted a request for a Inbound connection

Any reasonably current Access Point / Router IP Address would the object of a possible connection and not the IP address of the computer itself

I'm not an expert by any stretch of the imagination, but I would recommend that you try blocking it and see if it breaks anything. If all is fine, I don't see any reason why you would need it.

Let me know if you figure something out or if I'm just being stupid

Good Luck :)

From what I can see from Activity Monitor >> View ALL process

The " rapportd " process seems dominated by AddressBook

/usr/libexec/rapportd

/Library/Preferences/Logging/.plist-cache.8SpfjcQC

/System/Library/CoreServices/SystemVersion.bundle/English.lproj/SystemVersion.strings

/private/var/db/timezone/tz/2025b.1.0/icutz/icutz44l.dat

/usr/lib/libobjc-trampolines.dylib

/System/Library/Address Book Plug-Ins/LDAP.sourcebundle/Contents/Resources/InfoPlist.loctable

/System/Library/Address Book Plug-Ins/LocalSource.sourcebundle/Contents/Resources/InfoPlist.loctable

/System/Library/Address Book Plug-Ins/Exchange.sourcebundle/Contents/Resources/InfoPlist.loctable

/System/Library/Address Book Plug-Ins/DirectoryServices.sourcebundle/Contents/Resources/InfoPlist.loctable

/System/Library/Address Book Plug-Ins/CardDAVPlugin.sourcebundle/Contents/Resources/InfoPlist.loctable

/System/Library/PrivateFrameworks/AddressBookCore.framework/Versions/A/Resources/AB-NARWHAL.loctable

/System/Library/Address Book Plug-Ins/DirectoryServices.sourcebundle/Contents/MacOS/DirectoryServices

/System/Library/PrivateFrameworks/AddressBookCore.framework/Versions/A/Resources/ABLDAPStrings.loctable

/System/Library/Address Book Plug-Ins/LocalSource.sourcebundle/Contents/MacOS/LocalSource

/System/Library/PrivateFrameworks/AddressBookCore.framework/Versions/A/Resources/ABStrings.loctable

/usr/lib/dyld

/private/var/db/analyticsd/events.allowlist

/System/Library/Frameworks/OpenDirectory.framework/Versions/A/Frameworks/CFOpenDirectory.framework/Versions/A/Resources/Localizable.loctable

/System/Library/Frameworks/Contacts.framework/Versions/A/Resources/Errors.loctable

/System/Library/Address Book Plug-Ins/CardDAVPlugin.sourcebundle/Contents/MacOS/CardDAVPlugin

/usr/share/icu/icudt76l.dat

It’s only polarizing for the folks that repeatedly get asked to help support the app, and the trouble and effort the app can cause. Too often unnecessarily.

For an advanced user familiar with internals and very familiar with the limitations, risks, issues, and trade-offs the tool inherently involves, and with investigating the reports, it’s a reasonable choice.

If more generally interested in monitoring device or network security, I’d likely go with external network monitoring at the switch, router, or firewall, combined with an installed app using the Apple endpoint security support, though.

Too often unwary or inexperienced users get wrapped up in the tool the same way unwary or inexperienced users get wrapped up in spurious reports from anti-malware apps. We routinely get folks demanding a fix for what csn be a bug in some add-on security app, too. Add-on security apps tend to be noisy, too — variously for what are non-issues.

Got questions about what an add-on app might report? Check what is being reported, such as here using your knowledge of networking and particularly of rapportd to look for connection-related activity. Then after gathering some data, discuss your findings with the app vendor.

The Access Point / Router has its own IP Address independent for the IP address of the Computer

The computer derives its IP address assigned to it by the Router ( Dynamically )

Router IP Address

IP Address of computer IP: 192.168.2.35 assigned by Router

chris catalano wrote:

Ok, that's what I thought you meant. So we get back to the original question of why something external is making a direct request to the rapportd process running on my machine.

The more relevant questions are

1 - To what IP Address is this request for a connection being directed to ? Not the IP address of the computer

2 - Did the Computer, not Router , respond to this request ?

Even without a Two Way Software Firewall like LittleSnitch

The IP address of the Computer is invisible to anything outside of your Network

We shall leave with this adage

Don't go looking for trouble as trouble will find you soon enough

There are 4 Categories of Third Party Software / Services that are baffling.

Why some users insist on installing and using the below software. 

In no special order 

Third Party 2 Way Firewalls 

like Lulu and Little Snitch 

Commercial VPNs 

Third Party Security Software

Third Party Disk Cleaners / Optimizer 

Not to me