What is locationd and why is my 3rd party firewall intercepting it in Snow Leopard at intervals?

Little Snitch reported an outgoing connection from locationd which appears to be a new daemon installed by default on Snow Leopard.

A search for strings inside the locationd binary shows a link to http://skyhookwireless.com. The index of their page reads:

Skyhook Wireless' XPS is the world's first true hybrid positioning system.

Combining the unique benefits of GPS, Cell Tower triangulation and Wi-Fi Positioning, mobile consumers no longer have to wait minutes for a response or cope with inaccurate location.

If it happens again, I will report back with more details (endpoint, etc). I only clicked "allow once", so I did not create a firewall rule, unfortunately.

user4881

Posted 2009-09-05T22:32:23.480

Reputation: 488

1Skyhook =~ Skynet: sounds like the end of the world to me... – Telemachus – 2009-09-28T19:50:35.433

Answers

Short answer: You are seeing the request to Skyhook Wireless because they have the geographic database that Apple uses for Core Location in the operating system.

Longer answer:

Skyhook Wireless is the company with the geographic database about WiFi access points that is used for the new location services (Core Location) in OS X Snow Leopard. Core Location is a developer framework for dealing with the computer's location, and a usage example is automatic time zone updates based on your location. There is an option to turn the time zone updates on/off under the Date & Time preferences pane under Time Zone.

Skyhook Wireless's database triangulates a location based on a combination of IP geo-location and the MAC addresses of wireless devices that can be seen, even if the networks it is triangulating the location from is not open. (MAC addresses are always unencrypted and public even when using WPA since the MAC address helps identify the access point.) If I recall correctly, they can usually triangulate to within a few hundred meters of accuracy.

Lara Dougan

Posted 2009-09-05T22:32:23.480

Reputation: 2 266

1This is correct. Apple first paired up with Skyhook to provide positioning for the iPhone/iPod Touch based on wireless networks. You can also add your personal wireless network to Skyhook's database. – Jared Harley – 2009-09-06T02:59:48.533

2It's built in to a new API called Core Location. It's not something you should worry about. – alex – 2009-09-06T05:46:25.637

Adam- I'm interested in what else the location services do in the process of keeping my OS running. Also, why would locationd need to transmit data to a remote endpoint in order to adjust my system clock to the correct time zone? – user4881 – 2009-09-06T23:25:46.467

I added some more detail to this post, especially about Skyhook Wireless specifically. locationd needs to transmit data, because Skyhook Wireless are the ones with the geolocation database, not Apple. – Lara Dougan – 2009-09-07T18:09:55.007

2@sludge: If the Date and Time Preference Pane is set to automatically find your location it uses CoreLocation to find your location and then sets the time zone accordingly. – Chealion – 2009-09-14T16:25:16.753

As mentioned in another answer, locationd is the daemon (system process) responsible for Snow Leopard's new Core Location service, which uses the Skyhook WiFi location database to (attempt to) ascertain your location based on the WiFi access points your Mac "sees." However, disabling the "automatically update time zone" in Date and Time Preferences does NOT disable this feature. To completely disable Location Services, go to the Security preferences pane, and check the "Disable Location Services" button. Note that you'll only see any of these options if your Mac actually has WiFi. (this may sound obvious but I thought I'd better mention it seeing as how I just spent about ten minutes looking at my Mac Pro [which doesn't have AirPort] and scratching my head saying "gee, now I thought there was an option to disable that...")

Donald Burr

Posted 2009-09-05T22:32:23.480

Reputation: 603