Network & Connections

Scan this Mac's whole attack surface in one read-only pass — every 'open door' an intruder could use — and return them with a severity each, an overall exposure score (0-100, higher = safer), and, where Cyclone has a tool for it, which action closes it. Covers: File Sharing (SMB, incl. password-less guest shares), Remote Login (SSH), Screen Sharing, Remote Management, the Firewall (off / no stealth), FileVault, Gatekeeper, SIP, the Guest login account, and automatic login. Read-only; closing anything still needs the user's approval.

List the network connections this Mac currently has open (established) and how many — what the Mac is talking to right now.

Identify which local process owns a connection to a given remote IP (correlated from open connections — no network probing, no DNS).

Find which process is listening on a given TCP port.

Report the current Wi-Fi network name (SSID) and its encryption/security type (e.g. Wpa2/wpa3 vs open).

List this Mac's network interfaces (Wi-Fi, Ethernet, Thunderbolt, etc.) and their current IPv4 addresses, marking which are active.

Report rich details about the current Wi-Fi connection: SSID, phy mode (Wi-Fi 5/6/etc.), channel, signal strength, transmit rate, and security type.

List the Wi-Fi networks this Mac remembers (preferred networks it will auto-join).

List the VPN configurations on this Mac and whether any is currently connected.

Report the DNS resolvers this Mac is currently using.

Set the DNS servers on the active network connection, or reset them to automatic (DHCP). Use to undo a DNS hijack (point back to trusted resolvers) or to restore automatic DNS. Pass specific IPs like '1.1.1.1 1.0.0.1', or 'auto' to return to DHCP-provided DNS. Needs admin. Use after check_dns_integrity flags unexpected resolvers.

Report whether any network proxy (HTTP/HTTPS/SOCKS/auto-config pac) is active on this Mac. An unexpected proxy can intercept traffic.

Turn OFF all network proxies (HTTP, HTTPS, SOCKS, and auto-config/PAC) on the active network connection. An unexpected proxy can intercept and read traffic. Needs admin. Use after proxy_config shows an unexpected proxy the user didn't set.

Identify the network router/gateway: its IP, its hardware MAC/vendor, and whether it exposes a web admin page (port 80/443). Read-only.

Scan for nearby Wi-Fi networks and report each SSID, signal strength, whether it's open (no password), and whether an SSID is broadcast by MULTIPLE access points (a possible 'evil twin' rogue hotspot). Read-only. Recent macOS may require Location access to scan (the tool says so honestly if it can't).

Send a Wake-on-LAN 'magic packet' to power on a device on the local network by its MAC address (from scan_lan_devices). The device must support Wake-on-LAN and have it enabled; there's no delivery confirmation.

Measure internet speed (download, upload, and responsiveness/RPM) using macOS's built-in networkQuality tool. NOTE: this contacts Apple's servers over the internet, so it's skipped if Cyclone's connection is turned off.

Report the other macOS sharing services the attack-surface scan does not cover: Internet Sharing, AirPlay Receiver, Remote Apple Events, Content Caching, Media Sharing, and Printer Sharing — flagging which are on. Internet Sharing, AirPlay Receiver, and Remote Apple Events open real inbound network doors.

Make this Mac forget a remembered Wi-Fi network so it no longer auto-joins it — especially a remembered open network, which an evil-twin rogue hotspot can impersonate. Needs admin. Give the exact SSID from list_known_wifi_networks.

Connect one of this Mac's saved VPN configurations by name, so traffic routes through it. It may need credentials configured in System Settings. Cyclone re-checks and reports whether it actually connected.

Disconnect a currently-connected VPN configuration by name.