Firewall & Active Defense

Report whether the application firewall and stealth mode are on.

Turn ON the macOS application firewall and stealth mode (blocks unsolicited incoming connections; ignores network probes). Needs admin.

Turn the application firewall (and stealth mode) off — the undo of enable_firewall, for when the firewall blocks something the user needs (AirDrop, screen sharing, a local server). This reduces protection; suggest re-enabling afterwards. Needs admin.

List the IP addresses currently blocked by Cyclone's firewall rule (read-only).

Block all traffic to and from a specific remote IP using the macOS packet firewall (pf), persisting across reboots. Needs admin.

Remove a remote IP from Cyclone's firewall block list. Needs admin.

List the macOS application firewall's per-app INCOMING rules — which apps are allowed vs blocked from receiving unsolicited incoming connections. Complements check_firewall_status (global on/off).

Block one application from receiving incoming network connections via the macOS application firewall. (macOS's app firewall controls INCOMING only — to stop an app's OUTGOING traffic, block the remote IP with block_ip.) Needs admin.

Allow an application to receive incoming network connections again (the undo of block_app_incoming). Needs admin.

Inspect /etc/hosts for hijack entries. Malware/adware edits this file to silently redirect real websites (e.g. a bank or search engine) to another machine — DNS checks can not see this because hosts wins before DNS. Separates harmless ad-block style entries (domain → this Mac) from true redirects (domain → another IP).

Remove hijacking REDIRECT entries from /etc/hosts — the ones that silently send a real domain (e.g. a bank or search engine) to another machine. Comments them out (never deletes the file), backs the original up to /etc/hosts.cyclone.bak, flushes the DNS cache, and re-checks. Harmless ad-block style entries that point domains at this Mac itself are LEFT ALONE. Needs admin. Use after check_hosts_file finds a redirect.

Check the ARP table for man-in-the-middle red flags (one hardware MAC impersonating several IPs, or a changed gateway MAC).

Report the DNS resolvers in use and flag unexpected external ones (a sign of DNS hijacking that silently redirects websites).

Flush this Mac's DNS resolver cache to clear any poisoned/redirected entries. Needs admin.

Start the real-time defense monitor: every ~30s it snapshots this Mac's connections, listening ports, logins and gateway and records anomalies (a new remote connection, a new open port, a new login, a gateway-MAC change). Safe to start autonomously.

Stop the real-time defense monitor. Confirm-required: stopping ends a protection the user started, so it never happens silently.

Return the anomalies the real-time monitor has recorded (with severity: 'alert' = new login / new remote-access door / gateway MAC change; 'notice' = informational).

List the current interactive login sessions on this Mac (user, terminal, and whether local or from a remote host).

Detect whether anyone is connected to this Mac remotely right now (remote logins + active SSH/Screen Sharing/ARD connections).