# Local Network privacy TN3179 NSBonjourServices and detecting a denial > Source-anchored research for Local Network privacy TN3179 NSBonjourServices and detecting a denial. Run status: COMPLETED. Parent: [macOS App Sandbox Networking and Entitlements](https://llms-explorer.com/tree/macos-app-sandbox-networking/) · 3 facets · 12 facts · page: https://llms-explorer.com/tree/local-network-privacy-tn3179-nsbonjourservices-and-detecting-a-denial/ ## How it works - There is no general API to ask whether the process has local network access (FB8711182). Detect denial per operation: for Bonjour, an NWBrowser state .waiting(.dns(code)) with code kDNSServiceErr_PolicyDenied (-65570); for TCP, NWConnection enters .waiting and currentPath?.unsatisfiedReason == .localNetworkDenied. (low confidence) — [source](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy) - macOS auto-allows launchd daemons, any process running as root, and command-line tools run from Terminal or SSH with their children. launchd agents and ordinary apps are not auto-allowed. For helpers, macOS attributes the operation to the responsible app and records the choice for the whole app; an agent not installed through SMAppService needs AssociatedBundleIdentifiers in its launchd plist. (low confidence) — [source](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy) - On macOS there is no way to reset a program's Local Network privilege to Undetermined (FB14944392); workarounds are a VM snapshot or a fresh user account. There is no API to show the alert on demand; connecting a UDP socket to a link-local IPv6 address (port 9) triggers it without sending traffic, best effort. (low confidence) — [source](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy) ## Problems, failure modes and limitations - Local network privacy is supported on macOS from macOS 15; the privilege has three states (Undetermined, Allowed, Denied), the first local network operation triggers the alert, and macOS keeps separate state per user account. MDM cannot configure it. (medium confidence) — [source](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy) - Known macOS defects: very short-lived processes performing a local network operation get no alert (FB16131937, so do not exit immediately after failure); multiple installed copies of an app confuse System Settings (FB15568200); macOS 15.0 had many bugs fixed in 15.1. Community reports describe approved apps still blocked, missing prompts, re-prompts after 15.2/15.4 updates, and NSProcessInfo hostName triggering the prompt. (medium confidence) (verified as of 2026-02-17) — [source](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy) ## Facts and statements - Outgoing TCP connect, UDP unicast/multicast/broadcast send, connecting a UDP socket, and receiving UDP multicast/broadcast need local network access. Listening for/accepting TCP and receiving UDP unicast do not. The check sits deep in the stack, so it applies to Network.framework, BSD sockets and URLSession alike. (low confidence) — [source](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy) - Exemptions: traffic to a DNS server or network proxy that sits on the local network does not need access, nor does resolving a non-local DNS name with the system resolver. Resolving a .local name does need access. A network/DNS monitor that probes arbitrary LAN hosts or uses mDNS is therefore affected, but plain queries to the configured resolver are not. (low confidence) — [source](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy) - All Bonjour operations (register, browse, resolve) require local network access, across DNS-SD, Network.framework and Multipeer Connectivity. NSBonjourServices lists the service types the app uses (format _type._tcp / _udp); NSLocalNetworkUsageDescription supplies the alert text for any direct or indirect local network use. Both go in the app's Info.plist (the container app, not extensions). (medium confidence) — [source](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy) - If the user later grants access, NWConnection retries automatically; if the user revokes access, an established TCP connection to a local address is closed and new ones go to .waiting. The system may deny an operation immediately while the alert is still showing, so use waiting-for-connectivity APIs (Network.framework, URLSession waitsForConnectivity) or retry logic. (low confidence) — [source](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy) - Identity is tracked by code signature and main-executable UUID: sign with an Apple-issued identity (not ad hoc) and keep a unique UUID, otherwise behavior can be erratic. The multicast entitlement is not required on macOS. (low confidence) — [source](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy) - macOS 15.5 added two sudo-set defaults in domain com.apple.network.local-network, AllowedEthernetLocalNetworkAddresses and AllowedWiFiLocalNetworkAddresses (arrays of CIDR strings) that exempt whole networks from the privilege; a restart is needed. An Apple DTS engineer recommended them for unattended CI in April 2026. (medium confidence) (verified as of 2026-04-01) — [source](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy) - Do not hard-code en0 as the Wi-Fi interface; apps that do can appear to bypass or break the alert. Run discovery on all broadcast-capable interfaces, or filter getifaddrs by the SIOCGIFFUNCTIONALTYPE ioctl. (low confidence) — [source](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy)