What is the function of Replicatord in macOS Sequoia 15?

This is happening to me as well since yesterday when I just installed Sequoia 15 and it's coming from Norton 360

replicatord on macOS is a background daemon associated with Apple's iCloud services. It plays a role in synchronizing files and data between your Mac and iCloud. Specifically, it supports:

1. iCloud Drive: Ensuring files stored in iCloud Drive are synced between your Mac and other devices.
2. Desktop and Documents Folders Sync: Keeping these folders updated if you've enabled iCloud synchronization for them.
3. Optimization: Managing disk space by offloading infrequently used files to iCloud while keeping them accessible.

This daemon is a core part of macOS's integration with iCloud and generally runs without user intervention. If you notice high resource usage or issues related to replicatord, it might indicate:

• A large sync operation (e.g., uploading or downloading many files).
• Problems with your iCloud connection or account.

You can monitor or troubleshoot it by:

1. Checking Activity Monitor for resource usage.
2. Reviewing iCloud settings in System Settings > Apple ID > iCloud.
3. Verifying your internet connection.

If issues persist, restarting your Mac or signing out and back into iCloud can often resolve synchronization problems.

FWIW, it is located in System Settings.Privacy and security>local network.

I agree with you. Apple rolls out Sequoia and makes the end user face permission notices that can't be understood.

Ridiculous IMHO

I'd like to summarize:

• somebody asked what the replicatord process is
• speculation has been offered, nobody actually knows
• (some people say iPhone mirroring, however, it's not proven)
• people spent the majority of their time bashing 3rd party AV software (you may be right, but you're not helpful)

Ok, now that that's established - I too have seen this note - from the built-in firewall. I have a brand-new Mac, no backups were carried over.

I went into the Firewall settings and deleted all the default allowed connections. The list was quite long. I also unchecked "automatically allow built-in software to receive connections", and "automatically allow downloaded and signed software to receive connections".

replicatord was the first process that came knocking. Since then, ControlCenter, and rapportd.

I haven't even opened the iPhone mirroring app, no Norton or any other AV. So you're all wrong.

So, let's relax and keep gathering information for what replicatord does.

SONAR3 wrote:

Pardon my ignorance, but why would I not need/use NORTON AV on my. iMac? i.e. email scanning and download scanning for virus etc

Those types of apps usually cause more problems than they solve since they interfere with the normal operation of macOS. If you follow the tips in the following article (read through all the links within the article as well), then you greatly minimize the chances of any problems:

Effective defenses against malware and other threats - Apple Community

macOS has great built-in security especially when the user does their part to minimize chances of letting something onto their system. Even for Windows users I don't recommend using any third party AV software since MS already has it built-in. Many of the AV software vendors are now worse than any real threat you are likely to encounter if you practice those safe computing practices. Many AV vendors (and others offering consumer level security offerings & VPNs) are preying on your fears to sell you a false since of security while selling your personal information to make even more money. And some of those apps have their own vulnerabilities which make your system more susceptible to being compromised (funny how some of those security offerings make you more vulnerable).

_Sascha_ wrote:

nowhere in this topic or somewhere else (Norton/Reddit) are clear information and references about it. It's still based on hearsay.

There is also a CAReplicatorLayer. I could have used that in my new app if I had known about it. Not gonna rewrite it now. But still, that's an old API. Doesn't make sense that it would show up only recently. That is, unless Apple extended this feature to replicate Core Animation layers across the network to other devices, which is pretty much what iPhone Mirroring is. But still, just hearsay.

And even if it is iPhone Mirroring, I would like to know, why does it need to communicate and work, in a country where it is disabled?! (EU)

That's easier to answer. Apple builds the operating system the same way for all users. There is no language-specific version. There is no country-specific version. It's all the same. I think it was last year or the year before that people were making these exact same complaints regarding Apple's new "classroom" frameworks. "I'm not a student! Why is this running????"

If Apple can work out a deal with the EU, then they can just flip a switch back at headquarters and everybody in the EU gets iPhone Mirroring instantly. It would be silly to require a software update for that. Then you have two different versions of macOS, one for the EU and one elsewhere.

iPhone Mirroring is tricky. Apple doesn't want to create a little EU-specific cottage industry of iPhone spyware apps. That is what would happen if Apple were forced to allow 3rd party developers to have remote control of iPhones.

Please, has anybody found out what "replicatord" is yet?

The “replicatord” is a process called “replicatord.” It is related to the Apple Remote Desktop (ARD) software on macOS that is used to manage multiple macOS devices remotely. The “replicatord” process is involved in data synchronization or replication, typically used in remote management tasks like file transfers, distributing software updates, or executing commands on other systems.

A Mac will never work properly with "Norton" installed. You can either accept that fact, violate your employer's policy and uninstall it, tell your employer to amend that policy, or buy a Windows PC for your job. There are no other choices.

I am just hoping that it's not doing more harm than good.

"Norton" can do nothing good on Macs. Expressed mathematically,

harm : good = ∞

Rule 1 of Macs is don't install junk.

here is what I found after running a scan on the IP

1. IP Address: 151.101.3.6

• Ports Open:
• Port 80 (HTTP-Proxy): Uses the Varnish caching server.
  • • The Fastly error suggests this is part of a content delivery network (CDN).
• Port 443 (HTTPS):
  • Certificate details suggest it’s related to Apple Inc. with a SAN list containing domains like api.music.apple.com and others.

1. SSL Certificate Information:

• • Common Name (CN): api.music.apple.com
• Subject Alternative Names (SANs): Includes several Apple services such as:
  • • api.shazam.apple.com
    • api.books.apple.com
• api.music.apple.com
• Certificate issued for use starting 2024-12-06 and expiring on 2025-04-08.

1. Service Fingerprints:

• • Port 443 appears to be misconfigured or inaccessible without the correct Host header. It returns a 421 Misdirected Request, meaning the request was sent to a server unable to handle it for the specific hostname requested.

1. Operating System Detection:

• Unreliable but suggests:
  • iOS/macOS (Darwin): Likely running on a CDN system managed by Apple and hosted on Fastlyinfrastructure.

1. Traceroute:

• • The route shows the connection traversing several Spectrum and Charter Communications nodes before reaching Fastly’s CDN node at 151.101.3.6.

SONAR3 wrote:

Pardon my ignorance, but why would I not need/use NORTON AV on my. iMac? i.e. email scanning and download scanning for virus etc

You aren't going to get any virus on a Mac. The only way people get malware on a Mac is by purposefully bypassing multiple levels of Apple security. Sometimes they do this to run pirated versions of expensive apps for free, or watch some paid streaming movie or sporting events for free. But you do have to install it on purpose. And you have to try really hard to do so.

Is 'replicatord' for Apple Intelligence, i.e. uploading a summary of your data to Apple's private cloud in the background? I realise this is not yet functional, but they sure will be testing it in the background. Anything new you had to agree on when updating?

_Sascha_ wrote:

True, but the question what replicatord is and does, still remains open.

False.

replicatord is an Apple service that constitutes part of the macOS operating system. It is part of a private Apple framework. There are 70 similar <whatever>d services in that same folder. But no one cares about them because their 3rd party "security" app didn't flag them.

Anyone who is interested in what replicatord is should uninstall their 3rd party "security" apps. They aren't helping you.