macOS Network Cheat Sheet: practical commands for inspecting and configuring interfaces, DHCP, DNS, network locations, routes, Wi-Fi, Bonjour, firewalls, sockets, packet captures, SSH, and Nmap.
Interfaces and IP Addresses
List hardware ports and their device names
networksetup -listallhardwareports
List configured network services
networksetup -listallnetworkservices
Show all interfaces or details for one device
ifconfig -a ifconfig en0
Show the active network-state summary
scutil --nwi
Get an interface's IPv4 address
ipconfig getifaddr en0
Store the current IPv4 address in a shell variable
ip=$(ipconfig getifaddr en0) && printf '%s\n' "$ip" Read the DHCP subnet mask and DNS server
ipconfig getoption en0 subnet_mask ipconfig getoption en0 domain_name_server
Set a temporary address until the service is reconfigured
sudo ifconfig en0 inet 10.10.10.10 netmask 255.255.255.0 Temporarily change an interface's MAC address
sudo ifconfig en0 ether aa:bb:cc:dd:ee:ff Device names such as en0 are not stable across Macs. Resolve them with networksetup -listallhardwareports before scripting. Changes made directly with ifconfig are temporary and may be replaced by macOS.
Network Services
Rename a network service
networksetup -renamenetworkservice "Ethernet" "Wired" Disable or enable a network service
networksetup -setnetworkserviceenabled "Wi-Fi" off
networksetup -setnetworkserviceenabled "Wi-Fi" on Set network-service priority
networksetup -ordernetworkservices "Wi-Fi" "USB Ethernet" Configure a persistent static IPv4 address
networksetup -setmanual "Ethernet" 192.168.2.100 255.255.255.0 192.168.2.1 Return a service to DHCP
networksetup -setdhcp "Wi-Fi" Configure and inspect DNS servers for a service
networksetup -setdnsservers "Wi-Fi" 10.0.0.2 10.0.0.3
networksetup -getdnsservers "Wi-Fi" Restore DNS servers supplied by DHCP
networksetup -setdnsservers "Wi-Fi" Empty DHCP
Renew an interface's DHCP lease
sudo ipconfig set en0 DHCP Force a BOOTP-to-DHCP negotiation
sudo ipconfig set en0 BOOTP && sudo ipconfig set en0 DHCP Request a configuration refresh through SystemConfiguration
printf '%s\n' 'add State:/Network/Interface/en0/RefreshConfiguration temporary' | sudo scutil Show the DHCP packet, server, lease, and options
ipconfig getpacket en0
Cycling an interface with ifconfig down and up interrupts all traffic on that device. Prefer renewing through ipconfig or reapplying DHCP with networksetup.
DNS and External Address
Inspect the effective resolver configuration
scutil --dns
Query a name through the system resolver
dscacheutil -q host -a name example.com Clear the DNS caches
sudo dscacheutil -flushcache && sudo killall -HUP mDNSResponder Discover the public address through DNS
dig +short myip.opendns.com @resolver1.opendns.com Discover the public address through HTTPS
curl -fsS https://api.ipify.org && echo Host Names
Show the current BSD host name
hostname
Show macOS computer, host, and Bonjour names
scutil --get ComputerName
scutil --get HostName
scutil --get LocalHostName Set all three macOS host-name identities
sudo scutil --set ComputerName "New Mac" && \
sudo scutil --set HostName "new-mac.example.net" && \
sudo scutil --set LocalHostName "new-mac" Set the legacy SMB NetBIOS name when SMB clients require it
sudo defaults write /Library/Preferences/SystemConfiguration/com.apple.smb.server NetBIOSName -string "NEW-MAC" ComputerName is the user-facing label, LocalHostName forms the .local Bonjour name, and HostName is the optional fully qualified Unix host name.
Network Locations
List locations and show the active one
networksetup -listlocations networksetup -getcurrentlocation
Create a populated location
networksetup -createlocation "Work" populate Switch the active location
networksetup -switchtolocation "Work" List location IDs or select one with scselect
scselect
scselect "Work" Delete a location
networksetup -deletelocation "Work" Routes and ARP
Show the IPv4 and IPv6 routing tables
netstat -nr
Inspect the route macOS would use for a destination
route -n get 8.8.8.8 Add and remove a temporary host route
sudo route -n add -host 10.0.0.1 10.0.9.2
sudo route -n delete -host 10.0.0.1 10.0.9.2 Add and remove a temporary subnet route
sudo route -n add -net 10.0.0.0/24 10.0.9.2
sudo route -n delete -net 10.0.0.0/24 10.0.9.2 Show the ARP neighbor cache
arp -a
Delete all removable ARP entries
sudo arp -ad
A /32 route names one host, not an entire network. Routes added with route are normally lost when the network configuration changes or the Mac restarts.
Bonjour and mDNS
Browse advertised Bonjour service types
dns-sd -B _services._dns-sd._udp local. Browse HTTP services on the local network
dns-sd -B _http._tcp local. Temporarily increase mDNSResponder packet logging
sudo killall -USR2 mDNSResponder
log stream --predicate 'process == "mDNSResponder"' --info Legacy: suppress multicast advertisements through mDNSResponder arguments
sudo defaults write /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist ProgramArguments -array-add "-NoMulticastAdvertisements" Legacy: restore the historical default argument array
sudo defaults write /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist ProgramArguments -array "/usr/sbin/mDNSResponder" "-launchd" Do not unload mDNSResponder: macOS also uses it for ordinary DNS resolution. Editing a protected system launch daemon is unsupported on current macOS and may be blocked by System Integrity Protection. Prefer per-service controls or firewall policy.
Ping and Traceroute
Stop after the first successful response
ping -o example.com Send five probes at five-second intervals
ping -c 5 -i 5 192.168.1.1 Set payload size or source address
ping -c 5 -s 100 example.com
ping -c 5 -S 10.10.10.11 example.com Trace the path with or without DNS lookups
traceroute example.com
traceroute -n example.com Enable socket-level traceroute debugging
sudo traceroute -d example.com Flood ping (ping -f) can overwhelm a host or network. Keep it to controlled loopback or laboratory tests.
Sockets and Ports
Show the process using port 80
sudo lsof -nP -iTCP:80 Show all listening TCP processes
sudo lsof -nP -iTCP -sTCP:LISTEN Create a convenient listener alias
alias ports='sudo lsof -nP -iTCP -sTCP:LISTEN' Test a TCP port with a five-second timeout
nc -vz -w 5 example.com 443 Connect over IPv4 or listen locally for a test connection
nc -4 -v example.com 443
nc -l 2196 Show TCP sockets, protocol statistics, or interface counters
netstat -an -p tcp netstat -s netstat -i
Show statistics for one protocol
netstat -s -p igmp
The old Network Utility stroke binary and Server.app networking tools are no longer standard macOS components. Use nc, lsof, netstat, or Nmap instead.
Packet Capture
List capture interfaces
sudo tcpdump -D
Capture without name or service lookups
sudo tcpdump -i en0 -nn
Capture verbose packet data for one port
sudo tcpdump -i en0 -nnvvXSs 0 'port 548' Capture traffic for a port and destination to a pcap file
sudo tcpdump -i en0 -nn -s 0 'port 548 and dst host 10.0.0.48' -w /tmp/capture.pcap Read a pcap and render printable payload bytes
tcpdump -qnn -s 0 -A -r /tmp/capture.pcap Packet captures may contain credentials, cookies, personal data, and private payloads. Capture only traffic you are authorized to inspect and protect pcap files accordingly.
Wi-Fi
Turn the Wi-Fi device on or off
networksetup -setairportpower en0 on networksetup -setairportpower en0 off
Join a Wi-Fi network
networksetup -setairportnetwork en0 "WIFI_SSID" "WIFI_PASSWORD" Show known preferred Wi-Fi networks
networksetup -listpreferredwirelessnetworks en0
Read a saved Wi-Fi password from Keychain after authorization
security find-generic-password -D "AirPort network password" -a "WIFI_SSID" -gw Legacy private tool: inspect the current association
/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I Legacy private tool: scan nearby access points
/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -s Legacy private tool: print the current SSID
/System/Library/PrivateFrameworks/Apple80211.framework/Versions/Current/Resources/airport -I | awk '/ SSID/ {print substr($0, index($0, $2))}' Legacy: inspect historical airport preference data
sudo defaults read /Library/Preferences/SystemConfiguration/com.apple.airport.preferences airport is an undocumented private binary and may disappear or change. Do not create a permanent symlink that disguises this dependency; use Wireless Diagnostics for supported scans when the binary is absent.
Application Firewall
Inspect the application firewall state
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate Enable or disable the application firewall
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate on
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setglobalstate off List applications known to the firewall
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --listapps Add and unblock an application
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --add "/Applications/Example.app"
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp "/Applications/Example.app" Enable stealth mode
sudo /usr/libexec/ApplicationFirewall/socketfilterfw --setstealthmode on The historical com.apple.alf launch agents and socketfilterfw -t syntax are obsolete. Use the documented long options above. The application firewall controls inbound app access; it is not a general outbound packet filter.
SSH and Remote Login
Store a private-key passphrase in the Apple Keychain
ssh-add --apple-use-keychain ~/.ssh/id_ed25519 Load Apple Keychain identities into the agent
ssh-add --apple-load-keychain
Configure a host to use its key and the Apple Keychain
Host server.example.com
IdentityFile ~/.ssh/id_ed25519
UseKeychain yes
AddKeysToAgent yes Check, enable, or disable Remote Login
sudo systemsetup -getremotelogin sudo systemsetup -setremotelogin on sudo systemsetup -setremotelogin off
The old ssh-add -K option is ambiguous outside Apple's OpenSSH; use --apple-use-keychain. For tunnels, jump hosts, and forwarding, use the SSH commands reference.
SSHFS
Mount a remote directory after installing macFUSE and SSHFS
mkdir -p ~/mnt/server
sshfs user@192.168.2.1:/remote/path ~/mnt/server Unmount the remote directory
umount ~/mnt/server SSHFS is not included with macOS. It requires a compatible macFUSE installation and may require approval in Privacy & Security.
TFTP
Start the built-in TFTP launch daemon where it is still shipped
sudo launchctl load -F /System/Library/LaunchDaemons/tftp.plist
sudo launchctl start com.apple.tftpd Stop and unload the TFTP daemon
sudo launchctl stop com.apple.tftpd
sudo launchctl unload /System/Library/LaunchDaemons/tftp.plist The native daemon serves /private/tftpboot. TFTP has no authentication or encryption; expose it only on a trusted, isolated network. These legacy launchctl verbs may change on future macOS versions.
Scheduled Network Tasks
Edit the current user's crontab
crontab -e
List the current user's cron jobs
crontab -l
Cron remains available, but launchd is the native macOS scheduler and is better suited to jobs that depend on login state, network availability, or sleep and wake behavior.
Nmap Targets and Discovery
Scan one host, several hosts, a range, or a subnet
nmap 192.168.1.1
nmap 192.168.1.1 192.168.1.2
nmap 192.168.1.1-20
nmap 192.168.1.0/24 Read targets from a file
nmap -iL /tmp/targets.txt Exclude hosts directly or from a file
nmap 192.168.1.0/24 --exclude 192.168.1.5,192.168.1.254
nmap -iL /tmp/targets.txt --excludefile /tmp/exclude.txt Discover live hosts without a port scan
nmap -sn 192.168.1.0/24 Skip host discovery when probes are filtered
nmap -Pn 192.168.1.1 Scan an IPv6 address or host
nmap -6 2001:db8::10
nmap -6 server.example.com Show Nmap's local interfaces and routes
nmap --iflist
The modern forms are -Pn instead of -PN and -sn instead of -sP. Scan only systems and networks you own or are explicitly authorized to test.
Nmap Ports and Detection
Run a fast scan of common ports
nmap -F 192.168.1.1 Scan selected TCP ports or a range
nmap -p 22,80,443 192.168.1.1
nmap -p T:80-200 192.168.1.1 Scan selected TCP and UDP ports
sudo nmap -sS -sU -p U:53,123,T:22,80,443 192.168.1.1 Scan all ports or the most common ports
nmap -p- 192.168.1.1
nmap --top-ports 10 192.168.1.1 Show only open ports and explain each state
nmap --open --reason 192.168.1.1 Detect service versions, scripts, routes, and operating system
sudo nmap -A 192.168.1.1 Perform OS detection with an informed guess
sudo nmap -O --osscan-guess 192.168.1.1 Probe firewall filtering with TCP ACK packets
sudo nmap -sA 192.168.1.1 Trace every packet sent and received by Nmap
sudo nmap --packet-trace -p 443 192.168.1.1 Increase scan speed on a reliable local network
nmap -T4 192.168.1.0/24 -A, OS detection, UDP scanning, packet tracing, and high timing templates are noisy and may disrupt fragile devices. Start with a narrow target and port set. Use -T5 only in a controlled environment where missed results are acceptable.