raw Software
RAW Software Networking macOS Networking

macOS Network Cheat Sheet

Robert Eisele

macOS Network Cheat Sheet: practical commands for inspecting and configuring interfaces, DHCP, DNS, network locations, routes, Wi-Fi, Bonjour, firewalls, sockets, packet captures, SSH, and Nmap.

Interfaces and IP Addresses

List hardware ports and their device names

networksetup -listallhardwareports

List configured network services

networksetup -listallnetworkservices

Show all interfaces or details for one device

ifconfig -a
ifconfig en0

Show the active network-state summary

scutil --nwi

Get an interface's IPv4 address

ipconfig getifaddr en0

Store the current IPv4 address in a shell variable

ip=$(ipconfig getifaddr en0) && printf '%s\n' "$ip"

Read the DHCP subnet mask and DNS server

ipconfig getoption en0 subnet_mask
ipconfig getoption en0 domain_name_server

Set a temporary address until the service is reconfigured

sudo ifconfig en0 inet 10.10.10.10 netmask 255.255.255.0

Temporarily change an interface's MAC address

sudo ifconfig en0 ether aa:bb:cc:dd:ee:ff

Device names such as en0 are not stable across Macs. Resolve them with networksetup -listallhardwareports before scripting. Changes made directly with ifconfig are temporary and may be replaced by macOS.

Network Services

Rename a network service

networksetup -renamenetworkservice "Ethernet" "Wired"

Disable or enable a network service

networksetup -setnetworkserviceenabled "Wi-Fi" off
networksetup -setnetworkserviceenabled "Wi-Fi" on

Set network-service priority

networksetup -ordernetworkservices "Wi-Fi" "USB Ethernet"

Configure a persistent static IPv4 address

networksetup -setmanual "Ethernet" 192.168.2.100 255.255.255.0 192.168.2.1

Return a service to DHCP

networksetup -setdhcp "Wi-Fi"

Configure and inspect DNS servers for a service

networksetup -setdnsservers "Wi-Fi" 10.0.0.2 10.0.0.3
networksetup -getdnsservers "Wi-Fi"

Restore DNS servers supplied by DHCP

networksetup -setdnsservers "Wi-Fi" Empty

DHCP

Renew an interface's DHCP lease

sudo ipconfig set en0 DHCP

Force a BOOTP-to-DHCP negotiation

sudo ipconfig set en0 BOOTP && sudo ipconfig set en0 DHCP

Request a configuration refresh through SystemConfiguration

printf '%s\n' 'add State:/Network/Interface/en0/RefreshConfiguration temporary' | sudo scutil

Show the DHCP packet, server, lease, and options

ipconfig getpacket en0

Cycling an interface with ifconfig down and up interrupts all traffic on that device. Prefer renewing through ipconfig or reapplying DHCP with networksetup.

DNS and External Address

Inspect the effective resolver configuration

scutil --dns

Query a name through the system resolver

dscacheutil -q host -a name example.com

Clear the DNS caches

sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder

Discover the public address through DNS

dig +short myip.opendns.com @resolver1.opendns.com

Discover the public address through HTTPS

curl -fsS https://api.ipify.org && echo

Host Names

Show the current BSD host name

hostname

Show macOS computer, host, and Bonjour names

scutil --get ComputerName
scutil --get HostName
scutil --get LocalHostName

Set all three macOS host-name identities

sudo scutil --set ComputerName "New Mac" && \
sudo scutil --set HostName "new-mac.example.net" && \
sudo scutil --set LocalHostName "new-mac"

Set the legacy SMB NetBIOS name when SMB clients require it

sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server NetBIOSName -string "NEW-MAC"

ComputerName is the user-facing label, LocalHostName forms the .local Bonjour name, and HostName is the optional fully qualified Unix host name.

Network Locations

List locations and show the active one

networksetup -listlocations
networksetup -getcurrentlocation

Create a populated location

networksetup -createlocation "Work" populate

Switch the active location

networksetup -switchtolocation "Work"

List location IDs or select one with scselect

scselect
scselect "Work"

Delete a location

networksetup -deletelocation "Work"

Routes and ARP

Show the IPv4 and IPv6 routing tables

netstat -nr

Inspect the route macOS would use for a destination

route -n get 8.8.8.8

Add and remove a temporary host route

sudo route -n add -host 10.0.0.1 10.0.9.2
sudo route -n delete -host 10.0.0.1 10.0.9.2

Add and remove a temporary subnet route

sudo route -n add -net 10.0.0.0/24 10.0.9.2
sudo route -n delete -net 10.0.0.0/24 10.0.9.2

Show the ARP neighbor cache

arp -a

Delete all removable ARP entries

sudo arp -ad

A /32 route names one host, not an entire network. Routes added with route are normally lost when the network configuration changes or the Mac restarts.

Bonjour and mDNS

Browse advertised Bonjour service types

dns-sd -B _services._dns-sd._udp local.

Browse HTTP services on the local network

dns-sd -B _http._tcp local.

Temporarily increase mDNSResponder packet logging

sudo killall -USR2 mDNSResponder
log stream --predicate 'process == "mDNSResponder"' --info

Legacy: suppress multicast advertisements through mDNSResponder arguments

sudo defaults write /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist ProgramArguments -array-add "-NoMulticastAdvertisements"

Legacy: restore the historical default argument array

sudo defaults write /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist ProgramArguments -array "/usr/sbin/mDNSResponder" "-launchd"

Do not unload mDNSResponder: macOS also uses it for ordinary DNS resolution. Editing a protected system launch daemon is unsupported on current macOS and may be blocked by System Integrity Protection. Prefer per-service controls or firewall policy.

Ping and Traceroute

Stop after the first successful response

ping -o example.com

Send five probes at five-second intervals

ping -c 5 -i 5 192.168.1.1

Set payload size or source address

ping -c 5 -s 100 example.com
ping -c 5 -S 10.10.10.11 example.com

Trace the path with or without DNS lookups

traceroute example.com
traceroute -n example.com

Enable socket-level traceroute debugging

sudo traceroute -d example.com

Flood ping (ping -f) can overwhelm a host or network. Keep it to controlled loopback or laboratory tests.

Sockets and Ports

Show the process using port 80

sudo lsof -nP -iTCP:80

Show all listening TCP processes

sudo lsof -nP -iTCP -sTCP:LISTEN

Create a convenient listener alias

alias ports='sudo lsof -nP -iTCP -sTCP:LISTEN'

Test a TCP port with a five-second timeout

nc -vz -w 5 example.com 443

Connect over IPv4 or listen locally for a test connection

nc -4 -v example.com 443
nc -l 2196

Show TCP sockets, protocol statistics, or interface counters

netstat -an -p tcp
netstat -s
netstat -i

Show statistics for one protocol

netstat -s -p igmp

The old Network Utility stroke binary and Server.app networking tools are no longer standard macOS components. Use nc, lsof, netstat, or Nmap instead.

Packet Capture

List capture interfaces

sudo tcpdump -D

Capture without name or service lookups

sudo tcpdump -i en0 -nn

Capture verbose packet data for one port

sudo tcpdump -i en0 -nnvvXSs 0 'port 548'

Capture traffic for a port and destination to a pcap file

sudo tcpdump -i en0 -nn -s 0 'port 548 and dst host 10.0.0.48' -w /tmp/capture.pcap

Read a pcap and render printable payload bytes

tcpdump -qnn -s 0 -A -r /tmp/capture.pcap

Packet captures may contain credentials, cookies, personal data, and private payloads. Capture only traffic you are authorized to inspect and protect pcap files accordingly.

Wi-Fi

Turn the Wi-Fi device on or off

networksetup -setairportpower en0 on
networksetup -setairportpower en0 off

Join a Wi-Fi network

networksetup -setairportnetwork en0 "WIFI_SSID" "WIFI_PASSWORD"

Show known preferred Wi-Fi networks

networksetup -listpreferredwirelessnetworks en0

Read a saved Wi-Fi password from Keychain after authorization

security find-generic-password -D "AirPort network password" -a "WIFI_SSID" -gw

Legacy private tool: inspect the current association

/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I

Legacy private tool: scan nearby access points

/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s

Legacy private tool: print the current SSID

/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I | awk '/ SSID/ {print substr($0, index($0, $2))}'

Legacy: inspect historical airport preference data

sudo defaults read /Library/Preferences/SystemConfiguration/com.apple.airport.preferences

airport is an undocumented private binary and may disappear or change. Do not create a permanent symlink that disguises this dependency; use Wireless Diagnostics for supported scans when the binary is absent.

Application Firewall

Inspect the application firewall state

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate

Enable or disable the application firewall

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate off

List applications known to the firewall

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --listapps

Add and unblock an application

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add "/Applications/Example.app"
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp "/Applications/Example.app"

Enable stealth mode

sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on

The historical com.apple.alf launch agents and socketfilterfw -t syntax are obsolete. Use the documented long options above. The application firewall controls inbound app access; it is not a general outbound packet filter.

SSH and Remote Login

Store a private-key passphrase in the Apple Keychain

ssh-add --apple-use-keychain ~/.ssh/id_ed25519

Load Apple Keychain identities into the agent

ssh-add --apple-load-keychain

Configure a host to use its key and the Apple Keychain

Host server.example.com
    IdentityFile ~/.ssh/id_ed25519
    UseKeychain yes
    AddKeysToAgent yes

Check, enable, or disable Remote Login

sudo systemsetup -getremotelogin
sudo systemsetup -setremotelogin on
sudo systemsetup -setremotelogin off

The old ssh-add -K option is ambiguous outside Apple's OpenSSH; use --apple-use-keychain. For tunnels, jump hosts, and forwarding, use the SSH commands reference.

SSHFS

Mount a remote directory after installing macFUSE and SSHFS

mkdir -p ~/mnt/server
sshfs user@192.168.2.1:/remote/path ~/mnt/server

Unmount the remote directory

umount ~/mnt/server

SSHFS is not included with macOS. It requires a compatible macFUSE installation and may require approval in Privacy & Security.

TFTP

Start the built-in TFTP launch daemon where it is still shipped

sudo launchctl load -F /System/Library/LaunchDaemons/tftp.plist
sudo launchctl start com.apple.tftpd

Stop and unload the TFTP daemon

sudo launchctl stop com.apple.tftpd
sudo launchctl unload /System/Library/LaunchDaemons/tftp.plist

The native daemon serves /private/tftpboot. TFTP has no authentication or encryption; expose it only on a trusted, isolated network. These legacy launchctl verbs may change on future macOS versions.

Scheduled Network Tasks

Edit the current user's crontab

crontab -e

List the current user's cron jobs

crontab -l

Cron remains available, but launchd is the native macOS scheduler and is better suited to jobs that depend on login state, network availability, or sleep and wake behavior.

Nmap Targets and Discovery

Scan one host, several hosts, a range, or a subnet

nmap 192.168.1.1
nmap 192.168.1.1 192.168.1.2
nmap 192.168.1.1-20
nmap 192.168.1.0/24

Read targets from a file

nmap -iL /tmp/targets.txt

Exclude hosts directly or from a file

nmap 192.168.1.0/24 --exclude 192.168.1.5,192.168.1.254
nmap -iL /tmp/targets.txt --excludefile /tmp/exclude.txt

Discover live hosts without a port scan

nmap -sn 192.168.1.0/24

Skip host discovery when probes are filtered

nmap -Pn 192.168.1.1

Scan an IPv6 address or host

nmap -6 2001:db8::10
nmap -6 server.example.com

Show Nmap's local interfaces and routes

nmap --iflist

The modern forms are -Pn instead of -PN and -sn instead of -sP. Scan only systems and networks you own or are explicitly authorized to test.

Nmap Ports and Detection

Run a fast scan of common ports

nmap -F 192.168.1.1

Scan selected TCP ports or a range

nmap -p 22,80,443 192.168.1.1
nmap -p T:80-200 192.168.1.1

Scan selected TCP and UDP ports

sudo nmap -sS -sU -p U:53,123,T:22,80,443 192.168.1.1

Scan all ports or the most common ports

nmap -p- 192.168.1.1
nmap --top-ports 10 192.168.1.1

Show only open ports and explain each state

nmap --open --reason 192.168.1.1

Detect service versions, scripts, routes, and operating system

sudo nmap -A 192.168.1.1

Perform OS detection with an informed guess

sudo nmap -O --osscan-guess 192.168.1.1

Probe firewall filtering with TCP ACK packets

sudo nmap -sA 192.168.1.1

Trace every packet sent and received by Nmap

sudo nmap --packet-trace -p 443 192.168.1.1

Increase scan speed on a reliable local network

nmap -T4 192.168.1.0/24

-A, OS detection, UDP scanning, packet tracing, and high timing templates are noisy and may disrupt fragile devices. Start with a narrow target and port set. Use -T5 only in a controlled environment where missed results are acceptable.