macOS CLI Networking Cheat Sheet

By Manny Fernandez

August 31, 2026

macOS CLI Networking Cheat Sheet

If you troubleshoot Macs on a network for a living, you already know the GUI only gets you so far. ipconfig, ifconfig, networksetup, tcpdump, and a handful of other built-in tools will get you an answer faster than System Settings ever will. This is the reference sheet we keep open in a terminal tab: every command grouped by what it’s actually for, so you can find it fast during a live troubleshooting call instead of scrolling a man page.

IP and Interface Basics

Get the IP address assigned to en0:

ipconfig getifaddr en0

Store it in a variable and echo it back:

ip=$(ipconfig getifaddr en0); echo $ip

Check the subnet mask en0 is using:

ipconfig getoption en0 subnet_mask

Check the DNS server en0 picked up:

ipconfig getoption en0 domain_name_server

Pull the full DHCP lease details for an interface:

ipconfig getpacket en1

Dump everything ifconfig knows about en0:

ifconfig en0

Manually set an IP address and subnet mask on en0:

ifconfig en0 inet 10.10.10.10 netmask 255.255.255.0

Network Locations

List every network location configured on the Mac:

networksetup -listlocations

Show which location is currently active:

networksetup -getcurrentlocation

Create a new location called Work, seeded from the currently active connection:

networksetup -createlocation Work populate

Delete the Work location:

networksetup -deletelocation Work

Switch the active location to Work:

networksetup -switchlocation Work

Switch locations through scutil instead, useful when you need the identifier for a script:

scselect Work

Network Services

List every network service on the system:

networksetup -listallnetworkservices

Rename a service, in this case Ethernet to Wired:

networksetup -renamenetworkservice Ethernet Wired

Disable a network service:

networksetup -setnetworkserviceenabled "Wi-Fi" off

Change the priority order of your network services:

networksetup -ordernetworkservices "Wi-Fi" "USB Ethernet"

Force a service back to DHCP:

networksetup -setdhcp Wi-Fi

Renew a DHCP lease from the shell:

ipconfig set en1 BOOTP && ipconfig set en1 DHCP
ifconfig en1 down && ifconfig en1 up

Renew a DHCP lease through scutil instead, handy inside a script:

echo "add State:/Network/Interface/en0/RefreshConfiguration temporary" | sudo scutil

Configure a manual static IP:

networksetup -setmanual Wi-Fi 10.0.0.2 255.255.255.0 10.0.0.1

Set the DNS servers for an interface:

networksetup -setdnsservers Wi-Fi 10.0.0.2 10.0.0.3

Check which DNS servers an interface is currently using:

networksetup -getdnsservers Wi-Fi

Application Firewall

Stop the application layer firewall:

launchctl unload /System/Library/LaunchAgents/com.apple.alf.useragent.plist
launchctl unload /System/Library/LaunchDaemons/com.apple.alf.agent.plist

Start it back up:

launchctl load /System/Library/LaunchDaemons/com.apple.alf.agent.plist
launchctl load /System/Library/LaunchAgents/com.apple.alf.useragent.plist

Allow a specific app to reach out through the firewall:

fw=/usr/libexec/ApplicationFirewall/socketfilterfw
app="/Applications/FileMaker Pro/FileMaker Pro.app/Contents/MacOS/FileMaker Pro"
"$fw" -t "$app"

Routing

View the routing table:

netstat -nr

Add a static route out a specific interface:

route -n add 10.0.0.0/32 10.0.9.2

Bonjour and mDNS

Log Bonjour traffic at the packet level:

sudo killall -USR2 mDNSResponder

Stop Bonjour:

launchctl unload -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist

Start Bonjour:

launchctl load -w /System/Library/LaunchDaemons/com.apple.mDNSResponder.plist

Ping Toolkit

Add a delay between pings, five seconds here:

ping -i 5 192.168.210.1

Ping exactly five times and stop:

ping -c 5 google.com

Flood ping, only against hosts you own:

ping -f localhost

Set the ICMP packet size:

ping -s 100 google.com

Set the source IP the ping goes out with:

ping -S 10.10.10.11 google.com

Sweep a subnet with a quick for loop:

for ip in {1..254}; do ping -c 1 10.1.105.$ip; done

Traceroute

Trace the path to a host:

traceroute google.com

Skip the reverse DNS lookups for a faster trace:

traceroute -n google.com

Trace in debug mode:

traceroute -d google.com

Netstat Deep Dive

View all active sockets:

netstat -at

View IPv6 listeners:

netstat -lt

Per-protocol statistics:

netstat -s

Stats for one specific protocol, IGMP here:

netstat -p igmp

Interface statistics:

netstat -i

Port Scanning and Connectivity Tests

Quick TCP port check using the built-in Network Utility stroke tool:

stroke="/System/Library/CoreServices/Applications/Network Utility.app/Contents/\
Resources/stroke"
"$stroke" www.google.com 80 80

Stealth SYN scan with OS fingerprinting, only against hosts you’re authorized to scan:

nmap -sS -O krypted.com/24

Open a TCP connection to test reachability:

nc -v www.apple.com 80

Test connectivity to a specific host and port with a timeout:

/usr/bin/nc -v -w 15 gateway.push.apple.com 2195

Same test, but force IPv4 only:

/usr/bin/nc -v -4 feedback.push.apple.com 2196

Spin up a listener on a port for testing:

/usr/bin/nc -l 2196

Live network monitor, requires ntop to be installed:

ntop

Packet Capture With tcpdump

Basic capture, numeric addresses only:

tcpdump -nS

Full verbose capture with a hex and ASCII dump:

tcpdump -nnvvXS

Capture traffic on a specific port:

tcpdump -nnvvXs 548

Capture traffic on a port headed to one destination:

tcpdump -nnvvXs 548 dst 10.0.0.48

Same capture, written to a pcap file for later analysis:

tcpdump -nnvvXs 548 dst 10.0.0.48 -w /tmp/myfile.pcap

Read a saved capture back in human-readable form:

tcpdump -qns 0 -A -r /var/tmp/capture.pcap

Listening Ports and Processes

Which processes have which TCP ports open, and in what state:

lsof -n -i4TCP

A quick alias for “show me what’s listening”:

alias ports='lsof -n -i4TCP | grep LISTEN'

DNS, Hostname, and ARP

Print the system hostname:

hostname

Flush the local DNS resolver cache:

dscacheutil -flushcache

Clear the ARP cache:

arp -ad

Disk and Wi-Fi Diagnostics

Check disk I/O performance:

iostat -d disk0

Pull current Wi-Fi connection info:

airport=/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/\
Resources/airport
$airport -I

Scan for nearby wireless networks:

airport=/System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/\
Resources/airport
$airport -s

macOS Server (Legacy)

View how Server.app is interpreting your network settings:

serveradmin settings network

Whitelist an IP address in the Server app’s firewall:

/Applications/Server.app/Contents/ServerRoot/usr/libexec/afctl -w 10.10.10.2

Bonus One-Liner

Check the CPU model while you’re in there:

sysctl -n machdep.cpu.brand_string

Bookmark this one. Between DHCP hand-offs, DNS cache issues, firewall states, and a flaky Wi-Fi adapter, this covers the commands that come up over and over on a Mac fleet. If a command needs sudo on your build and it’s not shown that way above, that’s normal, permissions vary by what you’re touching.

macOS CLI Networking Cheat Sheet

IP and Interface Basics

Network Locations

Network Services

Application Firewall

Routing

Bonjour and mDNS

Ping Toolkit

Traceroute

Netstat Deep Dive

Port Scanning and Connectivity Tests

Packet Capture With tcpdump

Listening Ports and Processes

DNS, Hostname, and ARP

Disk and Wi-Fi Diagnostics

macOS Server (Legacy)

Bonus One-Liner

Recent posts