What is racoon?

Seeing a process called racoon in Activity Monitor can be surprising. Despite the name, it has nothing to do with animals. It is a VPN tool.

What is racoon?

racoon is the IKE (Internet Key Exchange) daemon used for IPsec VPN connections. It sets up and manages the security layer for VPN tunnels. The name comes from the KAME project, a Japanese open-source networking effort that macOS inherited from its BSD roots.

When does it run?

racoon starts when your Mac opens an IPsec VPN connection. This includes:

• L2TP/IPsec VPN connections set up in System Settings
• Cisco IPsec VPN connections
• Any VPN that uses the built-in macOS IPsec system

If you are not using a VPN, racoon may still be loaded but will not be doing anything.

What about third-party VPN apps?

Many modern VPN apps (like WireGuard, OpenVPN, or paid VPN services) use their own methods and do not rely on racoon. If you use one of these, racoon is probably not involved.

Can you turn it off?

racoon only runs when needed for IPsec VPN connections. If you are not using an IPsec VPN, it will not be active. There is no need to turn it off.

Should you worry?

No. It is a standard Unix networking tool included with macOS. If you see it running and you are not connected to a VPN, check whether a VPN profile was set up on your Mac. Look in System Settings, then VPN for any saved connections.

Enjoyed this post?

Well, you could share the post with others, follow me with RSS Feeds and/or send me a comment via email.

Tags