Network & Connections

List the readings Cyclone took during recent Emergency Lock Down countdowns — each captured what was happening on the Mac in the seconds before anything was cut off: how many machines were connected in, how many were unrecognised devices, which sharing doors were open. Addresses are withheld from the list.

Explain one Emergency Lock Down reading: who was connected and over which service, with devices on your own network named on-device from their hardware address plus Cyclone's built-in vendor database and the names you gave them. Summarised by default — raw addresses are only included when you ask for them.

Check the network this Mac is on right now — the same engine as the Network Shield panel, so the panel and this answer can never disagree. Reports the current Wi-Fi's encryption grade (WPA2/WPA3 good, open or WEP risky); where DNS lookups go and whether an encrypted-DNS configuration is active on the default path (recognised public resolvers are described by kind, not named — 1.1.1.1 is reported as a public resolver — while a resolver on the shared VPN/carrier range could be a VPN tunnel or a mobile carrier's own equipment, so from the address alone Cyclone says it cannot tell — though when the route to every resolver is a VPN tunnel interface it reports the lookups as travelling inside the VPN, hidden from the local network but still visible to the VPN provider's resolver); whether a proxy sits in the traffic path (an enabled HTTP/HTTPS/SOCKS proxy, a PAC auto-configuration URL, or automatic proxy discovery — a proxy can read and rewrite everything matching it, which is normal on a managed work Mac and suspicious when nobody set it up); whether the router serving this network is the same hardware seen on it before (hardware never seen here, or remembered but first seen within the last week — both are expected after a router swap or on a mesh, and both are also what an impersonated router looks like, so neither is reported as proof); and, when the network's name is readable, whether it reappeared without its usual security — the classic copycat-hotspot signal. It checks and reports: it does not encrypt traffic, hide the Mac, or block anything. Reading the network name needs the opt-in Location permission the panel offers, and without it the identity check reports that it could not run rather than an all-clear — any 'unknown' means the probe failed, never a pass. Asking does not change anything: it deliberately leaves the panel's remembered-networks list untouched.

Turn on encrypted DNS (DNS-over-HTTPS) for the whole Mac — the answer to the 'unencrypted DNS' finding, where every website name your Mac looks up travels in the clear for the network and your internet provider to read. macOS does not let any app switch a DNS configuration on, so Cyclone installs it and you select it in System Settings; the reply says plainly that the step is still outstanding. Encrypting lookups changes who can see them, not whether anyone can — the resolver answering them still sees every domain.

Remove the encrypted-DNS configuration Cyclone installed, so name lookups go back to whatever the network or your own settings provide. Use it when it interferes with a network that runs its own DNS — a workplace, a school, or a captive-portal Wi-Fi that will not let you online.

Scan this Mac's whole attack surface in one read-only pass — every 'open door' an intruder could use — and return them with a severity each, an overall exposure score (0-100, higher = safer), and, where Cyclone has a tool for it, which action closes it. Covers: File Sharing (SMB, incl. password-less guest shares), Remote Login (SSH), Screen Sharing, Remote Management, AirPlay Receiver, Remote Apple Events, Internet Sharing, the Firewall (off / no stealth), FileVault, Gatekeeper, SIP, the Guest login account, automatic login, unencrypted DNS (every domain visible to the network and the provider — resolvers on the shared VPN/carrier range are reported as could-not-tell, never as exposed and never as an all-clear, because that same range serves VPN tunnels and plaintext carrier equipment), and a configured traffic proxy (something reading and able to rewrite what passes through; normal on a managed work Mac — auto-discovery alone, with no proxy configured, is reported at lower severity because nothing is intercepting yet). Read-only; closing anything still needs the user's approval.

List the network connections this Mac currently has open (established) and how many — what the Mac is talking to right now.

Identify which local process owns a connection to a given remote IP (correlated from open connections — no network probing, no DNS).

Find which process is listening on a given TCP port.

Report the current Wi-Fi network name (SSID) and its encryption/security type (e.g. Wpa2/wpa3 vs open).

List this Mac's network interfaces (Wi-Fi, Ethernet, Thunderbolt, etc.) and their current IPv4 addresses, marking which are active.

Report rich details about the current Wi-Fi connection: SSID, phy mode (Wi-Fi 5/6/etc.), channel, signal strength, transmit rate, and security type.

Measure the internet speed this Mac actually gets — download, upload, latency and jitter — by transferring real data, then report where the bottleneck is: the local Wi-Fi/Ethernet hop, the internet service, other traffic that spoiled the run, or honestly undetermined. The Wi-Fi 'transmit rate' reported elsewhere is the negotiated link rate — a ceiling roughly double what a real Wi-Fi transfer achieves. Takes ~15 s and spends a few hundred MB of the user's own data (much less on a metered link). The panel itself is free and works even in Limited Mode.

List the Wi-Fi networks this Mac remembers (preferred networks it will auto-join).

List the VPN configurations on this Mac and whether any is currently connected.

Report the DNS resolvers this Mac is currently using.

Set the DNS servers on the active network connection, or reset them to automatic (DHCP). Use to undo a DNS hijack (point back to trusted resolvers) or to restore automatic DNS. Pass specific IPs like '1.1.1.1 1.0.0.1', or 'auto' to return to DHCP-provided DNS. Needs admin. Use after check_dns_integrity flags unexpected resolvers.

Report whether any network proxy (HTTP/HTTPS/SOCKS/auto-config pac) is active on this Mac. An unexpected proxy can intercept traffic.

Turn OFF all network proxies (HTTP, HTTPS, SOCKS, and auto-config/PAC) on the active network connection. An unexpected proxy can intercept and read traffic. Needs admin. Use after proxy_config shows an unexpected proxy the user didn't set.

Identify the network router/gateway: its IP, its hardware MAC/vendor, and whether it exposes a web admin page (port 80/443). Read-only.

Scan for nearby Wi-Fi networks and report each SSID, signal strength, whether it's open (no password), and whether an SSID is broadcast by MULTIPLE access points (a possible 'evil twin' rogue hotspot). Read-only. Recent macOS may require Location access to scan (the tool says so honestly if it can't).

Send a Wake-on-LAN 'magic packet' to power on a device on the local network by its MAC address (from scan_lan_devices). The device must support Wake-on-LAN and have it enabled; there's no delivery confirmation.

Measure internet speed (download, upload, and responsiveness/RPM) using macOS's built-in networkQuality tool. NOTE: this contacts Apple's servers over the internet, so it's skipped if Cyclone's connection is turned off.

Report the remaining macOS sharing services: Content Caching, Media Sharing and Printer Sharing — flagging which are on. Internet Sharing, Remote Apple Events and AirPlay Receiver are echoed here too, and are first-class doors in the attack-surface scan, where they are detected reliably.

Make this Mac forget a remembered Wi-Fi network so it no longer auto-joins it — especially a remembered open network, which an evil-twin rogue hotspot can impersonate. Needs admin. Give the exact SSID from list_known_wifi_networks.

Connect one of this Mac's saved VPN configurations by name, so traffic routes through it. It may need credentials configured in System Settings. Cyclone re-checks and reports whether it actually connected.

Disconnect a currently-connected VPN configuration by name.