# Kilobat: the full documentation

> Kilobat is a Mac menu-bar network app (macOS 14 or later) with a free, open-source CLI (`kilobat`, alias `kb`, GPL-3.0) and an MCP server (`kilobat mcp`). It shows which apps use the connection, blocks background apps on hotspots and capped plans, finds out why the internet is slow and keeps the Mac awake while agents work.

This file joins the docs, the setup page for each AI agent and every guide and recipe on https://kilobat.app. The build writes it from the same pages as the site, so the two match. A shorter overview is at https://kilobat.app/llms.txt. Every page also has a Markdown copy at its own address with `.md` in place of `.html`; the homepage's is https://kilobat.app/index.md.

## Install

- CLI: `brew install seifip/kilobat/kilobat` installs `kilobat` and its short alias `kb`. Source: https://github.com/seifip/kilobat-cli
- Mac app: https://kilobat.app/#pricing. The app also includes the CLI at `Kilobat.app/Contents/Helpers/kilobat`.
- Agent skills: `npx skills add seifip/kilobat-skills` (https://github.com/seifip/kilobat-skills).

## MCP setup

`kilobat mcp` is a local stdio server. It needs no API key and opens no network port.

- Claude Code: `claude mcp add --scope user kilobat -- kilobat mcp`
- Codex CLI: `codex mcp add kilobat -- kilobat mcp`
- Gemini CLI: `gemini mcp add -s user kilobat kilobat mcp`
- Clients with an `mcpServers` file (Cursor, Claude Desktop, Windsurf, Cline): `{ "mcpServers": { "kilobat": { "command": "kilobat", "args": ["mcp"] } } }`. An app opened from the Dock may not see Homebrew's PATH; then use the full path that `command -v kilobat` prints.
- Setup for each agent: https://kilobat.app/agents/index.html

Read-only tools run freely. Tools that change settings are annotated as destructive, and their descriptions tell the agent to ask the user first.

## Contents

- https://kilobat.app/docs.html
- https://kilobat.app/agents/index.html
- https://kilobat.app/agents/claude-code.html
- https://kilobat.app/agents/claude-desktop.html
- https://kilobat.app/agents/cline.html
- https://kilobat.app/agents/codex.html
- https://kilobat.app/agents/cursor.html
- https://kilobat.app/agents/gemini-cli.html
- https://kilobat.app/agents/mcp-client.html
- https://kilobat.app/agents/windsurf.html
- https://kilobat.app/agents/zed.html
- https://kilobat.app/guides/recipes/agent-lid-closed.html
- https://kilobat.app/guides/recipes/approve-new-apps.html
- https://kilobat.app/guides/recipes/block-app-on-metered.html
- https://kilobat.app/guides/recipes/check-network-before-download.html
- https://kilobat.app/guides/recipes/check-vpn-and-public-ip.html
- https://kilobat.app/guides/recipes/compare-carrier-usage.html
- https://kilobat.app/guides/recipes/compare-speed-tests.html
- https://kilobat.app/guides/recipes/connect-agent-hooks.html
- https://kilobat.app/guides/recipes/find-better-wifi-spot.html
- https://kilobat.app/guides/recipes/hotspot-data-by-app.html
- https://kilobat.app/guides/recipes/keep-mac-awake-download.html
- https://kilobat.app/guides/recipes/monthly-data-budget.html
- https://kilobat.app/guides/recipes/pick-faster-dns.html
- https://kilobat.app/guides/recipes/see-where-apps-connect.html
- https://kilobat.app/guides/recipes/share-wifi-qr-code.html
- https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html
- https://kilobat.app/guides/recipes/test-call-stutter.html
- https://kilobat.app/guides/recipes/why-cant-it-connect.html
- https://kilobat.app/guides/airplay-receiver-port-5000.html
- https://kilobat.app/guides/awdl-airdrop-latency-spikes.html
- https://kilobat.app/guides/bluetooth-wifi-interference.html
- https://kilobat.app/guides/bufferbloat-mac.html
- https://kilobat.app/guides/caffeinate-keep-mac-awake.html
- https://kilobat.app/guides/captive-portal-not-appearing.html
- https://kilobat.app/guides/clamshell-lid-closed-mac.html
- https://kilobat.app/guides/connection-not-private-mac.html
- https://kilobat.app/guides/content-filter-blocking.html
- https://kilobat.app/guides/corporate-proxy-certificates.html
- https://kilobat.app/guides/curl-could-not-resolve-host.html
- https://kilobat.app/guides/dns-probe-finished-nxdomain.html
- https://kilobat.app/guides/dns-server-not-found.html
- https://kilobat.app/guides/docker-container-from-mac.html
- https://kilobat.app/guides/encrypted-dns-mac.html
- https://kilobat.app/guides/err-cert-date-invalid.html
- https://kilobat.app/guides/err-connection-timed-out.html
- https://kilobat.app/guides/err-internet-disconnected.html
- https://kilobat.app/guides/err-name-not-resolved.html
- https://kilobat.app/guides/err-network-changed.html
- https://kilobat.app/guides/ethernet-adapter-not-detected.html
- https://kilobat.app/guides/ethernet-slow-link-speed.html
- https://kilobat.app/guides/find-devices-on-network.html
- https://kilobat.app/guides/find-saved-wifi-password.html
- https://kilobat.app/guides/flush-dns-cache-mac.html
- https://kilobat.app/guides/git-could-not-resolve-host-github.html
- https://kilobat.app/guides/homebrew-curl-28-timed-out.html
- https://kilobat.app/guides/homebrew-npm-download-fails.html
- https://kilobat.app/guides/hosts-file-not-working.html
- https://kilobat.app/guides/hotspot-background-data.html
- https://kilobat.app/guides/icloud-private-relay-sites.html
- https://kilobat.app/guides/instant-hotspot-not-showing.html
- https://kilobat.app/guides/internet-connection-appears-offline.html
- https://kilobat.app/guides/internet-sharing-mac.html
- https://kilobat.app/guides/ip-address-conflict-mac.html
- https://kilobat.app/guides/ipv6-problems-mac.html
- https://kilobat.app/guides/limit-ip-address-tracking.html
- https://kilobat.app/guides/local-network-permission.html
- https://kilobat.app/guides/localhost-from-container.html
- https://kilobat.app/guides/low-data-mode-mac.html
- https://kilobat.app/guides/mac-joins-wrong-wifi.html
- https://kilobat.app/guides/mac-sleep-stops-downloads.html
- https://kilobat.app/guides/macos-firewall-incoming.html
- https://kilobat.app/guides/metered-network-mac.html
- https://kilobat.app/guides/mtu-problems-mac.html
- https://kilobat.app/guides/network-connection-was-lost.html
- https://kilobat.app/guides/network-extension-conflicts.html
- https://kilobat.app/guides/network-service-order.html
- https://kilobat.app/guides/network-settings-terminal.html
- https://kilobat.app/guides/networkquality-speed-test.html
- https://kilobat.app/guides/npm-econnreset.html
- https://kilobat.app/guides/npm-etimedout.html
- https://kilobat.app/guides/packet-loss-mac.html
- https://kilobat.app/guides/port-already-in-use.html
- https://kilobat.app/guides/private-wifi-address.html
- https://kilobat.app/guides/proxy-settings-breaking-apps.html
- https://kilobat.app/guides/renew-dhcp-lease-mac.html
- https://kilobat.app/guides/request-timed-out.html
- https://kilobat.app/guides/safari-cant-connect-proxy-server.html
- https://kilobat.app/guides/safari-cant-connect-to-server.html
- https://kilobat.app/guides/safari-cant-establish-secure-connection.html
- https://kilobat.app/guides/safari-cant-find-server.html
- https://kilobat.app/guides/safari-not-connected-to-internet.html
- https://kilobat.app/guides/self-assigned-ip-address.html
- https://kilobat.app/guides/server-hostname-not-found.html
- https://kilobat.app/guides/site-works-on-phone-not-mac.html
- https://kilobat.app/guides/slow-dns-mac.html
- https://kilobat.app/guides/slow-internet-mac-cause.html
- https://kilobat.app/guides/slow-wifi-mac-fast-phone.html
- https://kilobat.app/guides/software-update-on-hotspot.html
- https://kilobat.app/guides/ssh-git-timeouts.html
- https://kilobat.app/guides/ssh-port-22-operation-timed-out.html
- https://kilobat.app/guides/tailscale-vpn-routing-conflicts.html
- https://kilobat.app/guides/traceroute-mac.html
- https://kilobat.app/guides/usb-tethering-iphone-mac.html
- https://kilobat.app/guides/video-call-stutter-mac.html
- https://kilobat.app/guides/vpn-connected-no-internet.html
- https://kilobat.app/guides/vpn-dns-leak-mac.html
- https://kilobat.app/guides/vpn-split-dns-internal-names.html
- https://kilobat.app/guides/wake-for-network-access.html
- https://kilobat.app/guides/weak-wifi-signal-mac.html
- https://kilobat.app/guides/what-is-appstoreagent.html
- https://kilobat.app/guides/what-is-apsd.html
- https://kilobat.app/guides/what-is-assetcache.html
- https://kilobat.app/guides/what-is-assistantd.html
- https://kilobat.app/guides/what-is-bird.html
- https://kilobat.app/guides/what-is-cloudd.html
- https://kilobat.app/guides/what-is-cloudphotod.html
- https://kilobat.app/guides/what-is-configd.html
- https://kilobat.app/guides/what-is-fileproviderd.html
- https://kilobat.app/guides/what-is-findmydeviced.html
- https://kilobat.app/guides/what-is-googleupdater.html
- https://kilobat.app/guides/what-is-identityservicesd.html
- https://kilobat.app/guides/what-is-locationd.html
- https://kilobat.app/guides/what-is-mdnsresponder.html
- https://kilobat.app/guides/what-is-microsoft-autoupdate.html
- https://kilobat.app/guides/what-is-mobileassetd.html
- https://kilobat.app/guides/what-is-netbiosd.html
- https://kilobat.app/guides/what-is-nsurlsessiond.html
- https://kilobat.app/guides/what-is-parsecd.html
- https://kilobat.app/guides/what-is-privatecloudcomputed.html
- https://kilobat.app/guides/what-is-rapportd.html
- https://kilobat.app/guides/what-is-remotepairingd.html
- https://kilobat.app/guides/what-is-reportcrash.html
- https://kilobat.app/guides/what-is-sharingd.html
- https://kilobat.app/guides/what-is-shipit.html
- https://kilobat.app/guides/what-is-softwareupdated.html
- https://kilobat.app/guides/what-is-sparkle-autoupdate.html
- https://kilobat.app/guides/what-is-symptomsd.html
- https://kilobat.app/guides/what-is-syspolicyd.html
- https://kilobat.app/guides/what-is-timed.html
- https://kilobat.app/guides/what-is-trustd.html
- https://kilobat.app/guides/which-app-uses-bandwidth.html
- https://kilobat.app/guides/wifi-bands-2-4-5-6-ghz.html
- https://kilobat.app/guides/wifi-channel-congestion.html
- https://kilobat.app/guides/wifi-connected-no-internet.html
- https://kilobat.app/guides/wifi-disconnects-after-sleep.html
- https://kilobat.app/guides/wifi-no-hardware-installed.html
- https://kilobat.app/guides/wifi-no-internet-connection.html
- https://kilobat.app/guides/wifi-weak-security-warning.html
- https://kilobat.app/guides/wireless-diagnostics-mac.html


---

Source: https://kilobat.app/docs.html

## Kilobat docs

Everything you need to run Kilobat from the menu bar, the terminal, or an AI agent.

### Install

The CLI is free and open source. Install it with Homebrew:

```
brew install seifip/kilobat/kilobat
```

This installs `kilobat` and `kb`, a short alias. Every example below works with either.

Or download the Mac app, which also includes the CLI at `Kilobat.app/Contents/Helpers/kilobat`.

[Download for Mac ↓](https://kilobat.app/downloads/Kilobat-1.3.4.dmg) [Download the free CLI ↓](https://kilobat.app/downloads/kilobat-cli-1.3.4-universal.tar.gz)

Turn on tab completion for your shell:

```
# zsh
echo 'source <(kilobat completion zsh)' >> ~/.zshrc
# fish
kilobat completion fish > ~/.config/fish/completions/kilobat.fish
```

### Quick start

Run `kilobat` on its own for an interactive menu: arrow keys or j/k to move, Enter to open, a number to jump, q to quit.

```
kilobat status --watch     # live traffic by app; q quit, s sort, f filter, / search
kilobat diagnose           # what is slowing your connection
kilobat speedtest          # speed and latency under load
kilobat profile travel     # switch to the Travel profile
kilobat block com.example.App
```

Run `kilobat <command> --help` for help with any command.

### Commands

#### Monitor

|  |  |
|---|---|
| `kilobat status [--watch] [--json]` | Live per-app traffic and session budget; a JSON snapshot, or a JSON-lines stream with --watch |
| `kilobat report [--csv\|--json] [--summary] [--days 1…365]` | Locally recorded usage history, or daily totals and top apps; CSV has one row per app |
| `kilobat report compare --total 40GB [--unit GB\|GiB] [--direction both\|download\|upload] (--from DATE --to DATE \| --period last-month) [--network NAME] [--json\|--csv]` | A router's or provider's figure beside what Kilobat recorded on this Mac for the same period, in the same unit, with the hours recorded, every gap and likely reasons for a difference |
| `kilobat health-history [--hours 1…720] [--json]` | Router, internet, jitter and DNS checks the app recorded over time |
| `kilobat networks [forget <name>]` | Networks seen, with the profile, budget and data cost remembered for each |
| `kilobat networks cost <metered\|unmetered\|automatic> [name]` | Treat this network, or a named one, as metered or unmetered, or follow macOS again |
| `kilobat bandwidth [app] [hour\|day\|week\|month] [--back N] [--json]` | One app's sent and received bytes over an hour, day, week or month, with the peak; --back steps to earlier periods |
| `kilobat access-policy <bundle-id> [--json]` | The connections an app's developer declares in its Internet Access Policy, and why |

#### Diagnose

|  |  |
|---|---|
| `kilobat diagnose [--json]` | Wi-Fi, router, internet, DNS and captive-portal checks with advice |
| `kilobat radar [--watch] [--json]` | Signal score and best-spot finder |
| `kilobat scan [--json]` | Nearby networks, channels and widths |
| `kilobat channels [--json]` | Congestion per channel and the least crowded one |
| `kilobat speedtest [--json] [--budget-mb 1…80] [--parallel]` | Cloudflare speed, loaded latency and call and streaming verdicts, 80 MB at most. One connection by default; --parallel opens four, as most speed-test sites do |
| `kilobat speed-compare [<test> <test>] [--json]` | What differed between two saved speed tests: network, time, server, connections, Wi-Fi band and signal, VPN, other traffic |
| `kilobat ip [--public] [--json]` | Where traffic leaves: the interface and any VPN, read on this Mac; --public also asks Cloudflare for your public IP and its registry country |
| `kilobat stutter [--seconds 10…60] [--target router\|internet\|<host>] [--json]` | Ping every 50 ms to find the short latency spikes speed tests miss, when they happen and whether they repeat |
| `kilobat airdrop [status\|everyone\|contacts\|off] [--json]` | AirDrop visibility, the AirDrop link (AWDL) and what uses it; changing visibility opens System Settings |
| `kilobat bluetooth [--json]` | Bluetooth devices and whether they share 2.4 GHz with your Wi-Fi |
| `kilobat dns [automatic\|cloudflare\|google\|quad9\|flush]` | Read or set DNS, or flush the cache |

#### Wi-Fi

|  |  |
|---|---|
| `kilobat wifi [status]` | Current network, signal, channel and link rate |
| `kilobat wifi on\|off\|restart\|disconnect` | Control Wi-Fi power and the connection |
| `kilobat wifi join <name> [--password-stdin]` | Join a saved network, or a new one |
| `kilobat wifi known` | Saved networks in order of preference |
| `kilobat wifi password\|share <name>` | Show a saved password, or a QR code to scan with a phone |
| `kilobat low-latency on [--for 15m\|1h\|2h] [--until-quit <app>]` | Pause AirDrop and AWDL during calls and games: 15 minutes by default, up to 4 hours, or until an app quits |
| `kilobat low-latency off` | Restore AirDrop and AWDL, also for a pause started in the app |

#### Awake & agents

|  |  |
|---|---|
| `kilobat awake [--display]` | Keep the Mac awake until Ctrl-C; closing the lid still sleeps it unless you add --lid-closed |
| `kilobat awake --lid-closed [--for 2h\|--until-quiet\|-- <command>]` | Keep running with the lid closed too, 8 hours at most, through the app’s power helper; needs Allow running with the lid closed in Settings |
| `kilobat awake --for 90m\|2h\|45s` | Stay awake for a while |
| `kilobat awake --until-quiet [--app <id>] [--quiet 1…60]` | Stay awake until downloads or one app go quiet, below 16 KB/s for 3 minutes by default |
| `kilobat awake -- <command> [args]` | Stay awake while a command runs, then report the data its processes moved and exit with its status |
| `kilobat awake --while-frontmost <app> [--display] [--for 2h]` | Stay awake only while that app is in front, for reading or presenting. Switching away lets the Mac sleep; it ends when the app quits, at 20% battery or after --for. --display keeps the screen on too |
| `kilobat settings awake-on-power on\|off` | The app stays awake whenever the power adapter is in and lets the Mac sleep again when it comes out |
| `kilobat settings keep-screen-on on\|off` | Keep the screen on too for everything the app keeps awake: timers, downloads, agents, the app in front and plugged in |
| `kilobat sessions [--days N] [--json]` | Awake sessions and AI agent runs the app recorded, with data used and network changes |
| `kilobat agent-event <start\|working\|waiting\|done\|failed> [--agent name] [--stdin-json\|--json-arg]` | For an agent's hooks: tells the app a run started, waits for you or is done. Silent, always exits 0 |
| `kilobat why <url\|host> [--app <id>] [--proxy <url>] [--context container\|vm\|remote\|provider] [--failed-at <time>] [--json]` | Find the layer that stops a connection: network and interface, proxy and the app's own proxy, DNS, Kilobat rules, IPv4 and IPv6, TLS, the server and each redirect. Requests the exact URL; output hides query values |
| `kilobat conditions [--json]` | Metered, Low Data Mode, VPN, latency, battery and heat, whether the lid may close, with advice for long runs |

#### Control

|  |  |
|---|---|
| `kilobat profile [travel\|work\|unrestricted]` | List or select a profile |
| `kilobat allow\|block <bundle-id> [--minutes 1…1440] [--profile name]` | Save an app rule, optionally temporary or for another profile |
| `kilobat reset <bundle-id> [--profile name]` | Remove an app's rule so it follows the default |
| `kilobat rules [--profile name] [--json]` | A profile’s rules |
| `kilobat limit [GB] [--cycle session\|daily\|weekly\|monthly] [--reset-day N] [--alert 50,80,100]` | Read or set this network’s data budget, when it starts over and when it notifies |
| `kilobat quota <bundle-id> <GB> [--upload] [--all-networks]` | Limit one app’s data per budget cycle; quota <bundle-id> --remove takes it off |
| `kilobat quota --list [--json]` | App quotas with what each used this cycle |
| `kilobat updaters [--json]` | Updaters paused on metered networks, the update bytes that still got through on this network, and the apps that update from inside themselves |
| `kilobat updaters on\|off` | Pause updater helpers such as Google Updater and macOS Software Update while the network is metered (on by default); the apps keep working |
| `kilobat settings [name [value] ]` | Read or change settings such as new-apps (allow, ask or block), apple-software, auto-travel, pause-updaters, awake-on-power, public-ip (off by default), speed-streams, alerts and menu-bar |
| `kilobat approvals [--json]` | Apps waiting for approval while new apps are asked about, with signer and destinations |
| `kilobat approve\|deny <app-id> [--minutes 1…1440]` | Block a waiting app at once, or ask the person to confirm allowing it in Kilobat |
| `kilobat block-host\|unblock-host <domain\|IP\|CIDR> [--app <id>]` | Block a domain (subdomains included, *.example.com accepted), an IP or a range for every app, or for one app |
| `kilobat quit <PID> [--force]` | Quit a process |

#### Setup

|  |  |
|---|---|
| `kilobat open` | Open the Mac app |
| `kilobat doctor` | Check the app, network filter and monitoring |
| `kilobat completion [zsh\|bash\|fish]` | Print a shell completion script |
| `kilobat mcp` | Run the MCP server for AI agents over stdio |
| `kilobat update` | Update a Homebrew install |

#### Expert

|  |  |
|---|---|
| `kilobat destinations [--pid PID] [--json]` | Observed process sockets |
| `kilobat devices [--bonjour] [--json]` | Devices on your network and Bonjour services |
| `kilobat devices name <MAC> <name>` | Name a device |
| `kilobat trace <host> [--rounds 2…10] [--json]` | Bounded 12-hop route probe; --rounds traces several times and shows each hop’s loss and delay |
| `kilobat route-history --host <host> [--json]` | Every saved trace to a host, hop by hop like mtr: loss, best, average, worst, route changes and where delay starts |
| `kilobat http-check <URL> [--json]` | DNS, connect, TLS and first-byte timing |
| `kilobat dns-benchmark` | Resolver timings |
| `kilobat lan-test <server> [--reverse] [--json]` | Five-second iperf3 test to a device running iperf3 -s; needs iperf3, which Kilobat never installs |
| `kilobat interfaces [--json]` | Physical and VPN counters, separately |
| `kilobat capture <interface> <file.pcap>` | Bounded packet capture |
| `kilobat connection-rule allow\|block <app> <host> [port]` | Save a destination rule |
| `kilobat blocklist status\|import <path>\|clear` | Manage a domain blocklist |
| `kilobat wake <MAC-address>` | Send a Wake-on-LAN packet |
| `kilobat spots [save <name>\|remove <id>]` | Saved Wi-Fi spots |
| `kilobat outages / speed-history [--days N]` | Recorded outages and speed tests as JSON |

### Scripting and JSON

Output switches to JSON automatically when piped, so scripts never parse the human layout. Pass `--json` to be explicit.

```
kilobat diagnose | jq .health            # "good", "degraded", "poor" or "unknown"
kilobat status --watch --json             # one JSON object per line, every second
kilobat report --summary --days 7 --json  # daily totals and top apps
kilobat report compare --total 40GB --period last-month --csv  # beside your provider's figure
```

Set `NO_COLOR` to turn off colors. Changes to DNS require administrator approval.

### AI agents and MCP

Step-by-step setup for [Claude Code](https://kilobat.app/agents/claude-code.html), [Codex](https://kilobat.app/agents/codex.html), [Cursor](https://kilobat.app/agents/cursor.html), [Gemini CLI](https://kilobat.app/agents/gemini-cli.html), [Claude Desktop](https://kilobat.app/agents/claude-desktop.html), [Windsurf](https://kilobat.app/agents/windsurf.html), [Cline](https://kilobat.app/agents/cline.html), [Zed](https://kilobat.app/agents/zed.html) and [any MCP client](https://kilobat.app/agents/mcp-client.html) is in [Set up Kilobat in your AI agent](https://kilobat.app/agents/index.html).

Give an agent like Claude Code, Codex or Cursor this prompt:

```
Install the Kilobat CLI with `brew install seifip/kilobat/kilobat`. Run `kilobat diagnose --json`, `kilobat status --json` and `kilobat scan --json`, then tell me what is slowing my connection and how to fix it. Ask me before changing DNS, profiles or rules.
```

#### MCP server

`kilobat mcp` speaks the Model Context Protocol over stdio. Add it to Claude Code:

```
claude mcp add kilobat -- kilobat mcp
```

Or add it to any client that reads an `mcpServers` config:

```
{ "mcpServers": { "kilobat": { "command": "kilobat", "args": ["mcp"] } } }
```

Read-only tools: `get_status`, `diagnose_network`, `diagnose_connection`, `get_conditions`, `get_updaters`, `get_wifi`, `scan_wifi`, `suggest_wifi_channel`, `get_usage_report`, `compare_usage`, `get_app_bandwidth`, `get_access_policy`, `get_network_history`, `list_sessions`, `benchmark_dns`, `check_url`, `list_connections`, `list_devices`, `trace_route`, `get_route_history`, `compare_speed_tests`, `get_exit_path` (it asks Cloudflare for your public IP only when the agent passes `public_ip`), `list_networks`, `list_rules`, `list_approvals`, `list_blocked_connections`, `run_stutter_test` (it only sends pings) and `get_nearby_radios`. They return the same JSON as the CLI. `run_speedtest` uses data, `run_lan_test` moves data on your own network for five seconds and asks first, and `keep_awake` and `release_awake` hold off idle sleep for a set time without changing settings; `keep_awake` with `lid_closed` keeps the Mac running with the lid shut too, once you allowed it, and asks you first. Change tools (`set_profile`, `set_app_rule`, `set_new_app_mode`, `decide_approval`, `block_destination`, `set_budget`, `set_app_quota`, `set_network_cost`, `set_updater_pause`, `set_dns`, which also flushes the cache, and `set_airdrop_visibility`, which opens AirDrop settings) are marked as changes, and their descriptions tell the agent to ask you first.

#### When something can't connect

`kilobat why <host>` (MCP: `diagnose_connection`) checks one host layer by layer from this Mac, without running `curl` or `nc`, so a strict profile can't block the check itself. It tries IPv4 and IPv6 separately, so a network whose IPv6 is broken, a common cause of agents that hang or keep reconnecting, gets a plain answer. It names the interface used, such as Wi-Fi, a phone hotspot or a VPN, and tries each one when there are several. It reports the proxy the system or its PAC file picks, and with `--app`, the `HTTPS_PROXY` in that app's environment, without passwords. With a VPN or proxy on, it compares the direct path with the tunnel. A private name sent to a VPN's own resolver says which one, and whether it answers. Code in a container, VM or remote machine has its own network: pass `--context` and the report ends with a command to run there. When a hosted service makes the request from its own servers, as Warp does for a custom inference endpoint, `--context provider` says when the target is private (`localhost`, a LAN or Tailscale address) and so out of their reach, even though it works from the Mac.

Give it the exact URL that fails, query included: it requests that URL, but every output shows query values as `[redacted]`, so a signed download link stays private. It sends the request the way the app would: through the app's `HTTPS_PROXY`, the system proxy, or with `--proxy <url>`, a proxy address the app sets in its own settings. When that proxy works and direct connections don't, as on many company networks, it says so instead of failing; when direct connections work and the request through the app's proxy fails, it says the network is fine and the app's path isn't. A setting it can't read or go through, such as LM Studio's Hugging Face proxy switch for huggingface.co downloads, gets its own note citing what users reported, and the verdict then says the network reaches the host, not that the app's request works. Kilobat never changes another app's settings. A server that refuses HEAD gets one GET for a single byte, never a download. It follows up to five redirects, names the hop that fails and checks IPv4 and IPv6 for the host the redirects end at. With `--app`, it lists the app's open connections to that host or its proxy, says when they use another IP version or server than the fresh check, and looks again a few seconds later: a transfer that went quiet is reported as quiet, never as finished. The report records the app's name and version, the method it sent, the path it took and, with `--failed-at`, when the app failed beside when the check ran. A passing check means this request works from this Mac over that path now; it can't see how a transfer already under way is doing, so watch that with `kilobat bandwidth <app>`.

#### Connect agents

Without help, Kilobat goes by an agent's traffic and CPU, so a quiet agent may be done or waiting for you. Its hooks tell Kilobat which project a run belongs to, when it waits for you and when it is done. Each hook runs `kilobat agent-event`, which prints nothing, returns at once and always exits 0, so it can't break the agent. If the app isn't running, events wait in a small file it reads when it opens. Kilobat reads session ids, folders and short status text, never prompts or replies. Merge these with any hooks you already have.

**Claude Code**, in `~/.claude/settings.json`. Each hook gets JSON on stdin with the session id and folder, which `--stdin-json` reads. A permission or input prompt means waiting; Stop means done once background tasks finish; a rate limit means waiting until it resets.

```
{
  "hooks": {
    "SessionStart": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent claude --stdin-json" }] }],
    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent claude --stdin-json" }] }],
    "Notification": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent claude --stdin-json" }] }],
    "Stop": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent claude --stdin-json" }] }],
    "StopFailure": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent claude --stdin-json" }] }],
    "SessionEnd": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent claude --stdin-json" }] }]
  }
}
```

**Codex**, simplest: `notify` in `~/.codex/config.toml`. Codex passes a JSON argument after each turn, which `--json-arg` reads. It only says done, and Codex runs one `notify` program.

```
notify = ["kilobat", "agent-event", "done", "--agent", "codex", "--json-arg"]
```

For waiting too, use Codex hooks in `~/.codex/hooks.json` instead, and trust them with `/hooks`:

```
{
  "hooks": {
    "SessionStart": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent codex --stdin-json" }] }],
    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent codex --stdin-json" }] }],
    "PermissionRequest": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent codex --stdin-json" }] }],
    "Stop": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent codex --stdin-json" }] }]
  }
}
```

**Gemini CLI**, in `~/.gemini/settings.json`. Gemini CLI runs as `node`, so Kilobat can't tie its traffic to the run, but the state comes through.

```
{
  "hooks": {
    "SessionStart": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent gemini --stdin-json" }] }],
    "BeforeAgent": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent gemini --stdin-json" }] }],
    "Notification": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent gemini --stdin-json" }] }],
    "AfterAgent": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent gemini --stdin-json" }] }]
  }
}
```

**Cline** (CLI, SDK and Kanban): install Kilobat's plugin, which adds one file to Cline's plugin store and changes no other settings. `cline plugin uninstall kilobat` removes it.

```
cline plugin install https://kilobat.app/agents/cline/kilobat.ts
```

It reports a run working, done, failed while Cline stays open, cancelled, rate-limited once Cline's own retries run out, and waiting while Cline asks you a question. It waits for subagents and teammates before calling a run done. Cline's approval prompts aren't visible to plugins, so traffic and CPU detection covers those.

Any other agent can call `kilobat agent-event start|working|waiting|done|failed --agent <name> --session <id> --cwd <folder>` from its own hooks. Add `--verbose` to see what happened when you try it by hand.

#### Why speed tests disagree

Kilobat's speed test sends one HTTPS connection at a time to Cloudflare's nearest data center, 8 seconds each way and 80 MB at most, and pings 1.1.1.1 before and during the transfers. Speedtest by Ookla, fast.com and macOS's `networkQuality` open several connections at once and pick their own servers, so on fast or distant links they usually show more. Choose *4 connections* beside the test button in the Speed tab, or run `kilobat speedtest --parallel`, to see how much that matters on your connection. Each saved test keeps the Cloudflare data center, the number of connections, the link (Wi-Fi band, channel, signal and link rate, or Ethernet), the VPN it went through and how much other traffic this Mac moved meanwhile. History › Speed-test comparison, `kilobat speed-compare` and MCP `compare_speed_tests` set two tests side by side and list what differed, each with a note on how it changes a result. They list differences, not causes: other devices on your network compete too, and Kilobat can't see them.

#### VPN and public IP

Health › Where traffic leaves, the Wi-Fi menu and `kilobat ip` show the interface the default route uses and whether that's a VPN, read from this Mac's routes and the VPNs macOS lists as connected. A VPN that's connected while the default route stays on Wi-Fi, such as Tailscale without an exit node, shows as Split: only some destinations go through it. Turn on Settings › Network › Look up public IP to also see the address websites see, asked from Cloudflare on network changes and every 30 minutes, with the country it is registered to from the DB-IP data bundled with Kilobat. It is off by default, since Cloudflare sees that request; `kilobat ip --public` asks once. The registry country isn't where you or a server are, and neither it nor a VPN shows that a connection is private or anonymous. Settings › Menu bar › VPN adds On, Split or Off (with the country code when the lookup is on) next to the bat, and History lists when a VPN went on or off and when the public IP changed.

#### Route history

Tools › DNS & LAN › Trace 3 times, or `kilobat trace <host> --rounds 3`, traces a route three times with three probes a hop and saves each trace. History › Saved routes combines every saved trace to a host hop by hop, like mtr: loss, best, average, worst and last delay, which hops changed routers and where lasting delay starts. A hop that skips replies while later hops answer is a router rate-limiting probes, not loss. For the local network alone, `kilobat lan-test <device>` runs five seconds of iperf3 against a device running `iperf3 -s`; install iperf3 yourself, Kilobat never installs anything.

#### While an app is in front

For reading or presenting, the teacup’s While an App Is in Front keeps the Mac awake only while the app you pick is the one in front, and lets it sleep again as soon as you switch away. Keep the screen on in the teacup decides whether the screen stays on too, as it does for everything Kilobat keeps awake. Kilobat follows macOS’s own app-switch events: it doesn’t poll, move the mouse or fake activity, so it can’t make you look present to monitoring software. It ends when the app quits, when you turn it off, or on battery at 20% (or the floor you set for lid-closed runs), and it never holds the lid. It has its own hold, so switching apps or quitting the app never ends an awake session or an agent run. From the terminal: `kilobat awake --while-frontmost Keynote --display`.

#### While plugged in

Turn on Stay awake while plugged in (Settings › Awake & agents), or While Plugged In in the teacup, and plugging in the power adapter keeps the Mac awake until you unplug it, as the strip’s “Awake while plugged in” says. Keep the screen on decides whether the screen stays on too. Turn it off and it stays off until you next plug in, even if Kilobat restarts. Kilobat hears the switch from macOS’s own power-source notification, without polling. Unplugging ends only the session plugging in started: one you started yourself, a download you’re waiting on, an app in front, an agent run or a hold from the terminal carries on. It never keeps the Mac running with the lid closed. From the terminal: `kilobat settings awake-on-power on`, and `kilobat settings keep-screen-on on` for the screen; `kilobat conditions --json` reports it as `awakeOnPower`.

#### Running with the lid closed

Closing the lid sleeps the Mac, even while Kilobat keeps it awake, unless you allow running with the lid closed in Settings › Awake & agents. That installs a small helper that runs as root; macOS asks you to allow it in System Settings › General › Login Items. With it on, a working agent run keeps the Mac going with the lid shut, and so does an awake session when you tick With the Lid Closed Too in the teacup menu. An agent waiting for you holds it only with Keep awake while an agent waits on, and for 30 minutes at most.

A closed Mac in a bag can overheat and run its battery flat, so the helper itself lets the Mac sleep at your battery floor (20% by default), when the Mac runs hot, as soon as it’s unplugged if you choose power only, after the longest stretch you set (8 hours at most), and a minute after Kilobat quits. If the helper or the Mac restarts while holding, it puts the setting back first. Kilobat shows how each hold ended, for example “Let the Mac sleep: battery at 20%”.

From the terminal, `kilobat awake --lid-closed` asks the app for the same hold and says why when it can’t; the hold ends with the command. Agents use `keep_awake` with `lid_closed`, which its description tells them to confirm with you first. `kilobat conditions --json` reports `lidClosedAllowed` and the current `lidHold`.

#### Agent skills

Nine Agent Skills teach coding agents to troubleshoot a Mac's network and keep long runs going with Kilobat. They interpret its measurements, explain what is uncertain and ask before changing settings. Install them together; the `kilobat` skill sends the agent to the one that fits.

```
npx skills add seifip/kilobat-skills
```

|  |  |
|---|---|
| [kilobat](https://github.com/seifip/kilobat-skills/tree/main/skills/kilobat) | Start here. Setup, safety rules and which skill fits the question. |
| [mac-network-troubleshooting](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-network-troubleshooting) | Slow or unreliable internet with an unclear cause: finds the failing layer. |
| [mac-wifi-troubleshooting](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-wifi-troubleshooting) | Weak or dropping Wi-Fi, crowded channels, the best spot for the Mac or router. |
| [mac-hotspot-data-saver](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-hotspot-data-saver) | Phone hotspots and data caps: what uses data, Travel profile, budgets. |
| [mac-dns-troubleshooting](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-dns-troubleshooting) | Slow lookups, resolver benchmarks, switching DNS, captive portals. |
| [video-call-network-check](https://github.com/seifip/kilobat-skills/tree/main/skills/video-call-network-check) | Stuttering calls and game streams: latency spikes, jitter, loss, bufferbloat and background uploads. |
| [mac-bandwidth-monitor](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-bandwidth-monitor) | Which apps use the connection, usage history and where they connect. |
| [mac-app-firewall](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-app-firewall) | Block or allow apps, domains and IPs; ask about new apps and answer them. |
| [mac-agent-runs](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-agent-runs) | Long agent runs: keep the Mac awake, check conditions, connect agent hooks, see when a run finished, waits for you or stalled. |

Install the Kilobat CLI separately with the Homebrew command above, or connect its MCP server. The CLI requires macOS 14 or later; the Homebrew source build requires Xcode 16 or later. See the [skills on skills.sh](https://skills.sh/seifip/kilobat-skills) or [read their source and references](https://github.com/seifip/kilobat-skills).

### The Mac app

1. Download the disk image, drag Kilobat into Applications and open it from there.
2. Live traffic, the Wi-Fi picker, speed tests, keep awake and Why can’t it connect? are free, and so is the whole CLI. Pro adds rules and Ask, budgets, Wi-Fi health, the connection map, radar and history in the app. To unlock Pro, start the 7-day trial or paste your license into Settings.
3. Choose your menu-bar items in Settings. Hold Command while dragging a menu-bar item to move it.

Allow Location access when asked so Kilobat can show Wi-Fi names and scan nearby networks. Your location is not sent anywhere.

#### Bandwidth per app

Each app's row shows its last minute of traffic, upload above the line and download below. Click it for the app's echo: a sentence on what it moved, then a waveform of the last five minutes live, and with Pro its history by hour, day, week or month. Markers show when the Mac joined another network or an agent run used the app, and tiles show which networks carried the traffic, how it compares with the app's last four periods and its share of all traffic. Below the chart are the app's open connections with the data each has moved and its country, and the connections the app's developer declares in an Internet Access Policy, if it ships one.

#### Comparing with your router or provider

When your router, ISP or carrier shows a different total from Kilobat, open History › Compare with your router or provider, or run `kilobat report compare`. Enter the figure as they show it, its unit and whether it counts download, upload or both, then the same period and the network it covers. Kilobat shows its own total in the same unit and the difference, and reads the figure in the other unit system too, since many providers write GB for 1,073,741,824 bytes (GiB) rather than 1,000,000,000.

A strip shows the hours Kilobat actually recorded and its gaps: time the Mac was asleep (recorded from Kilobat 1.3 on), time it was off or offline or Kilobat wasn’t running, time on other networks, and time before its history starts. Below it are the likely reasons for the difference, most likely first. Kilobat sees only this Mac, not the phones, TVs and other computers a router or provider counts. It leaves out local network and AirDrop traffic, which never reaches the Internet, and it counts packet headers no app accounts for as unattributed. Providers may count days in another time zone or post usage late. Kilobat doesn’t say which figure is right. Export the comparison as CSV or JSON, with the period, networks, recorded hours and every gap, to share with your provider.

#### Stutter test

Calls, game streaming and remote desktops can stutter while speed and loss look fine, because a ping spike of a few hundred milliseconds disappears in an average. The stutter test in Health pings your router (or the internet) every 50 ms for 20 seconds and draws every reply, spikes in rose, with the median, p95, p99 and worst ping. It tells you whether the spikes repeat at a regular interval, which often points to AirDrop/AWDL scanning, or come at random, which points to a busy network, interference or a weak signal. Many routers answer only about ten pings a second; Kilobat recognizes that pattern and doesn't count it as loss. With Pro, *Compare with low-latency on* runs the test again with AirDrop/AWDL paused and says whether it helped.

The low-latency pause turns off AirDrop, Sidecar and Universal Control for 15 minutes, 1 or 2 hours, or until an app such as your game or call quits, 4 hours at most. It always restores when the time is up, the app quits, Kilobat quits or the network changes, and on the next launch if the Mac crashed. macOS asks for administrator approval. Health’s Nearby panel also shows whether AirDrop’s radio is active and what uses it, your AirDrop visibility, and, when you ask, the Bluetooth devices that share the 2.4 GHz band with Wi-Fi.

The Wi-Fi menu lists your Bluetooth devices under the networks: click one to connect or disconnect it. A 2.4 GHz tag marks connected headphones, keyboards and mice that share the band with your Wi-Fi, with a shortcut to a known 5 GHz network. Below them is AirDrop, with its visibility, what is using the link and the low-latency pause. Bluetooth appears only after you choose Show Bluetooth devices, so macOS asks for access only then.

#### Links and launchers

Other apps can open Kilobat at the right place with a `kilobat://` link (from 1.3.4): `kilobat://open/speed` opens a tab (overview, connections, health, radar, speed, history, tools or settings), and `kilobat://share/speed` or `kilobat://share/week` opens a share card. Run one from Terminal with `open kilobat://open/history`, or bind it to a key in a launcher. The Raycast extension uses these links for its Open in Kilobat actions.

#### Where it connects

Connections shows every open connection on a globe, routed to the country its address is registered in, with the busiest countries in a list and the sockets underneath. Click a country to filter. The country comes from DB-IP's free database bundled with the app, so no address leaves your Mac. It is the registration country: a CDN or VPN address shows its owner's country, not where the server is.

### Blocking and filtering

Monitoring works without filtering. To enforce rules, open filtering setup in Kilobat and approve the extension and content filter when macOS asks. On current macOS, extensions are under System Settings → General → Login Items & Extensions → Network Extensions.

Filtering affects new connections; an existing connection may continue until it reconnects. If a rule interrupts something important, switch to Unrestricted or turn filtering off in Settings.

#### New apps: allow, ask or block

The pill above the app list sets what Travel and Work do with apps that have no rule. **Allow** lets them connect. **Ask** holds an app's first connections and opens a window with who signed it, its path and where it wants to go; allow or block it once and Kilobat saves the rule. Unanswered connections give up after a minute and the app asks again. **Block** only lets apps you allowed connect. Turn on *Allow Apple software* to let macOS services and Apple's apps through without asking. Your blocklist and connection rules apply in every mode, and if Kilobat isn't running, new apps are allowed rather than held.

#### Hotspots and data cost

macOS flags some connections as metered, such as an iPhone hotspot, but not every Android hotspot and not a phone tethered over USB or Ethernet. Each network has a data cost: *Automatic* follows macOS, and *Metered* or *Unmetered* is your call. Set it in the Wi-Fi menu, the budget menu, the Health tab or Settings, or with `kilobat networks cost metered`. On a metered network Kilobat switches to Travel, unless you chose a profile for that network, brings your previous profile back when you leave, and skips scheduled speed tests. `kilobat conditions --json` and the MCP server report both `metered` and what macOS says (`osMetered`). Kilobat needs to tell a network apart before you can set its cost, so for Wi-Fi it needs Location access to see the network’s name.

#### Pausing updaters on metered networks

On a metered network, the network filter also pauses the helpers that download updates on their own: Google Updater (and the older Keystone agent), Microsoft AutoUpdate, macOS Software Update (`softwareupdated`), App Store downloads (`appstored`, `appstoreagent`, `storedownloadd`), Sparkle’s download service, and Sparkle’s and Squirrel’s installers (`Autoupdate`, `Updater.app`, `ShipIt`). They are blocked with an ordinary filter rule, the blocked-connection journal says “Updater paused on a metered network”, and the apps themselves keep working. Once the network isn’t metered, updates carry on. Nothing in other apps, their staging folders or System Settings is changed, so there is nothing to restore. It is on by default; turn it off in Settings or with `kilobat updaters off`. Rules that already apply to a connection, such as a destination rule or a temporary allow, come first, so “allow for 30 minutes” lets one update through. Unrestricted pauses nothing.

The Health tab, `kilobat updaters` and the MCP tool `get_updaters` show which updaters are covered, which update bytes still got through on this network (an updater’s own bytes, and System downloads such as `nsurlsessiond` that connected for one, whose bytes include other downloads), and which installed apps update from inside their own process. Most apps built on Sparkle or Electron download the update inside the app and leave only the install to a helper, so they can’t be paused without blocking the app. The filter stops new connections, so a download already running when the network became metered can finish. Kilobat’s own scheduled update check waits for an unmetered network too; Check for Updates still works by hand.

#### Data budgets and app quotas

Each network has its own budget. By default it counts until you reset it. Set it to start over daily, weekly on a weekday you choose, or monthly on the day your plan renews; a plan that renews on the 31st starts on the last day of shorter months. A budget with a cycle counts the usage history of that network, so it carries on after a restart. Kilobat notifies once per cycle at 80% and 100% by default, and at 50% if you add it.

An app can have its own quota: a limit per cycle on everything it moves or only its uploads, on one network or on all of them. Set one from the app’s bandwidth panel or with `kilobat quota com.getdropbox.dropbox 2 --upload`. With filtering on, a used-up budget stops new connections, and a used-up quota stops that app’s new connections. A temporary allow or a connection rule still gets through. Kilobat samples traffic every second, so budgets and quotas are approximate: an app can go a little over before it stops.

#### What counts: Internet, local network and VPNs

Budgets, quotas and data used count Internet traffic only. Traffic to your local network (printers, NAS, other computers, a router's admin page), AirDrop and other nearby-device links (AWDL) is shown apart, as “Local network: 2.1 GB, not counted”, when you hold the pointer over the budget card's used figure, and in each app's bandwidth panel. The Mac's total comes from the Wi-Fi and Ethernet counters, so it includes what no app accounts for: packet headers and acknowledgments, which apps' byte counts leave out (usually 5–10% more), a process that started and finished between two samples, Internet Sharing, or a VPN that macOS runs itself. The same tooltip shows that part as “Not tied to an app”; it is never assigned to an app.

With a VPN, an app's traffic goes through the tunnel and the VPN carries it out over Wi-Fi or Ethernet. Kilobat counts it once, where it leaves the Mac, as your carrier does, and labels the app's share “Through a VPN”. With a proxy (a system proxy, `HTTPS_PROXY`, or a local proxy app), apps talk to the proxy on this Mac and the proxy makes the Internet connections, so the bytes show under the proxy; Kilobat can't tell which app was behind it. A proxy in TUN mode is a VPN to Kilobat: each app's own connection is labelled “Through a VPN”, and the proxy's outbound traffic shows under the proxy. A company proxy on a private address counts as local network.

#### System downloads

Apps hand some downloads to macOS: `nsurlsessiond` (background transfers for apps such as Music and Podcasts), `mobileassetd` (Apple Intelligence and Siri models, voices, fonts), `softwareupdated`, `appstored` and `appstoreagent`, `cloudd` and `bird` (iCloud), `fileproviderd` and Content Caching. The app list groups them as System downloads, with what each does. With filtering on, the filter sees which app each connection was for, so the list says “For Music” and a block reads “com.apple.Music via nsurlsessiond”. Without filtering, nettop sees only the service, so Kilobat can't say which app a download was for.

A process that is neither an app nor part of macOS, such as `node`, `python`, `deno`, `bun` or a Go binary in your home folder or Homebrew, shows its executable path when you expand its row, so an unfamiliar agent or tool stands out.

Turn on *Unusual uploads* in Settings to hear when an app uploads five times its usual in an hour, and at least 50 MB, at most once a day per app. It only notifies. Temporary rules and expiring connection rules are listed under Profiles with the time left, so you can end one early.

#### Blocking domains and IPs

Right-click an app's open connection to block that host for the app or for every app. The blocklist takes domains (subdomains included; `*.example.com` works too), IP addresses and CIDR ranges, alongside an imported hosts list. From the terminal: `kilobat block-host ads.example.com`.

### Privacy

Traffic history, network names and rules stay on your Mac. There is no account and no telemetry. Diagnostics contact test services, and license activation and update checks contact their services. Read the [privacy notice](https://kilobat.app/privacy.html).

---

Source: https://kilobat.app/agents/index.html

AI agents

## Set up Kilobat in your AI agent

Kilobat gives coding agents and assistants your Mac's network as tools: per-app traffic, Wi-Fi, DNS, why a host fails, whether the network is metered, and keep-awake for long runs. Pick your agent for its exact setup.

Free CLI and MCP server · 9 setups · Checked: 30 October 2026

### Pick your agent

- [Claude Code](https://kilobat.app/agents/claude-code.html): Give Claude Code your Mac's network as tools: per-app traffic, Wi-Fi, DNS, why a host fails and keep-awake.
- [Codex CLI](https://kilobat.app/agents/codex.html): Codex can check the network before a big download, find why its own request hangs and keep the Mac awake for a long task.
- [Cursor](https://kilobat.app/agents/cursor.html): Let Cursor's agent see why a package download hangs, which app is using the connection and whether the network is metered before a big pull.
- [Gemini CLI](https://kilobat.app/agents/gemini-cli.html): Gemini CLI can diagnose the Mac's network, scan Wi-Fi and keep the Mac awake while it works.
- [Claude Desktop](https://kilobat.app/agents/claude-desktop.html): Ask Claude why the Wi-Fi is slow, what used your hotspot data or whether your VPN carries everything, and it reads the answer from your Mac.
- [Windsurf](https://kilobat.app/agents/windsurf.html): Cascade can find why a dependency won't download, check DNS and trace a route from your Mac, with Kilobat's MCP server.
- [Cline](https://kilobat.app/agents/cline.html): Cline can check the Mac's network and keep it awake while it works.
- [Zed](https://kilobat.app/agents/zed.html): Zed's agent can measure the Mac's network, trace a route and compare DNS resolvers through Kilobat's MCP server.
- [Any MCP client](https://kilobat.app/agents/mcp-client.html): Kilobat's MCP server is a local stdio command, kilobat mcp.

### At a glance

| Agent | Add the MCP server | Run tracking |
|---|---|---|
| [Claude Code](https://kilobat.app/agents/claude-code.html) | `claude mcp add --scope user kilobat -- kilobat mcp` | Hooks |
| [Codex CLI](https://kilobat.app/agents/codex.html) | `codex mcp add kilobat -- kilobat mcp` | notify or hooks |
| [Cursor](https://kilobat.app/agents/cursor.html) | `mcp.json` | Traffic and CPU |
| [Gemini CLI](https://kilobat.app/agents/gemini-cli.html) | `gemini mcp add -s user kilobat kilobat mcp` | Hooks |
| [Claude Desktop](https://kilobat.app/agents/claude-desktop.html) | `.mcpb` extension or `claude_desktop_config.json` | Traffic and CPU |
| [Windsurf](https://kilobat.app/agents/windsurf.html) | `mcp_config.json` | Traffic and CPU |
| [Cline](https://kilobat.app/agents/cline.html) | `cline mcp add kilobat --yes -- kilobat mcp` | Plugin |
| [Zed](https://kilobat.app/agents/zed.html) | `context_servers` in settings | Traffic and CPU |
| [Any MCP client](https://kilobat.app/agents/mcp-client.html) | `kilobat mcp` | Traffic and CPU |

Run tracking tells Kilobat when a run works, waits for you or is done, so it keeps the Mac awake only while the agent is busy. Without hooks, Kilobat goes by the agent's traffic and CPU.

### Every setup

1. Install the CLI, which includes the MCP server.

   ```
   brew install seifip/kilobat/kilobat
   ```
2. Add `kilobat mcp` to the agent as a local stdio server.

   ```
   {
     "mcpServers": {
       "kilobat": {
         "command": "kilobat",
         "args": [
           "mcp"
         ]
       }
     }
   }
   ```
3. Add the skills, which teach the agent to read the results and to ask before changing settings.

   ```
   npx skills add seifip/kilobat-skills
   ```

Read-only tools run freely. Tools that change settings are annotated as destructive and tell the agent to ask you first. See [AI agents and MCP](https://kilobat.app/docs.html#agents) in the docs for every tool, and [llms-full.txt](https://kilobat.app/llms-full.txt) for the whole documentation as one Markdown file.

---

Source: https://kilobat.app/agents/claude-code.html

Agent setup

## Set up Kilobat in Claude Code

Give Claude Code your Mac's network as tools: per-app traffic, Wi-Fi, DNS, why a host fails and keep-awake. Its hooks tell Kilobat when a run works, waits for you or is done.

Free CLI and MCP server · macOS 14 or later · Checked: 30 October 2026

### Install the CLI

The Kilobat CLI is free and open source, and it includes the MCP server. Install it with Homebrew:

```
brew install seifip/kilobat/kilobat
```

Check it with `kilobat --version`. `kilobat doctor` says whether the Kilobat app is running, its network filter is on and Pro is active; the tools work without the app, which adds Wi-Fi names, history and rule enforcement. The CLI needs macOS 14 or later.

### Connect the MCP server

1. Add the server for all your projects. The `--` separates Claude Code's options from the command it runs.

   ```
   claude mcp add --scope user kilobat -- kilobat mcp
   ```
2. Start a new session and run `/mcp`. Kilobat is listed as connected.

Without `--scope user`, the server is added for the current project only, in `~/.claude.json`. With `--scope project` it goes in the project's `.mcp.json`, to share with your team.

### Add the skills

Nine Agent Skills teach the agent to read Kilobat's measurements and to ask before changing settings. Install them for all your projects with [skills.sh](https://skills.sh/seifip/kilobat-skills):

```
npx skills add seifip/kilobat-skills -g -a claude-code
```

This puts them in `~/.claude/skills/`. Leave out `-g` to install them for the current project only, or leave out both flags to pick agents from a list.

The `kilobat` skill is the entry point: it holds the setup and safety rules and sends the agent to the skill that fits, such as `mac-network-troubleshooting` or `mac-agent-runs`. See [all nine skills](https://kilobat.app/docs.html#network-troubleshooting-skill).

### Try these prompts

Ask in plain words. The agent picks the tools; these are the ones each request usually needs.

| Ask | MCP tools |
|---|---|
| The internet feels slow. Find out why and tell me what to fix first. | `diagnose_network`, `get_status` |
| npm install hangs on registry.npmjs.org. Find the layer that fails. | `diagnose_connection` |
| I'm about to pull a 6 GB Docker image. Is now a good time, or am I on a metered network? | `get_conditions` |
| Keep the Mac awake for the next two hours while you run the full test suite, then release it. | `keep_awake`, `release_awake` |
| Did my agent runs today finish, or did one stall or lose the network? | `list_sessions` |
| Something is uploading a lot. Which app is it, and how much has it sent in the last hour? | `get_status`, `get_app_bandwidth` |
| My video calls stutter even though speed tests look fine. Check for latency spikes. | `run_stutter_test`, `get_nearby_radios` |

### What Claude Code can and can't change

Kilobat's MCP server marks every tool as read-only or as a change, and each change tool's description tells the agent to get your confirmation first. The [kilobat skill](https://github.com/seifip/kilobat-skills/tree/main/skills/kilobat) holds the same rule: read freely, ask before changing.

#### Runs without asking

- Measure Wi-Fi, router, internet and DNS latency, and per-app traffic: `diagnose_network`, `get_status`, `get_wifi`, `scan_wifi`.
- Find the layer that stops one host, trace a route and compare resolvers: `diagnose_connection`, `trace_route`, `benchmark_dns`.
- Read history, sessions, rules and approvals: `get_usage_report`, `list_sessions`, `list_rules`, `list_approvals`.
- Ping for latency spikes with `run_stutter_test`, which sends pings only.

#### Asks you first

- A speed test, which uses up to 80 MB (`run_speedtest`; on a metered network, 10 MB or less), and a five-second LAN test (`run_lan_test`).
- Looking up your public IP with Cloudflare (`get_exit_path` with `public_ip`).
- Profiles, app rules, blocked hosts, the new-app mode, budgets, quotas, a network's data cost and pausing updaters (`set_profile`, `set_app_rule`, `block_destination`, `set_new_app_mode`, `set_budget`, `set_app_quota`, `set_network_cost`, `set_updater_pause`).
- DNS, which macOS also guards with an administrator password prompt (`set_dns`).
- Keeping the Mac running with the lid closed, every time (`keep_awake` with `lid_closed`). A plain `keep_awake` changes no settings and ends when it expires.

#### Can't do

- Let a waiting app connect on its own: `decide_approval` can block at once, but allowing opens Kilobat's approval window for you to confirm.
- Change AirDrop visibility: `set_airdrop_visibility` opens System Settings for you.
- Change sleep settings, another app's settings, or anything outside Kilobat. It never reads prompts or replies.
- Enforce rules without the Kilobat app and its network filter (Pro). Without them, rules are saved, not applied, and the agent should say so.

Claude Code asks before it calls an MCP tool unless a permission rule allows it. To skip the prompt for reads only, allow tools by name, such as `mcp__kilobat__diagnose_network`, and leave Kilobat's change tools to ask.

If the agent can also run shell commands, the `kilobat` CLI can do what the MCP tools do. The skills tell it which commands to run freely and which to ask about.

### Track agent runs

Add these to `~/.claude/settings.json`, merged with any hooks you already have. Each hook gets JSON on stdin with the session id and folder, which `--stdin-json` reads. A permission or input prompt means waiting; Stop means done once background tasks finish; a rate limit means waiting until it resets.

```
{
  "hooks": {
    "SessionStart": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent claude --stdin-json" }] }],
    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent claude --stdin-json" }] }],
    "Notification": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent claude --stdin-json" }] }],
    "Stop": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent claude --stdin-json" }] }],
    "StopFailure": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent claude --stdin-json" }] }],
    "SessionEnd": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent claude --stdin-json" }] }]
  }
}
```

### Sources

- [Claude Code docs: Connect Claude Code to tools via MCP](https://code.claude.com/docs/en/mcp)
- [Claude Code docs: Hooks reference](https://code.claude.com/docs/en/hooks)
- [Kilobat docs: AI agents and MCP](https://kilobat.app/docs.html#agents)
- [skills.sh: supported agents and their skill folders](https://github.com/vercel-labs/skills/blob/main/docs/agents.md)

Checked on 30 October 2026. Agents change their settings often; if a step no longer matches, tell us at the support address.

### Other agents

- [Codex CLI](https://kilobat.app/agents/codex.html): Codex can check the network before a big download, find why its own request hangs and keep the Mac awake for a long task.
- [Cursor](https://kilobat.app/agents/cursor.html): Let Cursor's agent see why a package download hangs, which app is using the connection and whether the network is metered before a big pull.
- [Gemini CLI](https://kilobat.app/agents/gemini-cli.html): Gemini CLI can diagnose the Mac's network, scan Wi-Fi and keep the Mac awake while it works.
- [Claude Desktop](https://kilobat.app/agents/claude-desktop.html): Ask Claude why the Wi-Fi is slow, what used your hotspot data or whether your VPN carries everything, and it reads the answer from your Mac.
- [Windsurf](https://kilobat.app/agents/windsurf.html): Cascade can find why a dependency won't download, check DNS and trace a route from your Mac, with Kilobat's MCP server.
- [Cline](https://kilobat.app/agents/cline.html): Cline can check the Mac's network and keep it awake while it works.
- [Zed](https://kilobat.app/agents/zed.html): Zed's agent can measure the Mac's network, trace a route and compare DNS resolvers through Kilobat's MCP server.
- [Any MCP client](https://kilobat.app/agents/mcp-client.html): Kilobat's MCP server is a local stdio command, kilobat mcp.

---

Source: https://kilobat.app/agents/claude-desktop.html

Agent setup

## Set up Kilobat in Claude Desktop

Ask Claude why the Wi-Fi is slow, what used your hotspot data or whether your VPN carries everything, and it reads the answer from your Mac.

Free CLI and MCP server · macOS 14 or later · Checked: 30 October 2026

### Install the CLI

The Kilobat CLI is free and open source, and it includes the MCP server. Install it with Homebrew:

```
brew install seifip/kilobat/kilobat
```

Check it with `kilobat --version`. `kilobat doctor` says whether the Kilobat app is running, its network filter is on and Pro is active; the tools work without the app, which adds Wi-Fi names, history and rule enforcement. The CLI needs macOS 14 or later.

### Connect the MCP server

1. Easiest, once a release includes it: download `kilobat-mcp-<version>.mcpb` from the [latest CLI release](https://github.com/seifip/kilobat-cli/releases/latest) and double-click it. Claude Desktop shows an install dialog. The extension carries its own copy of the CLI, so it needs no Homebrew.
2. Otherwise, install the CLI with Homebrew as above, then open Claude › Settings › Developer › Edit Config. It opens `~/Library/Application Support/Claude/claude_desktop_config.json`.
3. Add Kilobat with the full path to the CLI, which `command -v kilobat` prints. On an Intel Mac it is `/usr/local/bin/kilobat`.

   ```
   {
     "mcpServers": {
       "kilobat": {
         "command": "/opt/homebrew/bin/kilobat",
         "args": [
           "mcp"
         ]
       }
     }
   }
   ```
4. Quit Claude Desktop completely and open it again. Kilobat appears under Connectors in the + menu of the message box.

If it doesn't connect, read `~/Library/Logs/Claude/mcp-server-kilobat.log`.

### Add the skills

Claude Desktop doesn't read skills from a folder on disk. Download a skill folder from [github.com/seifip/kilobat-skills](https://github.com/seifip/kilobat-skills), starting with `skills/kilobat`, zip it, and upload it in Customize › Skills with the + button. Skills need code execution, which is under Settings › Capabilities.

The `kilobat` skill is the entry point: it holds the setup and safety rules and sends the agent to the skill that fits, such as `mac-network-troubleshooting` or `mac-agent-runs`. See [all nine skills](https://kilobat.app/docs.html#network-troubleshooting-skill).

### Try these prompts

Ask in plain words. The agent picks the tools; these are the ones each request usually needs.

| Ask | MCP tools |
|---|---|
| The internet feels slow. Find out why and tell me what to fix first. | `diagnose_network`, `get_status` |
| The Wi-Fi is weak in this room. Is the channel crowded, and which one should the router use? | `get_wifi`, `scan_wifi`, `suggest_wifi_channel` |
| My video calls stutter even though speed tests look fine. Check for latency spikes. | `run_stutter_test`, `get_nearby_radios` |
| What used my hotspot data today, app by app? | `get_usage_report`, `get_status` |
| My carrier says I used 40 GB last month. Compare that with what Kilobat recorded. | `compare_usage` |
| Does my VPN carry all my traffic, or only some of it? | `get_exit_path` |
| Which apps are waiting for approval to connect, and who signed them? | `list_approvals` |

### What Claude Desktop can and can't change

Kilobat's MCP server marks every tool as read-only or as a change, and each change tool's description tells the agent to get your confirmation first. The [kilobat skill](https://github.com/seifip/kilobat-skills/tree/main/skills/kilobat) holds the same rule: read freely, ask before changing.

#### Runs without asking

- Measure Wi-Fi, router, internet and DNS latency, and per-app traffic: `diagnose_network`, `get_status`, `get_wifi`, `scan_wifi`.
- Find the layer that stops one host, trace a route and compare resolvers: `diagnose_connection`, `trace_route`, `benchmark_dns`.
- Read history, sessions, rules and approvals: `get_usage_report`, `list_sessions`, `list_rules`, `list_approvals`.
- Ping for latency spikes with `run_stutter_test`, which sends pings only.

#### Asks you first

- A speed test, which uses up to 80 MB (`run_speedtest`; on a metered network, 10 MB or less), and a five-second LAN test (`run_lan_test`).
- Looking up your public IP with Cloudflare (`get_exit_path` with `public_ip`).
- Profiles, app rules, blocked hosts, the new-app mode, budgets, quotas, a network's data cost and pausing updaters (`set_profile`, `set_app_rule`, `block_destination`, `set_new_app_mode`, `set_budget`, `set_app_quota`, `set_network_cost`, `set_updater_pause`).
- DNS, which macOS also guards with an administrator password prompt (`set_dns`).
- Keeping the Mac running with the lid closed, every time (`keep_awake` with `lid_closed`). A plain `keep_awake` changes no settings and ends when it expires.

#### Can't do

- Let a waiting app connect on its own: `decide_approval` can block at once, but allowing opens Kilobat's approval window for you to confirm.
- Change AirDrop visibility: `set_airdrop_visibility` opens System Settings for you.
- Change sleep settings, another app's settings, or anything outside Kilobat. It never reads prompts or replies.
- Enforce rules without the Kilobat app and its network filter (Pro). Without them, rules are saved, not applied, and the agent should say so.

Claude Desktop asks before it uses a connector's tool. Approve Kilobat's change tools one at a time.

If the agent can also run shell commands, the `kilobat` CLI can do what the MCP tools do. The skills tell it which commands to run freely and which to ask about.

### Track agent runs

Claude Desktop isn't a coding agent, so there are no runs for Kilobat to track. Ask Claude to keep the Mac awake for a while with `keep_awake`; Claude Code has [hooks](https://kilobat.app/agents/claude-code.html#hooks) for agent runs.

### Sources

- [Model Context Protocol docs: Connect to local MCP servers](https://modelcontextprotocol.io/docs/develop/connect-local-servers)
- [Claude Help Center: Using skills in Claude](https://support.claude.com/en/articles/12512180-using-skills-in-claude)
- [Kilobat CLI releases](https://github.com/seifip/kilobat-cli/releases/latest)
- [Kilobat docs: AI agents and MCP](https://kilobat.app/docs.html#agents)
- [skills.sh: supported agents and their skill folders](https://github.com/vercel-labs/skills/blob/main/docs/agents.md)

Checked on 30 October 2026. Agents change their settings often; if a step no longer matches, tell us at the support address.

### Other agents

- [Claude Code](https://kilobat.app/agents/claude-code.html): Give Claude Code your Mac's network as tools: per-app traffic, Wi-Fi, DNS, why a host fails and keep-awake.
- [Codex CLI](https://kilobat.app/agents/codex.html): Codex can check the network before a big download, find why its own request hangs and keep the Mac awake for a long task.
- [Cursor](https://kilobat.app/agents/cursor.html): Let Cursor's agent see why a package download hangs, which app is using the connection and whether the network is metered before a big pull.
- [Gemini CLI](https://kilobat.app/agents/gemini-cli.html): Gemini CLI can diagnose the Mac's network, scan Wi-Fi and keep the Mac awake while it works.
- [Windsurf](https://kilobat.app/agents/windsurf.html): Cascade can find why a dependency won't download, check DNS and trace a route from your Mac, with Kilobat's MCP server.
- [Cline](https://kilobat.app/agents/cline.html): Cline can check the Mac's network and keep it awake while it works.
- [Zed](https://kilobat.app/agents/zed.html): Zed's agent can measure the Mac's network, trace a route and compare DNS resolvers through Kilobat's MCP server.
- [Any MCP client](https://kilobat.app/agents/mcp-client.html): Kilobat's MCP server is a local stdio command, kilobat mcp.

---

Source: https://kilobat.app/agents/cline.html

Agent setup

## Set up Kilobat in Cline

Cline can check the Mac's network and keep it awake while it works. Kilobat's Cline plugin reports each run as working, waiting for you, done or failed.

Free CLI and MCP server · macOS 14 or later · Checked: 30 October 2026

### Install the CLI

The Kilobat CLI is free and open source, and it includes the MCP server. Install it with Homebrew:

```
brew install seifip/kilobat/kilobat
```

Check it with `kilobat --version`. `kilobat doctor` says whether the Kilobat app is running, its network filter is on and Pro is active; the tools work without the app, which adds Wi-Fi names, history and rule enforcement. The CLI needs macOS 14 or later.

### Connect the MCP server

1. In the extension, click the MCP Servers icon at the top of the Cline panel, open Configure, then Configure MCP Servers. It opens `cline_mcp_settings.json`.
2. Add Kilobat. List only read-only tools in `autoApprove`, or none:

   ```
   {
     "mcpServers": {
       "kilobat": {
         "command": "kilobat",
         "args": [
           "mcp"
         ],
         "disabled": false,
         "autoApprove": [
           "get_status",
           "diagnose_network",
           "get_conditions"
         ]
       }
     }
   }
   ```
3. In the Cline CLI, add it from the terminal. It writes `~/.cline/data/settings/cline_mcp_settings.json`.

   ```
   cline mcp add kilobat --yes -- kilobat mcp
   ```

An app opened from the Dock doesn't always see the PATH your shell uses. If the server doesn't start, replace `kilobat` with the full path that `command -v kilobat` prints: `/opt/homebrew/bin/kilobat` on Apple silicon, `/usr/local/bin/kilobat` on Intel.

### Add the skills

Nine Agent Skills teach the agent to read Kilobat's measurements and to ask before changing settings. Install them for all your projects with [skills.sh](https://skills.sh/seifip/kilobat-skills):

```
npx skills add seifip/kilobat-skills -g -a cline
```

This puts them in `~/.agents/skills/`. Leave out `-g` to install them for the current project only, or leave out both flags to pick agents from a list.

The `kilobat` skill is the entry point: it holds the setup and safety rules and sends the agent to the skill that fits, such as `mac-network-troubleshooting` or `mac-agent-runs`. See [all nine skills](https://kilobat.app/docs.html#network-troubleshooting-skill).

### Try these prompts

Ask in plain words. The agent picks the tools; these are the ones each request usually needs.

| Ask | MCP tools |
|---|---|
| The internet feels slow. Find out why and tell me what to fix first. | `diagnose_network`, `get_status` |
| npm install hangs on registry.npmjs.org. Find the layer that fails. | `diagnose_connection` |
| Keep the Mac awake for the next two hours while you run the full test suite, then release it. | `keep_awake`, `release_awake` |
| Did my agent runs today finish, or did one stall or lose the network? | `list_sessions` |
| I'm about to pull a 6 GB Docker image. Is now a good time, or am I on a metered network? | `get_conditions` |
| My video calls stutter even though speed tests look fine. Check for latency spikes. | `run_stutter_test`, `get_nearby_radios` |

### What Cline can and can't change

Kilobat's MCP server marks every tool as read-only or as a change, and each change tool's description tells the agent to get your confirmation first. The [kilobat skill](https://github.com/seifip/kilobat-skills/tree/main/skills/kilobat) holds the same rule: read freely, ask before changing.

#### Runs without asking

- Measure Wi-Fi, router, internet and DNS latency, and per-app traffic: `diagnose_network`, `get_status`, `get_wifi`, `scan_wifi`.
- Find the layer that stops one host, trace a route and compare resolvers: `diagnose_connection`, `trace_route`, `benchmark_dns`.
- Read history, sessions, rules and approvals: `get_usage_report`, `list_sessions`, `list_rules`, `list_approvals`.
- Ping for latency spikes with `run_stutter_test`, which sends pings only.

#### Asks you first

- A speed test, which uses up to 80 MB (`run_speedtest`; on a metered network, 10 MB or less), and a five-second LAN test (`run_lan_test`).
- Looking up your public IP with Cloudflare (`get_exit_path` with `public_ip`).
- Profiles, app rules, blocked hosts, the new-app mode, budgets, quotas, a network's data cost and pausing updaters (`set_profile`, `set_app_rule`, `block_destination`, `set_new_app_mode`, `set_budget`, `set_app_quota`, `set_network_cost`, `set_updater_pause`).
- DNS, which macOS also guards with an administrator password prompt (`set_dns`).
- Keeping the Mac running with the lid closed, every time (`keep_awake` with `lid_closed`). A plain `keep_awake` changes no settings and ends when it expires.

#### Can't do

- Let a waiting app connect on its own: `decide_approval` can block at once, but allowing opens Kilobat's approval window for you to confirm.
- Change AirDrop visibility: `set_airdrop_visibility` opens System Settings for you.
- Change sleep settings, another app's settings, or anything outside Kilobat. It never reads prompts or replies.
- Enforce rules without the Kilobat app and its network filter (Pro). Without them, rules are saved, not applied, and the agent should say so.

Cline asks before each tool call that isn't in `autoApprove`. Never add Kilobat's `set_`, `block_destination` or `decide_approval` tools there.

If the agent can also run shell commands, the `kilobat` CLI can do what the MCP tools do. The skills tell it which commands to run freely and which to ask about.

### Track agent runs

For the Cline CLI, SDK and Kanban, install Kilobat's plugin. It adds one file to Cline's plugin store and changes no other settings. Cline's plugins don't run in the VS Code or JetBrains extensions yet.

```
cline plugin install https://kilobat.app/agents/cline/kilobat.ts
```

It reports a run working, done, failed while Cline stays open, cancelled, rate-limited once Cline's own retries run out, and waiting while Cline asks you a question. It waits for subagents and teammates before calling a run done. Cline's approval prompts aren't visible to plugins, so traffic and CPU detection covers those. `cline plugin uninstall kilobat` removes it.

### Sources

- [Cline docs: Configuring MCP servers](https://docs.cline.bot/mcp/configuring-mcp-servers)
- [Kilobat's Cline plugin, one TypeScript file](https://kilobat.app/agents/cline/kilobat.ts)
- [Kilobat docs: AI agents and MCP](https://kilobat.app/docs.html#agents)
- [skills.sh: supported agents and their skill folders](https://github.com/vercel-labs/skills/blob/main/docs/agents.md)

Checked on 30 October 2026. Agents change their settings often; if a step no longer matches, tell us at the support address.

### Other agents

- [Claude Code](https://kilobat.app/agents/claude-code.html): Give Claude Code your Mac's network as tools: per-app traffic, Wi-Fi, DNS, why a host fails and keep-awake.
- [Codex CLI](https://kilobat.app/agents/codex.html): Codex can check the network before a big download, find why its own request hangs and keep the Mac awake for a long task.
- [Cursor](https://kilobat.app/agents/cursor.html): Let Cursor's agent see why a package download hangs, which app is using the connection and whether the network is metered before a big pull.
- [Gemini CLI](https://kilobat.app/agents/gemini-cli.html): Gemini CLI can diagnose the Mac's network, scan Wi-Fi and keep the Mac awake while it works.
- [Claude Desktop](https://kilobat.app/agents/claude-desktop.html): Ask Claude why the Wi-Fi is slow, what used your hotspot data or whether your VPN carries everything, and it reads the answer from your Mac.
- [Windsurf](https://kilobat.app/agents/windsurf.html): Cascade can find why a dependency won't download, check DNS and trace a route from your Mac, with Kilobat's MCP server.
- [Zed](https://kilobat.app/agents/zed.html): Zed's agent can measure the Mac's network, trace a route and compare DNS resolvers through Kilobat's MCP server.
- [Any MCP client](https://kilobat.app/agents/mcp-client.html): Kilobat's MCP server is a local stdio command, kilobat mcp.

---

Source: https://kilobat.app/agents/codex.html

Agent setup

## Set up Kilobat in Codex CLI

Codex can check the network before a big download, find why its own request hangs and keep the Mac awake for a long task. One line in config.toml tells Kilobat when a turn is done.

Free CLI and MCP server · macOS 14 or later · Checked: 30 October 2026

### Install the CLI

The Kilobat CLI is free and open source, and it includes the MCP server. Install it with Homebrew:

```
brew install seifip/kilobat/kilobat
```

Check it with `kilobat --version`. `kilobat doctor` says whether the Kilobat app is running, its network filter is on and Pro is active; the tools work without the app, which adds Wi-Fi names, history and rule enforcement. The CLI needs macOS 14 or later.

### Connect the MCP server

1. Add the server from the terminal:

   ```
   codex mcp add kilobat -- kilobat mcp
   ```
2. Or add it to `~/.codex/config.toml` yourself. A longer tool timeout leaves room for speed and stutter tests.

   ```
   [mcp_servers.kilobat]
   command = "kilobat"
   args = ["mcp"]
   tool_timeout_sec = 120
   ```

A `.codex/config.toml` in a trusted project adds the server for that project only.

### Add the skills

Nine Agent Skills teach the agent to read Kilobat's measurements and to ask before changing settings. Install them for all your projects with [skills.sh](https://skills.sh/seifip/kilobat-skills):

```
npx skills add seifip/kilobat-skills -g -a codex
```

This puts them in `~/.agents/skills/`. Leave out `-g` to install them for the current project only, or leave out both flags to pick agents from a list.

The `kilobat` skill is the entry point: it holds the setup and safety rules and sends the agent to the skill that fits, such as `mac-network-troubleshooting` or `mac-agent-runs`. See [all nine skills](https://kilobat.app/docs.html#network-troubleshooting-skill).

### Try these prompts

Ask in plain words. The agent picks the tools; these are the ones each request usually needs.

| Ask | MCP tools |
|---|---|
| npm install hangs on registry.npmjs.org. Find the layer that fails. | `diagnose_connection` |
| The internet feels slow. Find out why and tell me what to fix first. | `diagnose_network`, `get_status` |
| I'm about to pull a 6 GB Docker image. Is now a good time, or am I on a metered network? | `get_conditions` |
| Keep the Mac awake for the next two hours while you run the full test suite, then release it. | `keep_awake`, `release_awake` |
| Trace the route to github.com three times and tell me where the delay starts. | `trace_route`, `get_route_history` |
| Did my agent runs today finish, or did one stall or lose the network? | `list_sessions` |

### What Codex CLI can and can't change

Kilobat's MCP server marks every tool as read-only or as a change, and each change tool's description tells the agent to get your confirmation first. The [kilobat skill](https://github.com/seifip/kilobat-skills/tree/main/skills/kilobat) holds the same rule: read freely, ask before changing.

#### Runs without asking

- Measure Wi-Fi, router, internet and DNS latency, and per-app traffic: `diagnose_network`, `get_status`, `get_wifi`, `scan_wifi`.
- Find the layer that stops one host, trace a route and compare resolvers: `diagnose_connection`, `trace_route`, `benchmark_dns`.
- Read history, sessions, rules and approvals: `get_usage_report`, `list_sessions`, `list_rules`, `list_approvals`.
- Ping for latency spikes with `run_stutter_test`, which sends pings only.

#### Asks you first

- A speed test, which uses up to 80 MB (`run_speedtest`; on a metered network, 10 MB or less), and a five-second LAN test (`run_lan_test`).
- Looking up your public IP with Cloudflare (`get_exit_path` with `public_ip`).
- Profiles, app rules, blocked hosts, the new-app mode, budgets, quotas, a network's data cost and pausing updaters (`set_profile`, `set_app_rule`, `block_destination`, `set_new_app_mode`, `set_budget`, `set_app_quota`, `set_network_cost`, `set_updater_pause`).
- DNS, which macOS also guards with an administrator password prompt (`set_dns`).
- Keeping the Mac running with the lid closed, every time (`keep_awake` with `lid_closed`). A plain `keep_awake` changes no settings and ends when it expires.

#### Can't do

- Let a waiting app connect on its own: `decide_approval` can block at once, but allowing opens Kilobat's approval window for you to confirm.
- Change AirDrop visibility: `set_airdrop_visibility` opens System Settings for you.
- Change sleep settings, another app's settings, or anything outside Kilobat. It never reads prompts or replies.
- Enforce rules without the Kilobat app and its network filter (Pro). Without them, rules are saved, not applied, and the agent should say so.

Codex shows Kilobat's tools with their annotations; keep its approval prompts on for the change tools.

If the agent can also run shell commands, the `kilobat` CLI can do what the MCP tools do. The skills tell it which commands to run freely and which to ask about.

### Track agent runs

Simplest: `notify` in `~/.codex/config.toml`. Codex passes a JSON argument after each turn, which `--json-arg` reads. It only says done, and Codex runs one `notify` program.

```
notify = ["kilobat", "agent-event", "done", "--agent", "codex", "--json-arg"]
```

For waiting too, use Codex hooks in `~/.codex/hooks.json` instead, and trust them with `/hooks`:

```
{
  "hooks": {
    "SessionStart": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent codex --stdin-json" }] }],
    "UserPromptSubmit": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent codex --stdin-json" }] }],
    "PermissionRequest": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent codex --stdin-json" }] }],
    "Stop": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent codex --stdin-json" }] }]
  }
}
```

### Sources

- [OpenAI Codex docs: Model Context Protocol](https://developers.openai.com/codex/mcp)
- [Kilobat docs: AI agents and MCP](https://kilobat.app/docs.html#agents)
- [skills.sh: supported agents and their skill folders](https://github.com/vercel-labs/skills/blob/main/docs/agents.md)

Checked on 30 October 2026. Agents change their settings often; if a step no longer matches, tell us at the support address.

### Other agents

- [Claude Code](https://kilobat.app/agents/claude-code.html): Give Claude Code your Mac's network as tools: per-app traffic, Wi-Fi, DNS, why a host fails and keep-awake.
- [Cursor](https://kilobat.app/agents/cursor.html): Let Cursor's agent see why a package download hangs, which app is using the connection and whether the network is metered before a big pull.
- [Gemini CLI](https://kilobat.app/agents/gemini-cli.html): Gemini CLI can diagnose the Mac's network, scan Wi-Fi and keep the Mac awake while it works.
- [Claude Desktop](https://kilobat.app/agents/claude-desktop.html): Ask Claude why the Wi-Fi is slow, what used your hotspot data or whether your VPN carries everything, and it reads the answer from your Mac.
- [Windsurf](https://kilobat.app/agents/windsurf.html): Cascade can find why a dependency won't download, check DNS and trace a route from your Mac, with Kilobat's MCP server.
- [Cline](https://kilobat.app/agents/cline.html): Cline can check the Mac's network and keep it awake while it works.
- [Zed](https://kilobat.app/agents/zed.html): Zed's agent can measure the Mac's network, trace a route and compare DNS resolvers through Kilobat's MCP server.
- [Any MCP client](https://kilobat.app/agents/mcp-client.html): Kilobat's MCP server is a local stdio command, kilobat mcp.

---

Source: https://kilobat.app/agents/cursor.html

Agent setup

## Set up Kilobat in Cursor

Let Cursor's agent see why a package download hangs, which app is using the connection and whether the network is metered before a big pull.

Free CLI and MCP server · macOS 14 or later · Checked: 30 October 2026

### Install the CLI

The Kilobat CLI is free and open source, and it includes the MCP server. Install it with Homebrew:

```
brew install seifip/kilobat/kilobat
```

Check it with `kilobat --version`. `kilobat doctor` says whether the Kilobat app is running, its network filter is on and Pro is active; the tools work without the app, which adds Wi-Fi names, history and rule enforcement. The CLI needs macOS 14 or later.

### Connect the MCP server

1. With the CLI installed, click [Add to Cursor](cursor://anysphere.cursor-deeplink/mcp/install?name=kilobat&config=eyJjb21tYW5kIjoia2lsb2JhdCIsImFyZ3MiOlsibWNwIl19) and confirm in Cursor.
2. Or add it to `~/.cursor/mcp.json` for every project, or to `.cursor/mcp.json` in one project:

   ```
   {
     "mcpServers": {
       "kilobat": {
         "command": "kilobat",
         "args": [
           "mcp"
         ]
       }
     }
   }
   ```
3. Open Cursor Settings, find Kilobat in the MCP list and check that it is on and lists its tools.

An app opened from the Dock doesn't always see the PATH your shell uses. If the server doesn't start, replace `kilobat` with the full path that `command -v kilobat` prints: `/opt/homebrew/bin/kilobat` on Apple silicon, `/usr/local/bin/kilobat` on Intel.

### Add the skills

Nine Agent Skills teach the agent to read Kilobat's measurements and to ask before changing settings. Install them for all your projects with [skills.sh](https://skills.sh/seifip/kilobat-skills):

```
npx skills add seifip/kilobat-skills -g -a cursor
```

This puts them in `~/.cursor/skills/`. Leave out `-g` to install them for the current project only, or leave out both flags to pick agents from a list.

The `kilobat` skill is the entry point: it holds the setup and safety rules and sends the agent to the skill that fits, such as `mac-network-troubleshooting` or `mac-agent-runs`. See [all nine skills](https://kilobat.app/docs.html#network-troubleshooting-skill).

### Try these prompts

Ask in plain words. The agent picks the tools; these are the ones each request usually needs.

| Ask | MCP tools |
|---|---|
| The internet feels slow. Find out why and tell me what to fix first. | `diagnose_network`, `get_status` |
| npm install hangs on registry.npmjs.org. Find the layer that fails. | `diagnose_connection` |
| Something is uploading a lot. Which app is it, and how much has it sent in the last hour? | `get_status`, `get_app_bandwidth` |
| I'm about to pull a 6 GB Docker image. Is now a good time, or am I on a metered network? | `get_conditions` |
| Does my VPN carry all my traffic, or only some of it? | `get_exit_path` |
| Pages are slow to start loading. Compare DNS resolvers and tell me if switching would help. Don't change anything yet. | `benchmark_dns`, `diagnose_network` |

### What Cursor can and can't change

Kilobat's MCP server marks every tool as read-only or as a change, and each change tool's description tells the agent to get your confirmation first. The [kilobat skill](https://github.com/seifip/kilobat-skills/tree/main/skills/kilobat) holds the same rule: read freely, ask before changing.

#### Runs without asking

- Measure Wi-Fi, router, internet and DNS latency, and per-app traffic: `diagnose_network`, `get_status`, `get_wifi`, `scan_wifi`.
- Find the layer that stops one host, trace a route and compare resolvers: `diagnose_connection`, `trace_route`, `benchmark_dns`.
- Read history, sessions, rules and approvals: `get_usage_report`, `list_sessions`, `list_rules`, `list_approvals`.
- Ping for latency spikes with `run_stutter_test`, which sends pings only.

#### Asks you first

- A speed test, which uses up to 80 MB (`run_speedtest`; on a metered network, 10 MB or less), and a five-second LAN test (`run_lan_test`).
- Looking up your public IP with Cloudflare (`get_exit_path` with `public_ip`).
- Profiles, app rules, blocked hosts, the new-app mode, budgets, quotas, a network's data cost and pausing updaters (`set_profile`, `set_app_rule`, `block_destination`, `set_new_app_mode`, `set_budget`, `set_app_quota`, `set_network_cost`, `set_updater_pause`).
- DNS, which macOS also guards with an administrator password prompt (`set_dns`).
- Keeping the Mac running with the lid closed, every time (`keep_awake` with `lid_closed`). A plain `keep_awake` changes no settings and ends when it expires.

#### Can't do

- Let a waiting app connect on its own: `decide_approval` can block at once, but allowing opens Kilobat's approval window for you to confirm.
- Change AirDrop visibility: `set_airdrop_visibility` opens System Settings for you.
- Change sleep settings, another app's settings, or anything outside Kilobat. It never reads prompts or replies.
- Enforce rules without the Kilobat app and its network filter (Pro). Without them, rules are saved, not applied, and the agent should say so.

Cursor asks before it runs a tool unless you let it run tools on its own. Kilobat's change tools still tell the agent to ask you, but keep confirmation on for them.

If the agent can also run shell commands, the `kilobat` CLI can do what the MCP tools do. The skills tell it which commands to run freely and which to ask about.

### Track agent runs

Cursor has no hook setup in Kilobat yet. Without hooks, Kilobat goes by an agent's traffic and CPU, so a quiet run may be done or waiting for you. An agent with its own hooks can call `kilobat agent-event start|working|waiting|done|failed --agent <name> --session <id> --cwd <folder>`; the command prints nothing and always exits 0. Add `--verbose` to see what happened when you try it by hand. See [Connect agents](https://kilobat.app/docs.html#connect-agents) in the docs.

Kilobat recognizes Cursor's agent by its traffic and keeps the Mac awake while it works, when you turn on While AI agents work.

### Sources

- [Cursor docs: Model Context Protocol](https://cursor.com/docs/context/mcp)
- [Cursor docs: MCP install links](https://cursor.com/docs/context/mcp/install-links)
- [Kilobat docs: AI agents and MCP](https://kilobat.app/docs.html#agents)
- [skills.sh: supported agents and their skill folders](https://github.com/vercel-labs/skills/blob/main/docs/agents.md)

Checked on 30 October 2026. Agents change their settings often; if a step no longer matches, tell us at the support address.

### Other agents

- [Claude Code](https://kilobat.app/agents/claude-code.html): Give Claude Code your Mac's network as tools: per-app traffic, Wi-Fi, DNS, why a host fails and keep-awake.
- [Codex CLI](https://kilobat.app/agents/codex.html): Codex can check the network before a big download, find why its own request hangs and keep the Mac awake for a long task.
- [Gemini CLI](https://kilobat.app/agents/gemini-cli.html): Gemini CLI can diagnose the Mac's network, scan Wi-Fi and keep the Mac awake while it works.
- [Claude Desktop](https://kilobat.app/agents/claude-desktop.html): Ask Claude why the Wi-Fi is slow, what used your hotspot data or whether your VPN carries everything, and it reads the answer from your Mac.
- [Windsurf](https://kilobat.app/agents/windsurf.html): Cascade can find why a dependency won't download, check DNS and trace a route from your Mac, with Kilobat's MCP server.
- [Cline](https://kilobat.app/agents/cline.html): Cline can check the Mac's network and keep it awake while it works.
- [Zed](https://kilobat.app/agents/zed.html): Zed's agent can measure the Mac's network, trace a route and compare DNS resolvers through Kilobat's MCP server.
- [Any MCP client](https://kilobat.app/agents/mcp-client.html): Kilobat's MCP server is a local stdio command, kilobat mcp.

---

Source: https://kilobat.app/agents/gemini-cli.html

Agent setup

## Set up Kilobat in Gemini CLI

Gemini CLI can diagnose the Mac's network, scan Wi-Fi and keep the Mac awake while it works. Its hooks tell Kilobat which run is working and which waits for you.

Free CLI and MCP server · macOS 14 or later · Checked: 30 October 2026

### Install the CLI

The Kilobat CLI is free and open source, and it includes the MCP server. Install it with Homebrew:

```
brew install seifip/kilobat/kilobat
```

Check it with `kilobat --version`. `kilobat doctor` says whether the Kilobat app is running, its network filter is on and Pro is active; the tools work without the app, which adds Wi-Fi names, history and rule enforcement. The CLI needs macOS 14 or later.

### Connect the MCP server

1. Add the server for your user. Without `-s user` it goes in the current project's `.gemini/settings.json`.

   ```
   gemini mcp add -s user kilobat kilobat mcp
   ```
2. Or add it to `~/.gemini/settings.json` yourself:

   ```
   {
     "mcpServers": {
       "kilobat": {
         "command": "kilobat",
         "args": [
           "mcp"
         ],
         "timeout": 120000
       }
     }
   }
   ```
3. Run `gemini mcp list`. In a folder you haven't trusted, stdio servers show as disconnected until you run `gemini trust`.

The Gemini CLI site says Antigravity CLI replaced it in June 2026, and Antigravity CLI keeps MCP servers in a config of its own. The setup and hooks on this page are for Gemini CLI.

### Add the skills

Nine Agent Skills teach the agent to read Kilobat's measurements and to ask before changing settings. Install them for all your projects with [skills.sh](https://skills.sh/seifip/kilobat-skills):

```
npx skills add seifip/kilobat-skills -g -a gemini-cli
```

This puts them in `~/.gemini/skills/`. Leave out `-g` to install them for the current project only, or leave out both flags to pick agents from a list.

The `kilobat` skill is the entry point: it holds the setup and safety rules and sends the agent to the skill that fits, such as `mac-network-troubleshooting` or `mac-agent-runs`. See [all nine skills](https://kilobat.app/docs.html#network-troubleshooting-skill).

### Try these prompts

Ask in plain words. The agent picks the tools; these are the ones each request usually needs.

| Ask | MCP tools |
|---|---|
| The internet feels slow. Find out why and tell me what to fix first. | `diagnose_network`, `get_status` |
| The Wi-Fi is weak in this room. Is the channel crowded, and which one should the router use? | `get_wifi`, `scan_wifi`, `suggest_wifi_channel` |
| npm install hangs on registry.npmjs.org. Find the layer that fails. | `diagnose_connection` |
| Keep the Mac awake for the next two hours while you run the full test suite, then release it. | `keep_awake`, `release_awake` |
| Did my agent runs today finish, or did one stall or lose the network? | `list_sessions` |
| Run a 10 MB speed test and say whether a video call will hold up. | `run_speedtest` |

### What Gemini CLI can and can't change

Kilobat's MCP server marks every tool as read-only or as a change, and each change tool's description tells the agent to get your confirmation first. The [kilobat skill](https://github.com/seifip/kilobat-skills/tree/main/skills/kilobat) holds the same rule: read freely, ask before changing.

#### Runs without asking

- Measure Wi-Fi, router, internet and DNS latency, and per-app traffic: `diagnose_network`, `get_status`, `get_wifi`, `scan_wifi`.
- Find the layer that stops one host, trace a route and compare resolvers: `diagnose_connection`, `trace_route`, `benchmark_dns`.
- Read history, sessions, rules and approvals: `get_usage_report`, `list_sessions`, `list_rules`, `list_approvals`.
- Ping for latency spikes with `run_stutter_test`, which sends pings only.

#### Asks you first

- A speed test, which uses up to 80 MB (`run_speedtest`; on a metered network, 10 MB or less), and a five-second LAN test (`run_lan_test`).
- Looking up your public IP with Cloudflare (`get_exit_path` with `public_ip`).
- Profiles, app rules, blocked hosts, the new-app mode, budgets, quotas, a network's data cost and pausing updaters (`set_profile`, `set_app_rule`, `block_destination`, `set_new_app_mode`, `set_budget`, `set_app_quota`, `set_network_cost`, `set_updater_pause`).
- DNS, which macOS also guards with an administrator password prompt (`set_dns`).
- Keeping the Mac running with the lid closed, every time (`keep_awake` with `lid_closed`). A plain `keep_awake` changes no settings and ends when it expires.

#### Can't do

- Let a waiting app connect on its own: `decide_approval` can block at once, but allowing opens Kilobat's approval window for you to confirm.
- Change AirDrop visibility: `set_airdrop_visibility` opens System Settings for you.
- Change sleep settings, another app's settings, or anything outside Kilobat. It never reads prompts or replies.
- Enforce rules without the Kilobat app and its network filter (Pro). Without them, rules are saved, not applied, and the agent should say so.

Leave `trust` off, as it is by default, so Gemini CLI confirms each Kilobat tool call.

If the agent can also run shell commands, the `kilobat` CLI can do what the MCP tools do. The skills tell it which commands to run freely and which to ask about.

### Track agent runs

Add these to `~/.gemini/settings.json`, merged with any hooks you already have. Gemini CLI runs as `node`, so Kilobat can't tie its traffic to the run, but the state comes through.

```
{
  "hooks": {
    "SessionStart": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent gemini --stdin-json" }] }],
    "BeforeAgent": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent gemini --stdin-json" }] }],
    "Notification": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent gemini --stdin-json" }] }],
    "AfterAgent": [{ "hooks": [{ "type": "command", "command": "kilobat agent-event --agent gemini --stdin-json" }] }]
  }
}
```

### Sources

- [Gemini CLI docs: MCP servers](https://geminicli.com/docs/tools/mcp-server/)
- [Kilobat docs: AI agents and MCP](https://kilobat.app/docs.html#agents)
- [skills.sh: supported agents and their skill folders](https://github.com/vercel-labs/skills/blob/main/docs/agents.md)

Checked on 30 October 2026. Agents change their settings often; if a step no longer matches, tell us at the support address.

### Other agents

- [Claude Code](https://kilobat.app/agents/claude-code.html): Give Claude Code your Mac's network as tools: per-app traffic, Wi-Fi, DNS, why a host fails and keep-awake.
- [Codex CLI](https://kilobat.app/agents/codex.html): Codex can check the network before a big download, find why its own request hangs and keep the Mac awake for a long task.
- [Cursor](https://kilobat.app/agents/cursor.html): Let Cursor's agent see why a package download hangs, which app is using the connection and whether the network is metered before a big pull.
- [Claude Desktop](https://kilobat.app/agents/claude-desktop.html): Ask Claude why the Wi-Fi is slow, what used your hotspot data or whether your VPN carries everything, and it reads the answer from your Mac.
- [Windsurf](https://kilobat.app/agents/windsurf.html): Cascade can find why a dependency won't download, check DNS and trace a route from your Mac, with Kilobat's MCP server.
- [Cline](https://kilobat.app/agents/cline.html): Cline can check the Mac's network and keep it awake while it works.
- [Zed](https://kilobat.app/agents/zed.html): Zed's agent can measure the Mac's network, trace a route and compare DNS resolvers through Kilobat's MCP server.
- [Any MCP client](https://kilobat.app/agents/mcp-client.html): Kilobat's MCP server is a local stdio command, kilobat mcp.

---

Source: https://kilobat.app/agents/mcp-client.html

Agent setup

## Kilobat with any MCP client

Kilobat's MCP server is a local stdio command, `kilobat mcp`. Any client that starts local servers can use it, with no API key and no open port.

Free CLI and MCP server · macOS 14 or later · Checked: 30 October 2026

### Install the CLI

The Kilobat CLI is free and open source, and it includes the MCP server. Install it with Homebrew:

```
brew install seifip/kilobat/kilobat
```

Check it with `kilobat --version`. `kilobat doctor` says whether the Kilobat app is running, its network filter is on and Pro is active; the tools work without the app, which adds Wi-Fi names, history and rule enforcement. The CLI needs macOS 14 or later.

### Connect the MCP server

1. Point your client at this command. It speaks MCP over stdin and stdout.

   ```
   kilobat mcp
   ```
2. Most clients read an `mcpServers` object like this one:

   ```
   {
     "mcpServers": {
       "kilobat": {
         "command": "kilobat",
         "args": [
           "mcp"
         ]
       }
     }
   }
   ```
3. Grok Build CLI, for example, adds it with one command:

   ```
   grok mcp add kilobat -- kilobat mcp
   ```

An app opened from the Dock doesn't always see the PATH your shell uses. If the server doesn't start, replace `kilobat` with the full path that `command -v kilobat` prints: `/opt/homebrew/bin/kilobat` on Apple silicon, `/usr/local/bin/kilobat` on Intel.

The server has 43 tools with full annotations (`readOnlyHint`, `destructiveHint`, `idempotentHint`, `openWorldHint`) and returns the same JSON as the CLI. The [docs](https://kilobat.app/docs.html#agents) list every tool.

### Add the skills

Nine Agent Skills teach the agent to read Kilobat's measurements and to ask before changing settings. Install them with [skills.sh](https://skills.sh/seifip/kilobat-skills), which asks which agents to install them for:

```
npx skills add seifip/kilobat-skills
```

For a client that skills.sh doesn't know, copy the folders from [github.com/seifip/kilobat-skills](https://github.com/seifip/kilobat-skills) to where it reads skills. Each skill is a folder with a `SKILL.md`.

The `kilobat` skill is the entry point: it holds the setup and safety rules and sends the agent to the skill that fits, such as `mac-network-troubleshooting` or `mac-agent-runs`. See [all nine skills](https://kilobat.app/docs.html#network-troubleshooting-skill).

### Try these prompts

Ask in plain words. The agent picks the tools; these are the ones each request usually needs.

| Ask | MCP tools |
|---|---|
| The internet feels slow. Find out why and tell me what to fix first. | `diagnose_network`, `get_status` |
| The Wi-Fi is weak in this room. Is the channel crowded, and which one should the router use? | `get_wifi`, `scan_wifi`, `suggest_wifi_channel` |
| npm install hangs on registry.npmjs.org. Find the layer that fails. | `diagnose_connection` |
| What used my hotspot data today, app by app? | `get_usage_report`, `get_status` |
| My video calls stutter even though speed tests look fine. Check for latency spikes. | `run_stutter_test`, `get_nearby_radios` |
| I'm on my phone's hotspot. Which updaters would Kilobat pause, and should I turn that on? | `get_conditions`, `get_updaters`, `set_updater_pause` |
| Which apps are waiting for approval to connect, and who signed them? | `list_approvals` |

### What the agent can and can't change

Kilobat's MCP server marks every tool as read-only or as a change, and each change tool's description tells the agent to get your confirmation first. The [kilobat skill](https://github.com/seifip/kilobat-skills/tree/main/skills/kilobat) holds the same rule: read freely, ask before changing.

#### Runs without asking

- Measure Wi-Fi, router, internet and DNS latency, and per-app traffic: `diagnose_network`, `get_status`, `get_wifi`, `scan_wifi`.
- Find the layer that stops one host, trace a route and compare resolvers: `diagnose_connection`, `trace_route`, `benchmark_dns`.
- Read history, sessions, rules and approvals: `get_usage_report`, `list_sessions`, `list_rules`, `list_approvals`.
- Ping for latency spikes with `run_stutter_test`, which sends pings only.

#### Asks you first

- A speed test, which uses up to 80 MB (`run_speedtest`; on a metered network, 10 MB or less), and a five-second LAN test (`run_lan_test`).
- Looking up your public IP with Cloudflare (`get_exit_path` with `public_ip`).
- Profiles, app rules, blocked hosts, the new-app mode, budgets, quotas, a network's data cost and pausing updaters (`set_profile`, `set_app_rule`, `block_destination`, `set_new_app_mode`, `set_budget`, `set_app_quota`, `set_network_cost`, `set_updater_pause`).
- DNS, which macOS also guards with an administrator password prompt (`set_dns`).
- Keeping the Mac running with the lid closed, every time (`keep_awake` with `lid_closed`). A plain `keep_awake` changes no settings and ends when it expires.

#### Can't do

- Let a waiting app connect on its own: `decide_approval` can block at once, but allowing opens Kilobat's approval window for you to confirm.
- Change AirDrop visibility: `set_airdrop_visibility` opens System Settings for you.
- Change sleep settings, another app's settings, or anything outside Kilobat. It never reads prompts or replies.
- Enforce rules without the Kilobat app and its network filter (Pro). Without them, rules are saved, not applied, and the agent should say so.

Keep your client's confirmation on for the change tools; never auto-approve them.

If the agent can also run shell commands, the `kilobat` CLI can do what the MCP tools do. The skills tell it which commands to run freely and which to ask about.

### Track agent runs

An agent with its own hooks can tell Kilobat when a run starts, waits for you or is done by calling `kilobat agent-event start|working|waiting|done|failed --agent <name> --session <id> --cwd <folder>`. It prints nothing and always exits 0, so it can't break the agent; add `--verbose` when you try it by hand. Ready-made hooks exist for [Claude Code](https://kilobat.app/agents/claude-code.html#hooks), [Codex](https://kilobat.app/agents/codex.html#hooks), [Gemini CLI](https://kilobat.app/agents/gemini-cli.html#hooks) and [Cline](https://kilobat.app/agents/cline.html#hooks). Without hooks, Kilobat goes by the agent's traffic and CPU.

### Sources

- [Model Context Protocol](https://modelcontextprotocol.io/)
- [xAI docs: MCP servers in Grok Build](https://docs.x.ai/build/features/mcp-servers)
- [Kilobat docs: AI agents and MCP](https://kilobat.app/docs.html#agents)
- [skills.sh: supported agents and their skill folders](https://github.com/vercel-labs/skills/blob/main/docs/agents.md)

Checked on 30 October 2026. Agents change their settings often; if a step no longer matches, tell us at the support address.

### Other agents

- [Claude Code](https://kilobat.app/agents/claude-code.html): Give Claude Code your Mac's network as tools: per-app traffic, Wi-Fi, DNS, why a host fails and keep-awake.
- [Codex CLI](https://kilobat.app/agents/codex.html): Codex can check the network before a big download, find why its own request hangs and keep the Mac awake for a long task.
- [Cursor](https://kilobat.app/agents/cursor.html): Let Cursor's agent see why a package download hangs, which app is using the connection and whether the network is metered before a big pull.
- [Gemini CLI](https://kilobat.app/agents/gemini-cli.html): Gemini CLI can diagnose the Mac's network, scan Wi-Fi and keep the Mac awake while it works.
- [Claude Desktop](https://kilobat.app/agents/claude-desktop.html): Ask Claude why the Wi-Fi is slow, what used your hotspot data or whether your VPN carries everything, and it reads the answer from your Mac.
- [Windsurf](https://kilobat.app/agents/windsurf.html): Cascade can find why a dependency won't download, check DNS and trace a route from your Mac, with Kilobat's MCP server.
- [Cline](https://kilobat.app/agents/cline.html): Cline can check the Mac's network and keep it awake while it works.
- [Zed](https://kilobat.app/agents/zed.html): Zed's agent can measure the Mac's network, trace a route and compare DNS resolvers through Kilobat's MCP server.

---

Source: https://kilobat.app/agents/windsurf.html

Agent setup

## Set up Kilobat in Windsurf

Cascade can find why a dependency won't download, check DNS and trace a route from your Mac, with Kilobat's MCP server.

Free CLI and MCP server · macOS 14 or later · Checked: 30 October 2026

### Install the CLI

The Kilobat CLI is free and open source, and it includes the MCP server. Install it with Homebrew:

```
brew install seifip/kilobat/kilobat
```

Check it with `kilobat --version`. `kilobat doctor` says whether the Kilobat app is running, its network filter is on and Pro is active; the tools work without the app, which adds Wi-Fi names, history and rule enforcement. The CLI needs macOS 14 or later.

### Connect the MCP server

1. In Cascade, open the MCP menu and choose Open MCP config file. Current builds keep it at `~/.config/devin/mcp_config.json`; older Windsurf builds use `~/.codeium/windsurf/mcp_config.json`.
2. Add Kilobat under `mcpServers`:

   ```
   {
     "mcpServers": {
       "kilobat": {
         "command": "kilobat",
         "args": [
           "mcp"
         ]
       }
     }
   }
   ```
3. Press the refresh button in the MCP menu. Kilobat's tools appear in Cascade.

The newer Devin Local agent in the same app reads Devin CLI's config instead: `devin mcp add -s user kilobat -- kilobat mcp`.

An app opened from the Dock doesn't always see the PATH your shell uses. If the server doesn't start, replace `kilobat` with the full path that `command -v kilobat` prints: `/opt/homebrew/bin/kilobat` on Apple silicon, `/usr/local/bin/kilobat` on Intel.

### Add the skills

Nine Agent Skills teach the agent to read Kilobat's measurements and to ask before changing settings. Install them for all your projects with [skills.sh](https://skills.sh/seifip/kilobat-skills):

```
npx skills add seifip/kilobat-skills -g -a windsurf
```

This puts them in `~/.codeium/windsurf/skills/`. Leave out `-g` to install them for the current project only, or leave out both flags to pick agents from a list.

The `kilobat` skill is the entry point: it holds the setup and safety rules and sends the agent to the skill that fits, such as `mac-network-troubleshooting` or `mac-agent-runs`. See [all nine skills](https://kilobat.app/docs.html#network-troubleshooting-skill).

### Try these prompts

Ask in plain words. The agent picks the tools; these are the ones each request usually needs.

| Ask | MCP tools |
|---|---|
| npm install hangs on registry.npmjs.org. Find the layer that fails. | `diagnose_connection` |
| The internet feels slow. Find out why and tell me what to fix first. | `diagnose_network`, `get_status` |
| I'm about to pull a 6 GB Docker image. Is now a good time, or am I on a metered network? | `get_conditions` |
| Pages are slow to start loading. Compare DNS resolvers and tell me if switching would help. Don't change anything yet. | `benchmark_dns`, `diagnose_network` |
| Trace the route to github.com three times and tell me where the delay starts. | `trace_route`, `get_route_history` |
| Something is uploading a lot. Which app is it, and how much has it sent in the last hour? | `get_status`, `get_app_bandwidth` |

### What Windsurf can and can't change

Kilobat's MCP server marks every tool as read-only or as a change, and each change tool's description tells the agent to get your confirmation first. The [kilobat skill](https://github.com/seifip/kilobat-skills/tree/main/skills/kilobat) holds the same rule: read freely, ask before changing.

#### Runs without asking

- Measure Wi-Fi, router, internet and DNS latency, and per-app traffic: `diagnose_network`, `get_status`, `get_wifi`, `scan_wifi`.
- Find the layer that stops one host, trace a route and compare resolvers: `diagnose_connection`, `trace_route`, `benchmark_dns`.
- Read history, sessions, rules and approvals: `get_usage_report`, `list_sessions`, `list_rules`, `list_approvals`.
- Ping for latency spikes with `run_stutter_test`, which sends pings only.

#### Asks you first

- A speed test, which uses up to 80 MB (`run_speedtest`; on a metered network, 10 MB or less), and a five-second LAN test (`run_lan_test`).
- Looking up your public IP with Cloudflare (`get_exit_path` with `public_ip`).
- Profiles, app rules, blocked hosts, the new-app mode, budgets, quotas, a network's data cost and pausing updaters (`set_profile`, `set_app_rule`, `block_destination`, `set_new_app_mode`, `set_budget`, `set_app_quota`, `set_network_cost`, `set_updater_pause`).
- DNS, which macOS also guards with an administrator password prompt (`set_dns`).
- Keeping the Mac running with the lid closed, every time (`keep_awake` with `lid_closed`). A plain `keep_awake` changes no settings and ends when it expires.

#### Can't do

- Let a waiting app connect on its own: `decide_approval` can block at once, but allowing opens Kilobat's approval window for you to confirm.
- Change AirDrop visibility: `set_airdrop_visibility` opens System Settings for you.
- Change sleep settings, another app's settings, or anything outside Kilobat. It never reads prompts or replies.
- Enforce rules without the Kilobat app and its network filter (Pro). Without them, rules are saved, not applied, and the agent should say so.

Keep Cascade's tool confirmations on for Kilobat's change tools.

If the agent can also run shell commands, the `kilobat` CLI can do what the MCP tools do. The skills tell it which commands to run freely and which to ask about.

### Track agent runs

Windsurf has no hook setup in Kilobat yet. Without hooks, Kilobat goes by an agent's traffic and CPU, so a quiet run may be done or waiting for you. An agent with its own hooks can call `kilobat agent-event start|working|waiting|done|failed --agent <name> --session <id> --cwd <folder>`; the command prints nothing and always exits 0. Add `--verbose` to see what happened when you try it by hand. See [Connect agents](https://kilobat.app/docs.html#connect-agents) in the docs.

### Sources

- [Windsurf docs: Cascade MCP configuration](https://docs.devin.ai/windsurf/plugins/cascade/mcp)
- [Devin docs: MCP configuration](https://docs.devin.ai/cli/extensibility/mcp/configuration)
- [Kilobat docs: AI agents and MCP](https://kilobat.app/docs.html#agents)
- [skills.sh: supported agents and their skill folders](https://github.com/vercel-labs/skills/blob/main/docs/agents.md)

Checked on 30 October 2026. Agents change their settings often; if a step no longer matches, tell us at the support address.

### Other agents

- [Claude Code](https://kilobat.app/agents/claude-code.html): Give Claude Code your Mac's network as tools: per-app traffic, Wi-Fi, DNS, why a host fails and keep-awake.
- [Codex CLI](https://kilobat.app/agents/codex.html): Codex can check the network before a big download, find why its own request hangs and keep the Mac awake for a long task.
- [Cursor](https://kilobat.app/agents/cursor.html): Let Cursor's agent see why a package download hangs, which app is using the connection and whether the network is metered before a big pull.
- [Gemini CLI](https://kilobat.app/agents/gemini-cli.html): Gemini CLI can diagnose the Mac's network, scan Wi-Fi and keep the Mac awake while it works.
- [Claude Desktop](https://kilobat.app/agents/claude-desktop.html): Ask Claude why the Wi-Fi is slow, what used your hotspot data or whether your VPN carries everything, and it reads the answer from your Mac.
- [Cline](https://kilobat.app/agents/cline.html): Cline can check the Mac's network and keep it awake while it works.
- [Zed](https://kilobat.app/agents/zed.html): Zed's agent can measure the Mac's network, trace a route and compare DNS resolvers through Kilobat's MCP server.
- [Any MCP client](https://kilobat.app/agents/mcp-client.html): Kilobat's MCP server is a local stdio command, kilobat mcp.

---

Source: https://kilobat.app/agents/zed.html

Agent setup

## Set up Kilobat in Zed

Zed's agent can measure the Mac's network, trace a route and compare DNS resolvers through Kilobat's MCP server.

Free CLI and MCP server · macOS 14 or later · Checked: 30 October 2026

### Install the CLI

The Kilobat CLI is free and open source, and it includes the MCP server. Install it with Homebrew:

```
brew install seifip/kilobat/kilobat
```

Check it with `kilobat --version`. `kilobat doctor` says whether the Kilobat app is running, its network filter is on and Pro is active; the tools work without the app, which adds Wi-Fi names, history and rule enforcement. The CLI needs macOS 14 or later.

### Connect the MCP server

1. Run `zed: open settings file` from the command palette, or add a server in Settings › AI › MCP Servers.
2. Add Kilobat under `context_servers`:

   ```
   {
     "context_servers": {
       "kilobat": {
         "command": "kilobat",
         "args": [
           "mcp"
         ],
         "env": {}
       }
     }
   }
   ```
3. Open the Agent Panel and ask a network question. If Kilobat's tools don't appear, run `zed: open log` to see why the server didn't start.

An app opened from the Dock doesn't always see the PATH your shell uses. If the server doesn't start, replace `kilobat` with the full path that `command -v kilobat` prints: `/opt/homebrew/bin/kilobat` on Apple silicon, `/usr/local/bin/kilobat` on Intel.

### Add the skills

Nine Agent Skills teach the agent to read Kilobat's measurements and to ask before changing settings. Install them for all your projects with [skills.sh](https://skills.sh/seifip/kilobat-skills):

```
npx skills add seifip/kilobat-skills -g -a zed
```

This puts them in `~/.agents/skills/`. Leave out `-g` to install them for the current project only, or leave out both flags to pick agents from a list.

The `kilobat` skill is the entry point: it holds the setup and safety rules and sends the agent to the skill that fits, such as `mac-network-troubleshooting` or `mac-agent-runs`. See [all nine skills](https://kilobat.app/docs.html#network-troubleshooting-skill).

### Try these prompts

Ask in plain words. The agent picks the tools; these are the ones each request usually needs.

| Ask | MCP tools |
|---|---|
| The internet feels slow. Find out why and tell me what to fix first. | `diagnose_network`, `get_status` |
| npm install hangs on registry.npmjs.org. Find the layer that fails. | `diagnose_connection` |
| Does my VPN carry all my traffic, or only some of it? | `get_exit_path` |
| Trace the route to github.com three times and tell me where the delay starts. | `trace_route`, `get_route_history` |
| Pages are slow to start loading. Compare DNS resolvers and tell me if switching would help. Don't change anything yet. | `benchmark_dns`, `diagnose_network` |
| Run a 10 MB speed test and say whether a video call will hold up. | `run_speedtest` |

### What Zed can and can't change

Kilobat's MCP server marks every tool as read-only or as a change, and each change tool's description tells the agent to get your confirmation first. The [kilobat skill](https://github.com/seifip/kilobat-skills/tree/main/skills/kilobat) holds the same rule: read freely, ask before changing.

#### Runs without asking

- Measure Wi-Fi, router, internet and DNS latency, and per-app traffic: `diagnose_network`, `get_status`, `get_wifi`, `scan_wifi`.
- Find the layer that stops one host, trace a route and compare resolvers: `diagnose_connection`, `trace_route`, `benchmark_dns`.
- Read history, sessions, rules and approvals: `get_usage_report`, `list_sessions`, `list_rules`, `list_approvals`.
- Ping for latency spikes with `run_stutter_test`, which sends pings only.

#### Asks you first

- A speed test, which uses up to 80 MB (`run_speedtest`; on a metered network, 10 MB or less), and a five-second LAN test (`run_lan_test`).
- Looking up your public IP with Cloudflare (`get_exit_path` with `public_ip`).
- Profiles, app rules, blocked hosts, the new-app mode, budgets, quotas, a network's data cost and pausing updaters (`set_profile`, `set_app_rule`, `block_destination`, `set_new_app_mode`, `set_budget`, `set_app_quota`, `set_network_cost`, `set_updater_pause`).
- DNS, which macOS also guards with an administrator password prompt (`set_dns`).
- Keeping the Mac running with the lid closed, every time (`keep_awake` with `lid_closed`). A plain `keep_awake` changes no settings and ends when it expires.

#### Can't do

- Let a waiting app connect on its own: `decide_approval` can block at once, but allowing opens Kilobat's approval window for you to confirm.
- Change AirDrop visibility: `set_airdrop_visibility` opens System Settings for you.
- Change sleep settings, another app's settings, or anything outside Kilobat. It never reads prompts or replies.
- Enforce rules without the Kilobat app and its network filter (Pro). Without them, rules are saved, not applied, and the agent should say so.

Keep `agent.tool_permissions.default` at `confirm`, or add per-tool rules for Kilobat's change tools, keyed like `mcp:kilobat:set_dns`.

If the agent can also run shell commands, the `kilobat` CLI can do what the MCP tools do. The skills tell it which commands to run freely and which to ask about.

### Track agent runs

Zed has no hook setup in Kilobat yet. Without hooks, Kilobat goes by an agent's traffic and CPU, so a quiet run may be done or waiting for you. An agent with its own hooks can call `kilobat agent-event start|working|waiting|done|failed --agent <name> --session <id> --cwd <folder>`; the command prints nothing and always exits 0. Add `--verbose` to see what happened when you try it by hand. See [Connect agents](https://kilobat.app/docs.html#connect-agents) in the docs.

### Sources

- [Zed docs: Model Context Protocol](https://zed.dev/docs/ai/mcp)
- [Kilobat docs: AI agents and MCP](https://kilobat.app/docs.html#agents)
- [skills.sh: supported agents and their skill folders](https://github.com/vercel-labs/skills/blob/main/docs/agents.md)

Checked on 30 October 2026. Agents change their settings often; if a step no longer matches, tell us at the support address.

### Other agents

- [Claude Code](https://kilobat.app/agents/claude-code.html): Give Claude Code your Mac's network as tools: per-app traffic, Wi-Fi, DNS, why a host fails and keep-awake.
- [Codex CLI](https://kilobat.app/agents/codex.html): Codex can check the network before a big download, find why its own request hangs and keep the Mac awake for a long task.
- [Cursor](https://kilobat.app/agents/cursor.html): Let Cursor's agent see why a package download hangs, which app is using the connection and whether the network is metered before a big pull.
- [Gemini CLI](https://kilobat.app/agents/gemini-cli.html): Gemini CLI can diagnose the Mac's network, scan Wi-Fi and keep the Mac awake while it works.
- [Claude Desktop](https://kilobat.app/agents/claude-desktop.html): Ask Claude why the Wi-Fi is slow, what used your hotspot data or whether your VPN carries everything, and it reads the answer from your Mac.
- [Windsurf](https://kilobat.app/agents/windsurf.html): Cascade can find why a dependency won't download, check DNS and trace a route from your Mac, with Kilobat's MCP server.
- [Cline](https://kilobat.app/agents/cline.html): Cline can check the Mac's network and keep it awake while it works.
- [Any MCP client](https://kilobat.app/agents/mcp-client.html): Kilobat's MCP server is a local stdio command, kilobat mcp.

---

Source: https://kilobat.app/guides/recipes/agent-lid-closed.html

Recipe

## Keep an agent running with the lid closed

Closing the lid puts a Mac laptop to sleep. Kilobat has an opt-in helper that keeps a working agent run going with the lid closed.

Kilobat 1.3 or later · You approve a helper in System Settings · Checked: 29 October 2026

### In the app

1. Open Settings in Kilobat and find Awake & agents.
2. Turn on Allow running with the lid closed.
3. When macOS asks, approve Kilobat’s power helper in System Settings > General > Login Items.
4. Set Longest with the lid closed. The limit is 8 hours.
5. Set the battery level at which the Mac sleeps. The default is 20%.
6. Turn on Keep the Mac awake while AI agents work.
7. For an awake session, open the teacup menu and choose With the Lid Closed Too.

### With the CLI

1. Make sure that the setting is on and see the current hold.

   ```
   kilobat conditions --json
   ```

   Output `lidClosedAllowed` and `lidHold`, with the battery level and heat state under `power`.
2. Keep running with the lid closed for two hours.

   ```
   kilobat awake --lid-closed --for 2h
   ```
3. Keep running with the lid closed while one command runs. The hold ends with the command.

   ```
   kilobat awake --lid-closed -- npm test
   ```

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `get_conditions` | Shows `lidClosedAllowed` and `lidHold`. |
| `keep_awake` `{"minutes": 120, "reason": "Agent run", "lid_closed": true}` | Keeps the Mac running with the lid closed. The tool tells the agent to get your confirmation each time. |
| `release_awake` | Ends the hold. |

### Good to know

- A closed Mac in a bag can become hot, and its battery can go flat. Connect the power adapter if you can.
- The helper lets the Mac sleep at your battery floor, when it is hot, after the time limit, and one minute after Kilobat quits.
- An agent that waits for you holds the lid for 30 minutes at most. This needs Keep awake while an agent waits for you.
- If the helper or the Mac restarts while it holds the lid, the helper puts the setting back first.

### Questions

**Can I do this without Kilobat?**

macOS keeps a laptop awake with the lid closed in closed-display mode, with an external display and power. See [Keep a Mac laptop working with the lid closed](https://kilobat.app/guides/clamshell-lid-closed-mac.html).

**Does an agent need its hooks for this?**

No. Kilobat sees agents by their traffic. Hooks tell it when a run waits or is done. See [Tell Kilobat when an agent waits or is done](https://kilobat.app/guides/recipes/connect-agent-hooks.html).

### Sources

- [Kilobat docs: Running with the lid closed](https://kilobat.app/docs.html#lid-closed)
- [Kilobat skill: mac-agent-runs](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-agent-runs)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Keep a Mac laptop working with the lid closed](https://kilobat.app/guides/clamshell-lid-closed-mac.html): Closing the lid puts a Mac laptop to sleep.
- [Tell Kilobat when an agent waits or is done](https://kilobat.app/guides/recipes/connect-agent-hooks.html): Without hooks, Kilobat sees an agent only by its traffic and CPU.
- [Keep your Mac awake until a download finishes](https://kilobat.app/guides/recipes/keep-mac-awake-download.html): Kilobat keeps the Mac awake while transfers run.
- [Check the network before a big download in an agent](https://kilobat.app/guides/recipes/check-network-before-download.html): An agent can ask Kilobat if now is a good time for a large transfer.

---

Source: https://kilobat.app/guides/recipes/approve-new-apps.html

Recipe

## Get approvals for new apps

In Ask mode, Kilobat holds the first connections of an app that has no rule. It shows who signed the app and where it wants to go.

Needs Kilobat Pro in the app · Needs the network filter and the running app · Checked: 29 October 2026

### In the app

1. Switch to the Travel or Work profile. Unrestricted allows every app.
2. Click the pill above the app list and choose Ask about new apps.
3. To let macOS services and Apple apps through, turn on Allow Apple Software.
4. When a new app connects, read its signer, its path and its destinations in the window.
5. Click Allow This App or Block This App. Use More allow options for Allow for 1 Hour.

### With the CLI

1. Ask about new apps.

   ```
   kilobat settings new-apps ask
   ```
2. Let Apple software through.

   ```
   kilobat settings apple-software on
   ```
3. List the apps that wait.

   ```
   kilobat approvals
   ```

   Output Each app with its process, path, signer, whether the signature is valid, and its destinations.
4. Block a waiting app at once.

   ```
   kilobat deny com.example.App
   ```
5. Ask to allow a waiting app. Kilobat opens its window, and you confirm there.

   ```
   kilobat approve com.example.App
   ```

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `set_new_app_mode` `{"mode": "ask", "allow_apple": "on"}` | How Travel and Work treat apps that have no rule. |
| `list_approvals` | The apps that wait, with signer and destinations. |
| `decide_approval` `{"app": "com.example.App", "decision": "block"}` | Blocks at once. `allow` only opens the window for you to confirm. |

### Good to know

- Connections that get no answer stop after one minute. The app asks again later.
- If Kilobat is not running, new apps are allowed, not held.
- Your blocklist and connection rules apply in every mode.
- Do not allow an app with Signature not valid, or an app that you do not know.

### Sources

- [Kilobat docs: New apps: allow, ask or block](https://kilobat.app/docs.html#new-apps)
- [Kilobat skill: mac-app-firewall](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-app-firewall)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Block an app on metered networks](https://kilobat.app/guides/recipes/block-app-on-metered.html): The Travel profile allows only the apps that you choose.
- [Little Snitch, LuLu and other network extensions conflict on a Mac](https://kilobat.app/guides/network-extension-conflicts.html): Firewalls, VPNs and content filters on macOS use network extensions.
- [A content filter blocks websites on a Mac](https://kilobat.app/guides/content-filter-blocking.html): A content filter examines web traffic and blocks some sites.
- [See where your apps connect](https://kilobat.app/guides/recipes/see-where-apps-connect.html): Kilobat shows the open connections of each app and the country where each address is registered.

---

Source: https://kilobat.app/guides/recipes/block-app-on-metered.html

Recipe

## Block an app on metered networks

The Travel profile allows only the apps that you choose. Kilobat can switch to it on its own when the network is metered.

Needs Kilobat Pro in the app · Blocking needs the network filter · Checked: 29 October 2026

### In the app

1. Set up filtering in Kilobat. Approve the extension and the content filter when macOS asks.
2. Open Settings and turn on Switch to Travel on metered networks.
3. If macOS does not flag the network, open the Wi-Fi menu and set Data cost to Metered.
4. In the app list, click an app's switch to allow or block it in the active profile.

### With the CLI

1. Make sure that the app is running and the filter is on.

   ```
   kilobat doctor
   ```
2. Allow the apps that you need in Travel before you switch.

   ```
   kilobat allow com.tinyspeck.slackmacgap --profile travel
   ```
3. Block one app in Travel.

   ```
   kilobat block com.getdropbox.dropbox --profile travel
   ```
4. Block an app for two hours only.

   ```
   kilobat block com.getdropbox.dropbox --minutes 120
   ```
5. Turn on the automatic switch to Travel.

   ```
   kilobat settings auto-travel on
   ```
6. Mark a network as metered by its name, for example an Android hotspot.

   ```
   kilobat networks cost metered "Pixel hotspot"
   ```
7. Read the Travel rules.

   ```
   kilobat rules --profile travel
   ```

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `set_network_cost` `{"cost": "metered", "network": "Pixel hotspot"}` | Treat that network as metered. |
| `set_app_rule` `{"app": "com.getdropbox.dropbox", "action": "block", "profile": "travel"}` | Save a block rule. Add `minutes` for a temporary rule. |
| `list_rules` `{"profile": "travel"}` | The saved rules and whether apps without a rule are allowed. |

### Good to know

- Without the filter, rules are saved but nothing is blocked.
- Filtering affects new connections. A connection that is open can continue until it reconnects.
- macOS flags an iPhone hotspot as metered, but not every Android hotspot or USB tethering.
- When you leave the metered network, Kilobat brings back your previous profile.

### Sources

- [Kilobat docs: Hotspots and data cost](https://kilobat.app/docs.html#data-cost)
- [Kilobat docs: Blocking and filtering](https://kilobat.app/docs.html#filtering)
- [Kilobat skill: mac-hotspot-data-saver](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-hotspot-data-saver)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Make a Mac treat a network as metered](https://kilobat.app/guides/metered-network-mac.html): macOS marks some connections as expensive, such as an iPhone Personal Hotspot.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.
- [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html): On a metered network, Kilobat can pause the helpers that download updates.
- [Get approvals for new apps](https://kilobat.app/guides/recipes/approve-new-apps.html): In Ask mode, Kilobat holds the first connections of an app that has no rule.

---

Source: https://kilobat.app/guides/recipes/check-network-before-download.html

Recipe

## Check the network before a big download in an agent

An agent can ask Kilobat if now is a good time for a large transfer. Kilobat answers in about two seconds with one line of advice.

Free in the app and the CLI · Checked: 29 October 2026

### In the app

1. Open the Wi-Fi menu. A metered network shows Connected · metered.
2. To change how Kilobat treats a network, set its Data cost to Automatic, Metered or Unmetered.

### With the CLI

1. Read the conditions as JSON.

   ```
   kilobat conditions --json
   ```

   Output `metered`, `osMetered`, `lowDataMode`, `vpn`, `internetLatencyMs`, `internetLossPercent`, `power` and one line of `advice`, for example “Good conditions: online, unmetered, on power.”
2. If the network is metered, ask the person first. A speed test then uses at most the budget you give.

   ```
   kilobat speedtest --budget-mb 10
   ```
3. Keep the Mac awake while the download runs.

   ```
   kilobat awake -- huggingface-cli download org/model
   ```

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `get_conditions` | Metered, Low Data Mode, VPN, latency, loss, battery and heat, with `advice`. |
| `get_updaters` | Whether updaters are paused on this network now. |
| `run_speedtest` `{"budget_mb": 10}` | Uses data. On a metered network, the agent must ask you first. |
| `keep_awake` `{"minutes": 60, "reason": "Downloading the model"}` | Stops idle sleep during the download. |

### Good to know

- `metered` is what Kilobat acts on. `osMetered` is what macOS says. `meteredSource` is `macOS` or `you`.
- A `null` latency means that the ping got no answer. It does not prove that the internet is down.
- The Kilobat agent skills tell agents to ask before large transfers on metered networks.

### Sources

- [Kilobat docs: AI agents and MCP](https://kilobat.app/docs.html#agents)
- [Kilobat skill: mac-agent-runs](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-agent-runs)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Use Low Data Mode on a Mac](https://kilobat.app/guides/low-data-mode-mac.html): Low Data Mode tells macOS and apps to use less data on one Wi-Fi network.
- [Make a Mac treat a network as metered](https://kilobat.app/guides/metered-network-mac.html): macOS marks some connections as expensive, such as an iPhone Personal Hotspot.
- [Keep your Mac awake until a download finishes](https://kilobat.app/guides/recipes/keep-mac-awake-download.html): Kilobat keeps the Mac awake while transfers run.
- [Homebrew or npm downloads fail on a Mac](https://kilobat.app/guides/homebrew-npm-download-fails.html): Homebrew downloads with curl and Git.

---

Source: https://kilobat.app/guides/recipes/check-vpn-and-public-ip.html

Recipe

## See if traffic goes through your VPN

Kilobat reads the Mac's routes to show whether traffic leaves through a VPN. It asks Cloudflare for your public IP only if you turn that on.

Free in the app and the CLI · Checked: 29 October 2026

### In the app

1. Open the dashboard and click the Health tab. Find Where traffic leaves.
2. Read the interface and the VPN state. Split means that a VPN is connected but only some traffic uses it.
3. To see your public IP, select Look up public IP. Kilobat then asks Cloudflare on network changes and every 30 minutes.
4. To show the VPN state next to the bat, open Settings › Menu bar and select VPN.
5. The History tab lists when a VPN went on or off, and when the public IP changed.

### With the CLI

1. Show where traffic leaves. Nothing leaves your Mac for this.

   ```
   kilobat ip
   ```

   Output For example: `Traffic leaves through utun3 (WireGuard)`.
2. Also ask Cloudflare for your public IP and its registry country.

   ```
   kilobat ip --public
   ```
3. Show the VPN state in the menu bar.

   ```
   kilobat settings menu-bar vpn
   ```

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `get_exit_path` | Returns `interface`, `vpn` (full, partial or off) and `vpnName`. Nothing is sent anywhere. |
| `get_exit_path` `{"public_ip": true}` | Also returns `publicIP` and `publicIPCountry`. This contacts Cloudflare. |

### Good to know

- The country is where the address is registered, from DB-IP data in the app. It is not where you or the server are.
- A VPN or an exit country does not show that your connection is private or anonymous.
- Cloudflare sees the lookup request, as any website that you visit would.
- With a system proxy, the public IP is the address of the proxy.
- If macOS lists several VPNs as connected, Kilobat does not guess which one carries the route.

### Sources

- [Kilobat docs: VPN and public IP](https://kilobat.app/docs.html#vpn)
- [Kilobat skill: mac-network-troubleshooting](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-network-troubleshooting)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet.html): A VPN sends traffic through a tunnel.
- [Tailscale and another VPN conflict on a Mac](https://kilobat.app/guides/tailscale-vpn-routing-conflicts.html): Tailscale gives each device an address in 100.64.0.0/10.
- [DNS queries go outside the VPN on a Mac](https://kilobat.app/guides/vpn-dns-leak-mac.html): With a VPN on, you usually want DNS queries to go to the VPN's servers.
- [Limit IP address tracking on a Mac](https://kilobat.app/guides/limit-ip-address-tracking.html): Limit IP address tracking is a setting for each network.

---

Source: https://kilobat.app/guides/recipes/compare-carrier-usage.html

Recipe

## Compare Kilobat with your carrier's data figure

Your carrier and Kilobat count different things. Kilobat puts the two figures side by side for the same period and lists the likely reasons for the difference.

CLI and MCP: free · In the app: History needs Kilobat Pro · Checked: 29 October 2026

### In the app

1. Open the dashboard and click the History tab.
2. Find Compare with your router or provider.
3. Enter the Router or provider figure as they show it, with its Unit.
4. Set What the figure counts: download, upload or both.
5. Set the Period and the Network that the figure covers.
6. Read the Difference, the Recorded strip with its gaps, and the Likely reasons.
7. To share the result, click Export CSV… or Export JSON…

### With the CLI

1. Compare a 3.2 GB figure for this month on one network.

   ```
   kilobat report compare --total 3.2GB --period this-month --network "My iPhone"
   ```

   Output Kilobat's total in the same unit, the difference, the hours it recorded, each gap and the likely reasons.
2. Give exact dates. A date-only `--to` includes that day.

   ```
   kilobat report compare --total 40 --unit GiB --from 2026-10-01 --to 2026-10-31
   ```
3. Export the comparison to send to your provider.

   ```
   kilobat report compare --total 40GB --period last-month --csv
   ```

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `compare_usage` `{"total": 3.2, "unit": "GB", "period": "this-month", "network": "My iPhone"}` | Kilobat's bytes in the same unit, `differenceBytes`, `gaps` and plain `reasons`. |

### Good to know

- Kilobat sees only this Mac, and only while the app runs. A router or provider total is usually higher.
- Many providers write GB for 1,073,741,824 bytes (GiB). Kilobat also reads the figure in the other unit.
- Kilobat does not say which figure is correct.

### Questions

**Why is the gap so large?**

Common reasons are the phone's own use and other devices on the hotspot. Hours when the Mac slept or Kilobat did not run also count, and so does GB against GiB.

### Sources

- [Kilobat docs: Comparing with your router or provider](https://kilobat.app/docs.html#compare)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Set a monthly data budget that resets on renewal day](https://kilobat.app/guides/recipes/monthly-data-budget.html): A Kilobat budget belongs to one network.
- [See which app uses data on a hotspot](https://kilobat.app/guides/recipes/hotspot-data-by-app.html): Kilobat shows the upload and download of each app on your Mac.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.

---

Source: https://kilobat.app/guides/recipes/compare-speed-tests.html

Recipe

## Find out why two speed tests differ

Two speed tests can disagree for many reasons. Kilobat keeps the conditions of each test, so you can see what changed between them.

Speed test: free · Comparison in History: Kilobat Pro · kilobat speed-compare: free · Checked: 29 October 2026

### In the app

1. Open the dashboard and click the Speed tab.
2. Next to the Start test button, choose 1 connection or 4 connections.
3. Click Start test. Then choose the other option and click Test again.
4. Click the History tab. Under Speed-test comparison, choose the two tests to compare.
5. Read each difference and its note. The note says how it can change the result.

### With the CLI

1. Run a test with one connection.

   ```
   kilobat speedtest
   ```
2. Run a test with four connections at once, as most speed-test sites do.

   ```
   kilobat speedtest --parallel
   ```
3. Compare the two newest tests that the app saved.

   ```
   kilobat speed-compare
   ```

   Output The download and upload change, then one line for each difference, such as `vpn: Off → WireGuard`, with a note.
4. Compare two older tests. Number 1 is the newest.

   ```
   kilobat speed-compare 3 1
   ```

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `run_speedtest` `{"parallel": true, "budget_mb": 80}` | Returns the speed with `streams`, `server`, `context` and `method`. |
| `compare_speed_tests` | Returns `differences`, each with a `note`, and `unknown` for conditions an older test did not keep. |

### Good to know

- Kilobat lists differences. It does not prove which one caused the change.
- Other devices on your network share the connection. Kilobat cannot see their traffic.
- Tests that earlier versions of Kilobat saved do not have the server, the link or the VPN. Kilobat says so.
- A test with four connections usually shows more on a fast or distant link. Neither number is wrong.
- Each test uses up to 80 MB. On a hotspot, use `--budget-mb 10`.

### Sources

- [Kilobat docs: Why speed tests disagree](https://kilobat.app/docs.html#speed-tests)
- [Kilobat skill: mac-network-troubleshooting](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-network-troubleshooting)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Test internet speed from Terminal with networkQuality](https://kilobat.app/guides/networkquality-speed-test.html): macOS includes networkQuality, a command-line test.
- [Bufferbloat: calls lag when the network is busy](https://kilobat.app/guides/bufferbloat-mac.html): Bufferbloat is latency that network devices add when they hold too much data in their buffers.
- [Wi-Fi is slow on the Mac but fast on the phone](https://kilobat.app/guides/slow-wifi-mac-fast-phone.html): When the phone is fast on the same network, the internet connection is not the problem.
- [Test for call stutter](https://kilobat.app/guides/recipes/test-call-stutter.html): A speed test averages its pings, so short spikes disappear.

---

Source: https://kilobat.app/guides/recipes/connect-agent-hooks.html

Recipe

## Tell Kilobat when an agent waits or is done

Without hooks, Kilobat sees an agent only by its traffic and CPU. Hooks tell it the project, and when a run waits for you or is done.

Free in the app and the CLI · Checked: 29 October 2026

### In the app

1. Open Settings and find Awake & agents.
2. Turn on Keep the Mac awake while AI agents work.
3. Look at the session strip in the popover. Each agent run shows as a chip with its state.

### With the CLI

1. For Claude Code, add a command hook to `~/.claude/settings.json` under SessionStart, UserPromptSubmit, Notification, Stop, StopFailure and SessionEnd.

   ```
   kilobat agent-event --agent claude --stdin-json
   ```
2. For Codex, add this line to `~/.codex/config.toml`. It reports done only.

   ```
   notify = ["kilobat", "agent-event", "done", "--agent", "codex", "--json-arg"]
   ```
3. For Cline, install the Kilobat plugin.

   ```
   cline plugin install https://kilobat.app/agents/cline/kilobat.ts
   ```
4. Test a hook by hand. `--verbose` says what happened.

   ```
   kilobat agent-event start --agent claude --verbose
   ```
5. Read the recorded runs.

   ```
   kilobat sessions --days 1
   ```

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `list_sessions` `{"days": 1}` | Runs with `project`, `state` (working, waitingForYou, done, stalled, networkFailed or failed) and the data used. |

### Good to know

- `kilobat agent-event` prints nothing and always exits 0, so it cannot break the agent.
- If the app is not running, the events wait in a small file that the app reads when it opens.
- Kilobat reads session IDs, folders and short status text. It never reads prompts or replies.
- Merge these hooks with the hooks that you already have.

### Sources

- [Kilobat docs: Connect agents](https://kilobat.app/docs.html#connect-agents)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Keep an agent running with the lid closed](https://kilobat.app/guides/recipes/agent-lid-closed.html): Closing the lid puts a Mac laptop to sleep.
- [Keep your Mac awake until a download finishes](https://kilobat.app/guides/recipes/keep-mac-awake-download.html): Kilobat keeps the Mac awake while transfers run.
- [Check the network before a big download in an agent](https://kilobat.app/guides/recipes/check-network-before-download.html): An agent can ask Kilobat if now is a good time for a large transfer.

---

Source: https://kilobat.app/guides/recipes/find-better-wifi-spot.html

Recipe

## Find a better Wi-Fi spot

The signal radar scores your Wi-Fi several times a second. Walk a few steps and stop, and it tells you if the signal gets better.

Radar in the app: Kilobat Pro · CLI: free · Checked: 29 October 2026

### In the app

1. Open the Wi-Fi menu and click Find a better spot. You can also open the Radar tab.
2. Walk a few steps with the Mac, then stop for a moment.
3. Read the score. The radar tells you when an earlier spot was stronger.
4. Save a good spot with a name, such as Kitchen, to compare rooms later.

### With the CLI

1. Run the radar in Terminal and walk around. To stop, type q and press Return.

   ```
   kilobat radar --watch
   ```
2. Take one reading at each spot.

   ```
   kilobat radar --json
   ```

   Output `score`, `signalNoiseRatio` and the radio values.
3. Save the current reading with a name.

   ```
   kilobat spots save "Kitchen"
   ```
4. List the saved spots.

   ```
   kilobat spots
   ```
5. Find the least crowded channel for your router.

   ```
   kilobat channels
   ```

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `get_wifi` | The current link: RSSI, noise, SNR, channel, band, link rate and a 0–100 score. |
| `scan_wifi` | Nearby networks with signal, channel, band and width. |
| `suggest_wifi_channel` | The least crowded channel in the current band. |

### Good to know

- The radar measures signal strength. It does not show direction or distance.
- A difference of less than about 10 points is noise.
- macOS shows Wi-Fi names only to apps with Location access. Allow it for Kilobat to see network names.
- A stronger signal does not always give faster internet. Run a diagnosis too.

### Sources

- [Kilobat Wi-Fi analyzer page](https://kilobat.app/wifi-analyzer-mac.html)
- [Kilobat skill: mac-wifi-troubleshooting](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-wifi-troubleshooting)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Weak Wi-Fi signal on a Mac](https://kilobat.app/guides/weak-wifi-signal-mac.html): Signal strength and noise decide how fast and how stable the Wi-Fi link is.
- [Crowded Wi-Fi channels near your Mac](https://kilobat.app/guides/wifi-channel-congestion.html): Networks on the same channel share the air time.
- [Wi-Fi is slow on the Mac but fast on the phone](https://kilobat.app/guides/slow-wifi-mac-fast-phone.html): When the phone is fast on the same network, the internet connection is not the problem.
- [2.4 GHz, 5 GHz and 6 GHz Wi-Fi on a Mac](https://kilobat.app/guides/wifi-bands-2-4-5-6-ghz.html): Wi-Fi uses three bands.

---

Source: https://kilobat.app/guides/recipes/hotspot-data-by-app.html

Recipe

## See which app uses data on a hotspot

Kilobat shows the upload and download of each app on your Mac. Use it on a hotspot to find the app that uses your data.

Live traffic: free · History by app: Kilobat Pro in the app · Checked: 29 October 2026

### In the app

1. Click the Kilobat item in the menu bar. The Overview tab opens.
2. Read Download and Upload at the top. They show the current rate for the whole Mac.
3. Look at the app list below. It sorts the apps by the data they used in this session.
4. Click an app's row. Its panel shows a sentence about what it moved and its last five minutes.
5. With Pro, choose hour, day, week or month in the panel to see the history of that app.
6. Expand the System downloads row to see services such as `nsurlsessiond` and `softwareupdated`. With the network filter on, a row can say which app a download was for.

### With the CLI

1. Install the CLI. It is free and open source.

   ```
   brew install seifip/kilobat/kilobat
   ```
2. Show live traffic by app. Press `s` to sort, `f` to filter, `/` to search and `q` to quit.

   ```
   kilobat status --watch
   ```
3. Get one snapshot as JSON for a script.

   ```
   kilobat status --json
   ```

   Output Each app has `id`, `name`, its rates, `sessionBytes`, `internetBytes`, `localBytes` and `tunnelBytes`.
4. Show the totals and the top apps for today. Use `--days 7` to compare with a normal week.

   ```
   kilobat report --summary --days 1
   ```

   Output Internet download and upload totals, then up to 10 apps by bytes.
5. Show one app over one day, with its peak.

   ```
   kilobat bandwidth "Google Chrome" day
   ```

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `get_status` | Per-app traffic now, whether the network is metered, and the active profile. |
| `get_usage_report` `{"days": 1}` | Totals per day and the top 10 apps. |
| `get_app_bandwidth` `{"app": "Google Chrome", "range": "day"}` | One app's sent and received bytes in buckets, with the peak. |

### Good to know

- Only Internet traffic uses your plan. Kilobat shows local network and AirDrop traffic apart and does not count it.
- Kilobat records history only while the app runs. A gap does not prove that nothing used data.
- Uploads count too. A photo library sync can use more data than web pages.

### Questions

**Does Kilobat see the data that my phone uses?**

No. Kilobat sees only the traffic of this Mac. The phone and other devices on the hotspot are not in its figures.

**Can I do this without Kilobat?**

Yes. Activity Monitor and `nettop` show network use by process. See [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html).

### Sources

- [Kilobat docs: Bandwidth per app](https://kilobat.app/docs.html#bandwidth)
- [Kilobat docs: What counts](https://kilobat.app/docs.html#what-counts)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.
- [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html): On a metered network, Kilobat can pause the helpers that download updates.
- [Set a monthly data budget that resets on renewal day](https://kilobat.app/guides/recipes/monthly-data-budget.html): A Kilobat budget belongs to one network.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.

---

Source: https://kilobat.app/guides/recipes/keep-mac-awake-download.html

Recipe

## Keep your Mac awake until a download finishes

Kilobat keeps the Mac awake while transfers run. When the traffic stays low for some minutes, it lets the Mac sleep again.

Free in the app and the CLI · Checked: 29 October 2026

### In the app

1. Click the Kilobat item in the menu bar.
2. Click the teacup at the top of the popover.
3. Choose Until Downloads Finish. You can also choose For 1 Hour or Until I Turn It Off.
4. To follow one app, right-click its row in the app list and choose Keep Mac Awake Until It Finishes.
5. To stop early, open the teacup menu and choose Turn Off.

### With the CLI

1. Stay awake until the traffic of the Mac stays below 16 KB/s for 3 minutes.

   ```
   kilobat awake --until-quiet
   ```
2. Follow one app only, with its `id` from `kilobat status --json`.

   ```
   kilobat awake --until-quiet --app com.apple.Safari
   ```
3. Stay awake for a fixed time.

   ```
   kilobat awake --for 2h
   ```
4. Stay awake while one command runs. Kilobat then reports the data that the command moved.

   ```
   kilobat awake -- curl -O https://example.com/big.iso
   ```

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `keep_awake` `{"minutes": 120, "reason": "Downloading the model"}` | Stops idle sleep for that time. It changes no settings. |
| `release_awake` | Ends the hold early. |
| `list_sessions` `{"days": 1}` | Awake sessions with the data used and the network changes. |

### Good to know

- Closing the lid still puts the Mac to sleep. See [Keep an agent running with the lid closed](https://kilobat.app/guides/recipes/agent-lid-closed.html).
- Each awake session goes into History with the data moved and the battery used.
- The built-in `caffeinate` command also stops sleep. See [Keep a Mac awake from Terminal with caffeinate](https://kilobat.app/guides/caffeinate-keep-mac-awake.html).

### Sources

- [Kilobat docs: Commands, Awake and agents](https://kilobat.app/docs.html#commands)
- [Kilobat changelog 1.1](https://kilobat.app/changelog.html)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Keep a Mac awake from Terminal with caffeinate](https://kilobat.app/guides/caffeinate-keep-mac-awake.html): The caffeinate command stops a Mac from sleeping while a task runs.
- [Mac sleep stops downloads](https://kilobat.app/guides/mac-sleep-stops-downloads.html): A Mac that goes to sleep stops most app activity, so a long download can stop or fail.
- [Keep an agent running with the lid closed](https://kilobat.app/guides/recipes/agent-lid-closed.html): Closing the lid puts a Mac laptop to sleep.
- [Check the network before a big download in an agent](https://kilobat.app/guides/recipes/check-network-before-download.html): An agent can ask Kilobat if now is a good time for a large transfer.

---

Source: https://kilobat.app/guides/recipes/monthly-data-budget.html

Recipe

## Set a monthly data budget that resets on renewal day

A Kilobat budget belongs to one network. It can start over daily, weekly, or monthly on the day your plan renews.

Needs Kilobat Pro in the app · Stopping new connections needs the network filter · Checked: 29 October 2026

### In the app

1. Join the network that has the data plan.
2. Open Settings in Kilobat and find Data budget.
3. Set the budget for this network in GB.
4. Set Starts over to Monthly. Then set Day of the month to the day your plan renews.
5. Under Alerts, click 50%, 80% or 100% to get a notification once per cycle.
6. To limit one app, click its row in the app list and click Set a quota…

### With the CLI

1. Set a 30 GB budget that starts over on day 14 of each month, with three alerts.

   ```
   kilobat limit 30 --cycle monthly --reset-day 14 --alert 50,80,100
   ```
2. Read the budget and the use in this cycle.

   ```
   kilobat limit
   ```

   Output For example: `Budget: 20 GB · Until reset`, then the use in this cycle and the alerts.
3. Limit the uploads of one app to 2 GB per cycle.

   ```
   kilobat quota com.getdropbox.dropbox 2 --upload
   ```
4. List the app quotas and their use.

   ```
   kilobat quota --list
   ```

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `set_budget` `{"gb": 30, "cycle": "monthly", "reset_day": 14, "alerts": "50,80,100"}` | Set the current network's budget and when it starts over. |
| `set_app_quota` `{"app": "com.getdropbox.dropbox", "gb": 2, "direction": "upload"}` | Limit one app per budget cycle. |
| `list_rules` | The `budget` with `usedBytes` and when it `resets`, and the app `quotas`. |

### Good to know

- If your plan renews on the 31st, the budget starts on the last day of shorter months.
- With filtering on, new connections stop when the budget is used up in Travel and Work. Unrestricted only tracks it.
- Kilobat samples traffic every second. An app can go a little over before it stops.
- The budget counts Internet traffic only. Local network and AirDrop traffic do not count.

### Questions

**Does the budget continue after a restart?**

Yes. A budget with a cycle counts the usage history of that network.

**My carrier shows a different total. Which is right?**

Kilobat sees only this Mac. Compare the same period with [Compare Kilobat with your carrier's data figure](https://kilobat.app/guides/recipes/compare-carrier-usage.html).

### Sources

- [Kilobat docs: Data budgets and app quotas](https://kilobat.app/docs.html#budgets)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Compare Kilobat with your carrier's data figure](https://kilobat.app/guides/recipes/compare-carrier-usage.html): Your carrier and Kilobat count different things.
- [See which app uses data on a hotspot](https://kilobat.app/guides/recipes/hotspot-data-by-app.html): Kilobat shows the upload and download of each app on your Mac.
- [Block an app on metered networks](https://kilobat.app/guides/recipes/block-app-on-metered.html): The Travel profile allows only the apps that you choose.
- [Make a Mac treat a network as metered](https://kilobat.app/guides/metered-network-mac.html): macOS marks some connections as expensive, such as an iPhone Personal Hotspot.

---

Source: https://kilobat.app/guides/recipes/pick-faster-dns.html

Recipe

## Pick a faster DNS

Slow DNS makes every new site slow to start. Kilobat measures your resolver against Cloudflare, Google and Quad9 before you change anything.

CLI: free · In the app: switching DNS needs Kilobat Pro. Automatic stays free. · Checked: 29 October 2026

### In the app

1. Open the dashboard and click the Health tab. The DNS panel shows the lookup time and the resolvers in use.
2. Write down the resolvers, so that you can restore them.
3. To compare, open the Tools tab and run Resolver benchmark. This needs Pro.
4. Click Cloudflare, Google or Quad9 to switch. macOS asks for an administrator password.
5. If nothing gets better, click Automatic. It restores the DNS that the network gives.

### With the CLI

1. Show the current resolvers.

   ```
   kilobat dns
   ```
2. Compare resolvers. Run it twice before you decide.

   ```
   kilobat dns-benchmark
   ```

   Output JSON with each `resolver`, its `milliseconds` and its `replies` out of 3.
3. Switch to Quad9.

   ```
   kilobat dns quad9
   ```

   Needs an administrator password.
4. Return to the DNS of the network.

   ```
   kilobat dns automatic
   ```

   Needs an administrator password.
5. Clear the DNS cache after a site moved.

   ```
   kilobat dns flush
   ```

   Needs an administrator password.

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `benchmark_dns` | Lookup times through the system resolver, Cloudflare, Google and Quad9. |
| `set_dns` `{"provider": "quad9"}` | Sets DNS for the active network service. macOS asks for a password. `flush` clears the cache. |
| `diagnose_network` | Includes the DNS lookup time and the resolvers. |

### Good to know

- Treat a resolver as faster only if it wins twice by about 20 ms or more.
- Company networks and VPNs often need their own DNS for internal names. Ask your administrator before you change it.
- A custom resolver can stop hotel and café login pages from appearing.

### Sources

- [Kilobat skill: mac-dns-troubleshooting](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-dns-troubleshooting)
- [Kilobat docs: Commands](https://kilobat.app/docs.html#commands)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Slow DNS on a Mac](https://kilobat.app/guides/slow-dns-mac.html): Every new site needs a DNS lookup before it can load.
- [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html): macOS keeps DNS answers for some time.
- [Use encrypted DNS on a Mac](https://kilobat.app/guides/encrypted-dns-mac.html): Normal DNS queries are not encrypted.
- [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html): Public networks often hold all traffic until you sign in on a login page.

---

Source: https://kilobat.app/guides/recipes/see-where-apps-connect.html

Recipe

## See where your apps connect

Kilobat shows the open connections of each app and the country where each address is registered.

Connections globe: Kilobat Pro · CLI: free · Checked: 29 October 2026

### In the app

1. Open the dashboard and click the Connections tab. This needs Pro.
2. Read the busiest countries in the list. Click a country to filter the connections.
3. Click an app's row in the app list. Its panel shows its open connections with data and country.
4. Right-click a connection to block that host for the app or for every app. Blocking needs the network filter.

### With the CLI

1. List the open sockets of every process.

   ```
   kilobat destinations
   ```

   Output Each socket with its process ID, process, transport, local and remote address, and state.
2. List the sockets of one process.

   ```
   kilobat destinations --pid 4242
   ```
3. Read what an app's developer says it connects to.

   ```
   kilobat access-policy com.raycast.macos
   ```
4. Block a host for one app.

   ```
   kilobat block-host ads.example.com --app com.example.App
   ```

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `list_connections` `{"pid": 4242}` | Open sockets, for one process or all. |
| `get_access_policy` `{"app": "com.raycast.macos"}` | The declared connections, their purpose and what breaks if you deny them. |
| `block_destination` `{"target": "ads.example.com", "app": "com.example.App"}` | Blocks a domain, IP or CIDR range for one app or every app. |

### Good to know

- The country comes from the DB-IP database in the app. No address leaves your Mac.
- It is the country where the address is registered. A CDN or VPN address shows its owner's country, not the server's location.
- Check the access policy before you block a domain that an app needs.

### Sources

- [Kilobat docs: Where it connects](https://kilobat.app/docs.html#map)
- [Kilobat docs: Blocking domains and IPs](https://kilobat.app/docs.html#blocklist)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Get approvals for new apps](https://kilobat.app/guides/recipes/approve-new-apps.html): In Ask mode, Kilobat holds the first connections of an app that has no rule.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.
- [See which app uses data on a hotspot](https://kilobat.app/guides/recipes/hotspot-data-by-app.html): Kilobat shows the upload and download of each app on your Mac.

---

Source: https://kilobat.app/guides/recipes/share-wifi-qr-code.html

Recipe

## Share Wi-Fi with a QR code

Kilobat makes a QR code from the saved password of a network. A phone camera can scan it to join.

Free in the app and the CLI · Checked: 29 October 2026

### In the app

1. Open the Kilobat Wi-Fi menu.
2. Click the … button beside your current network, then click Share network…
3. Click Unlock with macOS… and authenticate. The password stays on this Mac.
4. Let the other person scan the code with the phone camera.
5. To send the password as text, click Copy password for 60 seconds.

### With the CLI

1. Show the password and a QR code in Terminal. macOS asks first.

   ```
   kilobat wifi share "Home"
   ```
2. Show only the saved password.

   ```
   kilobat wifi password "Home"
   ```
3. List the saved networks in order of preference.

   ```
   kilobat wifi known
   ```

### Good to know

- The QR code contains your network password. Show it only to people that you trust.
- There is no MCP tool for Wi-Fi passwords. An agent cannot read them.
- An open network needs no password, so Kilobat shows no code.

### Questions

**Can I do this without Kilobat?**

Yes. macOS can show saved Wi-Fi passwords and share them with nearby Apple devices. See [Find a saved Wi-Fi password on a Mac](https://kilobat.app/guides/find-saved-wifi-password.html).

### Sources

- [Kilobat changelog 1.0 and CLI 0.2](https://kilobat.app/changelog.html)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Find a saved Wi-Fi password on a Mac](https://kilobat.app/guides/find-saved-wifi-password.html): The Mac stores the password of each Wi-Fi network that it joins.
- [Mac joins the wrong Wi-Fi network](https://kilobat.app/guides/mac-joins-wrong-wifi.html): The Mac joins known networks on its own.
- [Find a better Wi-Fi spot](https://kilobat.app/guides/recipes/find-better-wifi-spot.html): The signal radar scores your Wi-Fi several times a second.

---

Source: https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html

Recipe

## Stop updates from using hotspot data

On a metered network, Kilobat can pause the helpers that download updates. The apps keep working, and the updates continue on your usual network.

Needs Kilobat Pro in the app · Blocking needs the network filter · Checked: 29 October 2026

### In the app

1. Make sure that Kilobat treats the network as metered. macOS flags an iPhone hotspot. For other networks, open the Wi-Fi menu and set Data cost to Metered.
2. Open the dashboard and click the Health tab.
3. Find Pause updaters. Turn on On metered networks. It is on by default.
4. Click What’s covered and what got through. The list shows the covered helpers and the update bytes that got through on this network.
5. Read the apps under Sparkle and Squirrel. These apps update from inside the app, so Kilobat cannot pause them separately.

### With the CLI

1. Mark the current network as metered, if macOS does not.

   ```
   kilobat networks cost metered
   ```
2. Show the updater report.

   ```
   kilobat updaters
   ```

   Output The `covered` helpers, the update bytes that got through (`gotThrough`), connections paused in the last 24 hours and the `inProcess` apps.
3. Turn pausing on. It is on by default.

   ```
   kilobat updaters on
   ```
4. To let one update through, allow its helper for a short time.

   ```
   kilobat allow com.google.GoogleUpdater --minutes 30
   ```

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `get_updaters` | The covered helpers, what got through, and whether updaters are paused now. |
| `set_network_cost` `{"cost": "metered"}` | Treat the current network as metered. |
| `set_updater_pause` `{"pause": "on"}` | Pause updater helpers on metered networks. |

### Good to know

- Kilobat covers Google Updater and Keystone, Microsoft AutoUpdate, `softwareupdated`, App Store downloads, and the Sparkle and Squirrel helpers.
- The filter stops new connections. A download that started before the network became metered can finish.
- Kilobat changes no setting in other apps or in System Settings. There is nothing to restore.
- The Unrestricted profile pauses nothing.

### Questions

**Why does an app still update on the hotspot?**

Many apps that use Sparkle or Electron download the update inside the app. Turn off automatic updates in that app, or block the app for a while.

**How do I stop macOS updates without Kilobat?**

Change the Software Update settings in macOS. See [Stop Software Update downloading on a hotspot](https://kilobat.app/guides/software-update-on-hotspot.html).

### Sources

- [Kilobat docs: Pausing updaters on metered networks](https://kilobat.app/docs.html#updaters)
- [Kilobat docs: Hotspots and data cost](https://kilobat.app/docs.html#data-cost)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Stop Software Update downloading on a hotspot](https://kilobat.app/guides/software-update-on-hotspot.html): macOS can download updates on its own.
- [Make a Mac treat a network as metered](https://kilobat.app/guides/metered-network-mac.html): macOS marks some connections as expensive, such as an iPhone Personal Hotspot.
- [See which app uses data on a hotspot](https://kilobat.app/guides/recipes/hotspot-data-by-app.html): Kilobat shows the upload and download of each app on your Mac.
- [Block an app on metered networks](https://kilobat.app/guides/recipes/block-app-on-metered.html): The Travel profile allows only the apps that you choose.
- [What is GoogleUpdater on Mac?](https://kilobat.app/guides/what-is-googleupdater.html): GoogleUpdater updates Chrome and other Google apps in the background.

---

Source: https://kilobat.app/guides/recipes/test-call-stutter.html

Recipe

## Test for call stutter

A speed test averages its pings, so short spikes disappear. The stutter test pings every 50 ms and shows each spike.

Stutter test: free · Compare with low-latency on: Kilobat Pro · Checked: 29 October 2026

### In the app

1. Open the dashboard and click the Health tab.
2. Find Stutter test and click Run test. It pings your router every 50 ms for 20 seconds.
3. Read the Median, the Spikes and the Worst ping. Spikes show in rose.
4. If the spikes repeat at a regular interval, click Compare with low-latency on. This needs Pro.
5. In the Wi-Fi menu, choose Show Bluetooth devices. A tag marks devices that share 2.4 GHz with your Wi-Fi.

### With the CLI

1. Run the test against your router.

   ```
   kilobat stutter
   ```

   Output p50, p95, p99 and the worst ping, the spikes with their times, the `pattern` and a verdict.
2. Run it against the internet to see if the spikes start beyond your router.

   ```
   kilobat stutter --target internet --seconds 60
   ```
3. Pause AirDrop and AWDL for one hour during the call. macOS asks for an administrator.

   ```
   kilobat low-latency on --for 1h
   ```

   Needs an administrator password.
4. Restore AirDrop and AWDL.

   ```
   kilobat low-latency off
   ```

   Needs an administrator password.
5. List Bluetooth devices that share 2.4 GHz with Wi-Fi.

   ```
   kilobat bluetooth
   ```

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `run_stutter_test` `{"seconds": 20, "target": "router"}` | Sends pings only. Returns `latencyMs`, `spikes`, `periodSeconds`, `pattern` and a `verdict`. |
| `get_nearby_radios` | Whether the AirDrop link is active and what uses it, and Bluetooth devices that share the band. |

### Good to know

- Regular spikes on the router test often come from AWDL, the link that AirDrop uses. Other causes can look the same, so test before you decide.
- Many routers answer only about ten pings a second. Kilobat marks this as `pingRateLimited`, not as real loss.
- There is no MCP tool for the low-latency pause. Run it in your own Terminal.

### Sources

- [Kilobat docs: Stutter test](https://kilobat.app/docs.html#stutter)
- [Kilobat skill: video-call-network-check](https://github.com/seifip/kilobat-skills/tree/main/skills/video-call-network-check)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Video calls stutter or freeze on a Mac](https://kilobat.app/guides/video-call-stutter-mac.html): Calls need steady latency and steady upload more than high speed.
- [AirDrop, AWDL and latency spikes in games and calls](https://kilobat.app/guides/awdl-airdrop-latency-spikes.html): AWDL is the Apple Wireless Direct Link.
- [Bluetooth headphones and Wi-Fi interference on a Mac](https://kilobat.app/guides/bluetooth-wifi-interference.html): Bluetooth and 2.4 GHz Wi-Fi use the same radio band.
- [Bufferbloat: calls lag when the network is busy](https://kilobat.app/guides/bufferbloat-mac.html): Bufferbloat is latency that network devices add when they hold too much data in their buffers.

---

Source: https://kilobat.app/guides/recipes/why-cant-it-connect.html

Recipe

## Find why one site or API won't connect

When the internet works but one address fails, Kilobat checks each layer in turn. It names the layer that failed and what to do next.

Free in the app and the CLI · Checked: 29 October 2026

### In the app

1. Open the dashboard and click the Health tab.
2. Find Why can’t it connect?.
3. Paste the exact address that fails into the field, for example `github.com` or a full URL.
4. Pick the app, if one app has the problem. Kilobat then checks its own proxy and open connections too.
5. Click Check. Read the layer that failed and the next step.

### With the CLI

1. Check one host.

   ```
   kilobat why api.example.com
   ```

   Output Each layer with ok, warning, failed or skipped, then a verdict and the next step. The command exits with 1 when a layer failed.
2. Check the exact URL that one app uses. The output hides query values.

   ```
   kilobat why https://example.com/file.zip --app com.example.App
   ```
3. Test through the proxy address that the app sets in its own settings.

   ```
   kilobat why https://huggingface.co --proxy http://127.0.0.1:7890
   ```
4. Tell Kilobat when the code runs in a container, a VM or on a remote machine.

   ```
   kilobat why db.internal --context container
   ```
5. Record when the app failed beside the time of the check.

   ```
   kilobat why api.example.com --failed-at 14:05
   ```

### Through MCP

Connect the MCP server once with `claude mcp add kilobat -- kilobat mcp`. For other clients, see [the docs](https://kilobat.app/docs.html#agents). Then an agent can call these tools. Tools that change settings tell the agent to ask you first.

| Tool and arguments | What it does |
|---|---|
| `diagnose_connection` `{"target": "https://api.example.com/v1/models", "app": "process:node"}` | Returns `verdict`, `next` and the `steps`, each with `layer`, `status` and `detail`. |

### Good to know

- The check runs inside Kilobat, not through `curl`. A strict Kilobat profile cannot block the check itself.
- It tests IPv4 and IPv6 separately. A broken IPv6 path gets its own verdict.
- A passing check means that this request works from this Mac over that path now. It cannot see a transfer that is already in progress.

### Questions

**What does --context provider do?**

Use it when a hosted service makes the request from its own servers. A private address such as `localhost` works from your Mac, but those servers cannot reach it.

### Sources

- [Kilobat docs: When something can't connect](https://kilobat.app/docs.html#why)
- [Kilobat skill: mac-network-troubleshooting](https://github.com/seifip/kilobat-skills/tree/main/skills/mac-network-troubleshooting)
- [Kilobat llms.txt: CLI and MCP reference](https://kilobat.app/llms.txt)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [A website works on your phone but not on your Mac](https://kilobat.app/guides/site-works-on-phone-not-mac.html): When a site opens on your phone but not on your Mac, the problem is usually on the Mac.
- [Proxy settings stop apps from connecting on a Mac](https://kilobat.app/guides/proxy-settings-breaking-apps.html): A proxy setting sends traffic through another server.
- [IPv6 problems on a Mac](https://kilobat.app/guides/ipv6-problems-mac.html): Most networks give a Mac both IPv4 and IPv6 addresses.
- [A container cannot reach localhost on the Mac](https://kilobat.app/guides/localhost-from-container.html): Each container has its own network stack.

---

Source: https://kilobat.app/guides/airplay-receiver-port-5000.html

Developers

## Port 5000 or 7000 is in use on a Mac: AirPlay Receiver

Apple lists TCP ports 5000 and 7000 for AirPlay. When AirPlay Receiver is on, a dev server cannot use these ports.

Applies to: macOS 12 Monterey and later. The setting is in General > AirDrop & Handoff, or AirDrop & Continuity in newer versions. · Checked: 29 October 2026

### Symptoms

- A Flask or other dev server on port 5000 stops with “address already in use”.
- `lsof` shows `ControlCenter` on port 5000 or 7000.
- `curl localhost:5000` returns a reply that is not from your app.

### Likely causes

- **AirPlay Receiver.** AirPlay Receiver lets other Apple devices stream to the Mac. Apple lists ports 5000 and 7000 for AirPlay.
- **Another server.** If the process is not ControlCenter, another app uses the port. See [Port already in use on a Mac](https://kilobat.app/guides/port-already-in-use.html).

### How to check

1. Find the process on port 5000.

   ```
   lsof -nP -iTCP:5000 -sTCP:LISTEN
   ```

   Output A line with `ControlCenter` in the COMMAND column means AirPlay Receiver.
2. Find the process on port 7000.

   ```
   lsof -nP -iTCP:7000 -sTCP:LISTEN
   ```

### How to fix it

1. The easiest fix is to use another port for your dev server, such as 5001 or 8000.
2. To free the ports, choose Apple menu > System Settings > General > AirDrop & Handoff. Newer versions call it AirDrop & Continuity.
3. Turn off AirPlay Receiver.
4. On macOS 12, the setting is in System Preferences > Sharing > AirPlay Receiver.
5. Run lsof again to make sure that the port is free.

   ```
   lsof -nP -iTCP:5000 -sTCP:LISTEN
   ```

### Questions

**Can I keep AirPlay Receiver on?**

Yes. Run your server on another port. You need to turn off AirPlay Receiver only if the app must use port 5000 or 7000.

**Why does the server work on Linux on port 5000?**

AirPlay Receiver is a macOS feature. Other systems do not use this port for it.

### Sources

- [Apple Support: TCP and UDP ports used by Apple software products](https://support.apple.com/en-us/103229)
- [Apple Support: Change AirDrop & Continuity settings on Mac](https://support.apple.com/guide/mac-help/mchl6a407f99/mac)
- lsof(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Port already in use on a Mac](https://kilobat.app/guides/port-already-in-use.html): Only one process can listen on a TCP port and address.
- [Cannot reach a Docker container from the Mac](https://kilobat.app/guides/docker-container-from-mac.html): Docker on a Mac runs containers in a Linux virtual machine.
- [A container cannot reach localhost on the Mac](https://kilobat.app/guides/localhost-from-container.html): Each container has its own network stack.
- [An app cannot find devices on the local network](https://kilobat.app/guides/local-network-permission.html): macOS 15 Sequoia and later ask before an app connects to devices on your local network.

---

Source: https://kilobat.app/guides/awdl-airdrop-latency-spikes.html

Wi-Fi

## AirDrop, AWDL and latency spikes in games and calls

AWDL is the Apple Wireless Direct Link. AirDrop, Sidecar and Universal Control use it. It shares the Wi-Fi radio with your network, so test it when games or calls stutter.

Applies to: All current macOS versions. The AirDrop settings path is for macOS 13 Ventura and later. · Checked: 29 October 2026

### Symptoms

- Pings to the router are low most of the time, with short high spikes.
- Game streaming or remote desktops freeze for a moment, again and again.
- Speed tests show good results, but calls still stutter.

### Likely causes

- **The radio serves two networks.** Research on AWDL shows that the radio switches between AWDL and the access point channel at set times.
- **Features that use AWDL.** AirDrop, Sidecar, Universal Control and other Continuity features use the AWDL link.
- **Other causes look the same.** Interference, a weak signal and a busy network also cause spikes. Apple does not document an effect of AWDL on latency, so test it.

### How to check

1. Show the state of the AWDL interface.

   ```
   ifconfig awdl0
   ```

   Output A line such as `status: active` or `status: inactive`.
2. Find the address of your router.

   ```
   route -n get default
   ```
3. Ping the router 100 times. Look for replies that are much slower than the others.

   ```
   ping -c 100 192.168.1.1
   ```
4. Write down the slowest replies and the times between them.

### How to fix it

1. Turn off features you do not need now, such as Sidecar or Universal Control.
2. To set who can send you items with AirDrop, choose System Settings > General > AirDrop & Continuity.
3. In earlier macOS versions, this pane is AirDrop & Handoff.
4. For a test, turn off the AWDL interface. This stops AirDrop, Sidecar and Universal Control.

   ```
   sudo ifconfig awdl0 down
   ```

   Needs an administrator password.
5. Ping the router again and compare the results.
6. Turn the interface on again when the test is complete.

   ```
   sudo ifconfig awdl0 up
   ```

   Needs an administrator password.
7. If the spikes stay with AWDL off, look for interference or a weak signal. See [Bluetooth headphones and Wi-Fi interference on a Mac](https://kilobat.app/guides/bluetooth-wifi-interference.html).

### With Kilobat

1. Run a stutter test. It pings the router every 50 ms for 20 seconds and finds spikes that repeat.

   ```
   kilobat stutter
   ```
2. Show the AWDL link, what uses it and the AirDrop visibility.

   ```
   kilobat airdrop
   ```
3. Pause AWDL for 15 minutes, then run the stutter test again. macOS asks for an administrator password.

   ```
   kilobat low-latency on --for 15m
   ```
4. Restore AWDL before the time ends, if necessary.

   ```
   kilobat low-latency off
   ```
5. In the app, the Wi-Fi menu has Pause for calls and games. The pause in the app is part of Kilobat Pro. The CLI is free.
6. See the full steps in [Test for call stutter](https://kilobat.app/guides/recipes/test-call-stutter.html).

### Questions

**Does setting AirDrop to receive from nobody stop AWDL?**

No. The visibility setting controls who can send to you. Other features can still use the link.

**Is it safe to turn off awdl0?**

Yes, for a test. AirDrop, Sidecar and Universal Control stop until you turn it on again or restart the Mac.

### Sources

- [Stute, Kreitschmann and Hollick: One Billion Apples' Secret Sauce, the AWDL protocol (MobiCom 2018)](https://arxiv.org/abs/1808.03156)
- [Apple Support: Change AirDrop & Continuity settings on Mac](https://support.apple.com/guide/mac-help/mchl6a407f99/mac)
- ifconfig(8), ping(8) and route(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Test for call stutter](https://kilobat.app/guides/recipes/test-call-stutter.html): A speed test averages its pings, so short spikes disappear.
- [Video calls stutter or freeze on a Mac](https://kilobat.app/guides/video-call-stutter-mac.html): Calls need steady latency and steady upload more than high speed.
- [Bluetooth headphones and Wi-Fi interference on a Mac](https://kilobat.app/guides/bluetooth-wifi-interference.html): Bluetooth and 2.4 GHz Wi-Fi use the same radio band.
- [Test for packet loss on a Mac with ping](https://kilobat.app/guides/packet-loss-mac.html): Packet loss makes calls break up and pages stall.

---

Source: https://kilobat.app/guides/bluetooth-wifi-interference.html

Wi-Fi

## Bluetooth headphones and Wi-Fi interference on a Mac

Bluetooth and 2.4 GHz Wi-Fi use the same radio band. When both are busy, Wi-Fi can slow down and Bluetooth audio can skip.

Applies to: All current macOS versions. The System Settings steps are for macOS 13 Ventura and later. · Checked: 29 October 2026

### Symptoms

- Bluetooth audio skips, stutters, cuts off or has static.
- Wi-Fi becomes slow when you connect Bluetooth headphones.
- The mouse or trackpad pointer moves in jumps.
- The problem is worse near USB 3 drives or hubs.

### Likely causes

- **Shared 2.4 GHz band.** Apple says that both Bluetooth and Wi-Fi devices use the 2.4 GHz band.
- **USB 3 and Thunderbolt 3 devices.** Apple says that these devices and their hubs can interfere with nearby wireless devices.
- **Distance and obstacles.** Bluetooth devices far from the Mac, or behind metal, need more retries.
- **Other sources.** Apple lists power cables, microwave ovens, fluorescent lights, wireless video cameras and cordless phones.

### How to check

1. Hold the Option key and click the Wi-Fi icon. Make sure of the band of the network.
2. If the band is 2.4 GHz, interference with Bluetooth is possible.
3. List the connected Bluetooth devices.

   ```
   system_profiler SPBluetoothDataType
   ```
4. Disconnect the Bluetooth device for a test. If Wi-Fi becomes faster, interference is likely.

### How to fix it

1. Connect the Mac to a 5 GHz network, if the router has one. Apple suggests moving more Wi-Fi devices to 5 GHz.
2. Bring the Bluetooth device closer to the Mac.
3. Use a shielded USB or Thunderbolt 3 cable for each device.
4. Move USB 3 and Thunderbolt 3 devices and hubs away from the Mac. Do not put them on top of the Mac.
5. Turn off USB 3 devices that you do not use.
6. On the router, set 2.4 GHz to a channel width of 20 MHz. Apple recommends this to reduce interference.

### With Kilobat

1. List the Bluetooth devices, and show which share 2.4 GHz with the Wi-Fi.

   ```
   kilobat bluetooth
   ```
2. In the Kilobat Wi-Fi menu, choose Show Bluetooth devices. A 2.4 GHz tag marks devices that share the band.
3. The menu then offers a shortcut to a known 5 GHz network.
4. To measure short latency spikes, see [Test for call stutter](https://kilobat.app/guides/recipes/test-call-stutter.html).

### Questions

**Does 5 GHz Wi-Fi remove all Bluetooth interference?**

It removes the shared band. Distance, obstacles and USB 3 noise can still affect Bluetooth.

**Do AirPods count?**

Yes. All Bluetooth audio devices use the 2.4 GHz band.

### Sources

- [Apple Support: Resolve Wi-Fi and Bluetooth issues caused by wireless interference](https://support.apple.com/en-us/102319)
- [Apple Support: Recommended settings for Wi-Fi routers and access points](https://support.apple.com/en-us/102766)
- system_profiler(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [2.4 GHz, 5 GHz and 6 GHz Wi-Fi on a Mac](https://kilobat.app/guides/wifi-bands-2-4-5-6-ghz.html): Wi-Fi uses three bands.
- [AirDrop, AWDL and latency spikes in games and calls](https://kilobat.app/guides/awdl-airdrop-latency-spikes.html): AWDL is the Apple Wireless Direct Link.
- [Video calls stutter or freeze on a Mac](https://kilobat.app/guides/video-call-stutter-mac.html): Calls need steady latency and steady upload more than high speed.
- [Test for call stutter](https://kilobat.app/guides/recipes/test-call-stutter.html): A speed test averages its pings, so short spikes disappear.

---

Source: https://kilobat.app/guides/bufferbloat-mac.html

Websites and speed

## Bufferbloat: calls lag when the network is busy

Bufferbloat is latency that network devices add when they hold too much data in their buffers. Calls and games lag while the network is busy.

Applies to: All current macOS versions. `networkQuality` needs macOS 12 Monterey or later. · Checked: 29 October 2026

### Symptoms

- Calls freeze or audio breaks up while a backup or upload runs.
- Games lag when another device downloads.
- Pages load slowly during large transfers, but the speed test is fast.

### Likely causes

- **Large buffers in the router or modem.** When the link is full, packets wait in a long queue. Each wait adds latency.
- **Uploads that fill the link.** Upload capacity is often much smaller than download capacity, so an upload fills it quickly.
- **No queue management on the router.** Smart queue management can keep queues short. Not all routers have it, or it is off.

### How to check

1. Run `networkQuality` while nothing else uses the network. Write down the responsiveness.

   ```
   networkQuality
   ```
2. Start a large upload or download on another device. Run the test again.

   ```
   networkQuality
   ```
3. Compare the two results. A large drop in responsiveness under load shows bufferbloat.
4. For a simple test, ping a server while the upload runs. Watch the times rise.

   ```
   ping 1.1.1.1
   ```
5. Press Control-C to stop `ping`.

### How to fix it

1. Open the settings of your router. Look for SQM, smart queue management or a similar QoS setting.
2. If the router has it, turn it on. Follow the instructions of the router maker for the speed values.
3. If the router does not have it, schedule large uploads and backups for times when you do not make calls.
4. Pause cloud sync during important calls.
5. Ask your provider whether the modem or router supports queue management.

### With Kilobat

1. Kilobat's speed test reports latency under load. It rates bufferbloat as Low, Moderate, High or Inconclusive.

   ```
   kilobat speedtest --json
   ```

   Output `addedLatencyMs` and `bufferbloat`, with verdicts for calls and streaming.
2. Under 15 ms of added latency is Low. Under 60 ms is Moderate. 60 ms or more is High.
3. To find the app that uploads, sort live traffic by upload.

   ```
   kilobat status --watch
   ```
4. With Pro and the network filter, you can block an app for the length of a call. See [Test for call stutter](https://kilobat.app/guides/recipes/test-call-stutter.html).

### Questions

**Is bufferbloat a problem with my Mac?**

Usually no. The large buffers are in the router, the modem or the provider's network. The Mac only shows the effect.

**Does a faster plan fix bufferbloat?**

Not always. More capacity can help, but queues can still fill when a transfer uses the full link.

### Sources

- [Bufferbloat.net: Introduction](https://www.bufferbloat.net/projects/bloat/wiki/Introduction/)
- [Apple Support: Test Wi-Fi networks with Apple Network Responsiveness](https://support.apple.com/en-us/101942)
- networkQuality(8), man page installed with macOS 27.2
- ping(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Test internet speed from Terminal with networkQuality](https://kilobat.app/guides/networkquality-speed-test.html): macOS includes networkQuality, a command-line test.
- [Video calls stutter or freeze on a Mac](https://kilobat.app/guides/video-call-stutter-mac.html): Calls need steady latency and steady upload more than high speed.
- [Slow internet on a Mac: find which part is slow](https://kilobat.app/guides/slow-internet-mac-cause.html): A slow connection has many possible causes.
- [Test for call stutter](https://kilobat.app/guides/recipes/test-call-stutter.html): A speed test averages its pings, so short spikes disappear.

---

Source: https://kilobat.app/guides/caffeinate-keep-mac-awake.html

Sleep and power

## Keep a Mac awake from Terminal with caffeinate

The `caffeinate` command stops a Mac from sleeping while a task runs. It is part of macOS and changes no settings.

Applies to: All current macOS versions. The System Settings paths are for macOS 13 Ventura and later. · Checked: 29 October 2026

### Symptoms

- A download, build or script stops when the Mac goes to sleep.
- A remote session or SSH connection drops after some minutes with no input.
- You want the Mac to stay awake for one task, but you do not want to change the sleep settings.

### Likely causes

- **Idle sleep.** macOS puts the Mac to sleep after a time with no keyboard or mouse input. Network activity alone does not always stop this.
- **Display sleep.** The display turns off on its own timer. On some Macs, the system then sleeps too.
- **The lid.** Closing the lid of a Mac laptop puts it to sleep. `caffeinate` does not change this. See [Keep a Mac laptop working with the lid closed](https://kilobat.app/guides/clamshell-lid-closed-mac.html).

### How to check

1. Open Terminal. See which processes now prevent sleep.

   ```
   pmset -g assertions
   ```

   Output A list of assertions such as `PreventUserIdleSystemSleep`, with the process that holds each one.
2. See the sleep settings that are in use now.

   ```
   pmset -g
   ```

### How to fix it

1. To keep the Mac awake while one command runs, put `caffeinate -i` before the command. The assertion stops when the command stops.

   ```
   caffeinate -i make
   ```
2. To keep the Mac awake for a fixed time, give the time in seconds with `-t`. This example is two hours.

   ```
   caffeinate -i -t 7200
   ```
3. To keep the Mac awake until a process stops, give its process ID with `-w`.

   ```
   caffeinate -i -w 12345
   ```
4. To keep the display on too, add `-d`.

   ```
   caffeinate -d -i
   ```
5. To stop `caffeinate` that you started with no command, press Control-C.
6. To stop automatic sleep while the display is off, change the setting. On a Mac laptop, choose Apple menu > System Settings > Battery > Options. Turn on “Prevent automatic sleeping on power adapter when the display is off”.
7. On a Mac desktop, choose Apple menu > System Settings > Energy. Turn on “Prevent automatic sleeping when the display is off”.

### With Kilobat

1. Kilobat can keep the Mac awake until a download goes quiet, then let it sleep. Open Kilobat from the menu bar. Click the teacup and choose Until Downloads Finish.
2. The CLI does the same. It stops after 3 minutes below 16 KB/s.

   ```
   kilobat awake --until-quiet
   ```
3. To keep the Mac awake while one command runs, and to see the data it moved, use `awake --`.

   ```
   kilobat awake -- make release
   ```
4. These features are free. See [the recipe](https://kilobat.app/guides/recipes/keep-mac-awake-download.html) for the app, CLI and MCP steps.

### Questions

**Does caffeinate keep the Mac awake with the lid closed?**

No. `caffeinate` stops idle sleep. Closing the lid still puts a Mac laptop to sleep, unless the Mac uses an external display, keyboard and power. See [Keep a Mac laptop working with the lid closed](https://kilobat.app/guides/clamshell-lid-closed-mac.html).

**What does the -s option do?**

`-s` stops system sleep. The man page says that it works only when the Mac is on AC power.

**Does caffeinate change my settings?**

No. It creates power assertions. They stop when `caffeinate` stops.

### Sources

- caffeinate(8), man page installed with macOS 27.2
- pmset(1), man page installed with macOS 27.2
- [Apple Support: Set sleep and wake settings for your Mac](https://support.apple.com/guide/mac-help/prevent-your-mac-from-sleeping-mchle41a6ccd/mac)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Keep your Mac awake until a download finishes](https://kilobat.app/guides/recipes/keep-mac-awake-download.html): Kilobat keeps the Mac awake while transfers run.
- [Mac sleep stops downloads](https://kilobat.app/guides/mac-sleep-stops-downloads.html): A Mac that goes to sleep stops most app activity, so a long download can stop or fail.
- [Keep a Mac laptop working with the lid closed](https://kilobat.app/guides/clamshell-lid-closed-mac.html): Closing the lid puts a Mac laptop to sleep.

---

Source: https://kilobat.app/guides/captive-portal-not-appearing.html

Public Wi-Fi and privacy

## Wi-Fi login page does not appear on a Mac

Public networks often hold all traffic until you sign in on a login page. macOS finds these pages and opens them. Sometimes it does not, and you must open the page yourself.

Applies to: All current macOS versions. macOS 11 Big Sur and later also read the login page address that a network advertises. · Checked: 29 October 2026

### Symptoms

- The Mac joins the network, but no sign-in window opens.
- Pages do not load, or show a security warning.
- The connection worked, then stopped after some time.

### Likely causes

- **The Mac joined on its own.** When the Mac joins a known network on its own, you can miss the sign-in window.
- **A VPN or custom DNS.** A VPN or another DNS server can stop the network from sending you to its login page.
- **The session expired.** Apple says that when a session ends, the network can show the wrong page or a security warning in Safari.
- **Network setup.** Apple tells network operators to advertise their login page in a standard way. Not all networks do this.

### How to check

1. Hold the Option key and click the Wi-Fi icon. Make sure that you are on the correct network.
2. Show the DNS servers of the Wi-Fi service. A custom server shows here.

   ```
   networksetup -getdnsservers Wi-Fi
   ```

   Output `There aren't any DNS Servers set on Wi-Fi.` means that the Mac uses the network's DNS.
3. Look for a VPN at the top of the service order.

   ```
   networksetup -listnetworkserviceorder
   ```

### How to fix it

1. Turn off the VPN until you are signed in.
2. In a browser, open a page that uses http, not https. For example, open http://captive.apple.com.
3. If the network still does not redirect you, remove custom DNS for a short time.

   ```
   sudo networksetup -setdnsservers Wi-Fi empty
   ```

   Needs an administrator password.
4. Sign in on the login page.
5. Set your DNS servers again after you sign in, if you use custom DNS.
6. If the page still does not appear, forget the network and join it again from the Wi-Fi menu.

### With Kilobat

1. Check for a login page with Kilobat's diagnosis.

   ```
   kilobat diagnose --json
   ```

   Output `measurements.captivePortal` is `true` when the network wants a sign-in.
2. The Kilobat Wi-Fi menu shows Sign-in required. The Health tab shows Open network login page.
3. If you set DNS with Kilobat, return to the network's DNS for the sign-in.

   ```
   kilobat dns automatic
   ```
4. Changing DNS needs an administrator password.

### Questions

**Why do I get a certificate warning instead of the login page?**

The network intercepts the https page and shows its own. Open an http page instead.

**Should I use a VPN on public Wi-Fi?**

A VPN can protect your traffic, but turn it on only after you sign in.

### Sources

- [Apple Developer News: How to modernize your captive network (22 June 2020)](https://developer.apple.com/news/?id=q78sq5rv)
- [Apple Support: If your Mac isn't connecting to the internet over Wi-Fi](https://support.apple.com/en-us/101588)
- networksetup(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Mac connected to Wi-Fi but no internet](https://kilobat.app/guides/wifi-connected-no-internet.html): A Wi-Fi connection is only the link to the router.
- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [Pick a faster DNS](https://kilobat.app/guides/recipes/pick-faster-dns.html): Slow DNS makes every new site slow to start.
- [Private Wi-Fi address on a Mac](https://kilobat.app/guides/private-wifi-address.html): A private Wi-Fi address replaces the hardware MAC address of the Mac on a network.

---

Source: https://kilobat.app/guides/clamshell-lid-closed-mac.html

Sleep and power

## Keep a Mac laptop working with the lid closed

Closing the lid puts a Mac laptop to sleep. With an external display and accessories connected, you can close the lid and continue to use the Mac.

Applies to: Current macOS versions. Apple lists extra needs for two displays on MacBook Air and MacBook Pro with M3. · Checked: 29 October 2026

### Symptoms

- A download or a long task stops when you close the lid.
- The Mac goes to sleep each time you close the lid.
- `caffeinate` keeps the Mac awake, but closing the lid still puts it to sleep.

### Likely causes

- **The lid puts the Mac to sleep.** Apple lists closing the display as one way to put a Mac laptop to sleep.
- **No external display or accessories.** Apple describes lid-closed use with a connected display and accessories.
- **No power.** For two displays with the lid closed on M3 models, Apple lists power from the display or a power adapter.
- **Assertions do not cover the lid.** The `caffeinate` man page describes idle sleep and system sleep. It does not describe the lid.

### How to check

1. Make sure that an external display is connected and shows the desktop.
2. Make sure that an external keyboard and a mouse or trackpad are connected.
3. Make sure that the Mac gets power from the display or from its power adapter.
4. See which processes hold sleep assertions now.

   ```
   pmset -g assertions
   ```

### How to fix it

1. Connect an external keyboard and a mouse or trackpad.
2. Connect the Mac to power.
3. Connect the external display. Wait until it shows the desktop.
4. Close the lid. Continue to work on the external display.
5. Before you close the lid, remove any camera cover, palm rest or keyboard cover from the Mac.
6. If you do not have a display, keep the lid open while the task runs. Use [caffeinate](https://kilobat.app/guides/caffeinate-keep-mac-awake.html) to stop idle sleep.
7. Do not put a Mac that is awake into a bag. The Mac can get hot, and the battery can go flat.

### With Kilobat

1. Kilobat can keep a task running with the lid closed and no display. First, open Kilobat Settings › Awake & agents.
2. Turn on Allow running with the lid closed. Approve the helper in System Settings › General › Login Items.
3. Then keep one command running with the lid closed. The hold ends with the command.

   ```
   kilobat awake --lid-closed -- make release
   ```
4. Or hold for a time, 8 hours at most.

   ```
   kilobat awake --lid-closed --for 2h
   ```
5. The helper lets the Mac sleep at your battery floor, 20% by default, or when the Mac gets hot.
6. For AI agents, see [Keep an agent running with the lid closed](https://kilobat.app/guides/recipes/agent-lid-closed.html).

### Questions

**Does caffeinate work with the lid closed?**

The man page describes idle and system sleep assertions only. Closing the lid still puts the Mac to sleep in usual use.

**Can I use two external displays with the lid closed?**

On MacBook Air and MacBook Pro with M3, Apple describes this setup. It needs an external keyboard and mouse or trackpad, and power.

### Sources

- [Apple Support: Put your Mac to sleep or wake it](https://support.apple.com/guide/mac-help/mh10330/mac)
- [Apple Support: Connect an external display to MacBook Pro](https://support.apple.com/guide/macbook-pro/connect-an-external-display-apd8cdd74f57/mac)
- [Apple Support: Use dual monitors with your MacBook Air and MacBook Pro with M3 chip](https://support.apple.com/en-us/117373)
- [Apple Support: Using a camera cover, palm rest, or keyboard cover on a Mac notebook](https://support.apple.com/en-us/102051)
- caffeinate(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Keep a Mac awake from Terminal with caffeinate](https://kilobat.app/guides/caffeinate-keep-mac-awake.html): The caffeinate command stops a Mac from sleeping while a task runs.
- [Mac sleep stops downloads](https://kilobat.app/guides/mac-sleep-stops-downloads.html): A Mac that goes to sleep stops most app activity, so a long download can stop or fail.
- [Keep an agent running with the lid closed](https://kilobat.app/guides/recipes/agent-lid-closed.html): Closing the lid puts a Mac laptop to sleep.
- [Keep your Mac awake until a download finishes](https://kilobat.app/guides/recipes/keep-mac-awake-download.html): Kilobat keeps the Mac awake while transfers run.

---

Source: https://kilobat.app/guides/connection-not-private-mac.html

Websites and speed

## “This Connection Is Not Private” and certificate warnings on a Mac

Safari shows a certificate warning when it cannot confirm the identity of a website. Do not enter passwords or card numbers on that site.

Applies to: Safari on macOS 13 Ventura and later. The date and time steps are for macOS 13 and later. · Checked: 29 October 2026

### Symptoms

- Safari shows a warning that the connection is not private.
- The Smart Search field shows “Not Secure”.
- Many secure sites show warnings at the same time.
- Only one site, or only one network, shows the warning.

### Likely causes

- **A wrong date or time on the Mac.** A certificate is valid only between two dates. A wrong clock can make a valid certificate look expired.
- **An expired or illegitimate certificate.** Apple says that Safari warns when the certificate of a website is expired or illegitimate.
- **A self-signed certificate.** Some internal sites use a certificate that a certificate authority did not issue.
- **A network that intercepts connections.** A captive portal, a company proxy or security software can show its own certificate.
- **An unencrypted site.** Safari shows “Not Secure” for a site that does not use HTTPS.

### How to check

1. Click Show Certificate in the warning. Read who issued the certificate, the name it is for, and its dates.
2. Examine the date, time and time zone on the Mac. Open System Settings > General > Date & Time.
3. Open other secure sites. If many sites show warnings, the cause is on the Mac or the network.
4. Join a different network, for example your phone's hotspot. Open the site again. If the warning stops, the first network intercepts connections.
5. If you are on public Wi-Fi, open any site to show the login page. See [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html).
6. Show the details of the server certificate from Terminal.

   ```
   curl -v -I https://example.com
   ```

### How to fix it

1. If the date or time is wrong, open System Settings > General > Date & Time. Turn on “Set time and date automatically”.
2. If the certificate is not trusted, or the name does not match the site, click Cancel. Apple recommends this.
3. If an internal site uses a self-signed certificate, ask the site owner or administrator about the warning.
4. If a company proxy or security app inspects connections, ask the administrator for the correct certificate. See [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html).
5. Do not enter a password or credit card number on a site that shows a warning.

### Questions

**Can I click through the warning?**

Do not continue on a site that asks for a password or payment. If you continue anyway, Apple says to examine the address, because fraudulent sites can change one or two letters.

**Why do many sites show warnings on hotel Wi-Fi?**

Many hotel and café networks hold connections until you log in. The login page then answers for other sites. Log in first, then try again.

**How do I see if a site is encrypted?**

In Safari, choose Safari > Connection Security Details.

### Sources

- [Apple Support: Avoid fraud by using encrypted websites in Safari on Mac](https://support.apple.com/guide/safari/sfri40697/mac)
- [Apple Support: If you see a “Not Secure” warning while browsing with Safari](https://support.apple.com/en-us/102279)
- [Apple Support: Set the date and time automatically on your Mac](https://support.apple.com/guide/mac-help/set-the-date-and-time-automatically-mchlp2996/mac)
- curl(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html): Public networks often hold all traffic until you sign in on a login page.
- [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html): Some company networks inspect HTTPS traffic.
- [Safari can’t find the server on a Mac](https://kilobat.app/guides/safari-cant-find-server.html): “Safari can’t find the server” usually means that the Mac could not get an address for the site name.
- [A website works on your phone but not on your Mac](https://kilobat.app/guides/site-works-on-phone-not-mac.html): When a site opens on your phone but not on your Mac, the problem is usually on the Mac.
- [NET::ERR_CERT_DATE_INVALID in Chrome on Mac](https://kilobat.app/guides/err-cert-date-invalid.html): The server's certificate looks expired or not yet valid by the Mac's clock.

---

Source: https://kilobat.app/guides/content-filter-blocking.html

VPN, proxy and filters

## A content filter blocks websites on a Mac

A content filter examines web traffic and blocks some sites. On a Mac, the filter can come from Screen Time, from an app or from your organization.

Applies to: macOS 13 Ventura and later. The Screen Time pane names come from the current Apple guide and are different in earlier versions. · Checked: 29 October 2026

### Symptoms

- Safari shows a page that says the site is restricted or blocked.
- A site loads on your phone but not on the Mac, on the same network.
- Sites fail on every network, also on a phone hotspot.
- The problem started after you installed a security, VPN or parental control app.

### Likely causes

- **Screen Time web limits.** The Limit Adult Websites or Allowed Websites Only setting blocks sites for a user.
- **A filter app.** Security, antivirus and parental control apps can add a network extension that filters content.
- **A profile from your organization.** A school or company can manage the Mac and install a web content filter.
- **A firewall rule.** A firewall app can block one domain for one app or for all apps.

### How to check

1. Try the site on a different network, such as a phone hotspot. If it still fails, the filter is on the Mac.
2. Choose Apple menu > System Settings > Screen Time. Select the user, then click Content & Privacy.
3. Click App Store, Media, Web, & Games. Look at the Safari setting.
4. Choose Apple menu > System Settings > General > Login Items & Extensions. Click the Info button for Network Extensions.
5. In current macOS versions, choose Apple menu > System Settings > General > Device Management. Look for profiles from your organization.

### How to fix it

1. If Screen Time blocks the site, click Customize next to Limit Adult Websites. Add the site to the Allowed list.
2. To remove the limit, choose Unrestricted Access.
3. If an app filters content, open that app. Allow the site, or turn off its filter.
4. If your organization manages the Mac, ask your IT team. Do not try to remove its profile.
5. Test the site again in a new Safari window.

### With Kilobat

1. If Kilobat's filter is on, its connection check says whether a Kilobat rule blocks the host.

   ```
   kilobat why example.com
   ```
2. List the hosts and IP ranges that Kilobat blocks for every app.

   ```
   kilobat rules --json
   ```
3. Remove a host from Kilobat's blocklist. Blocking needs Pro and the network filter.

   ```
   kilobat unblock-host example.com
   ```

### Questions

**Can a filter block sites in every browser?**

Yes. A network extension filter works below the browser. It can block traffic from all apps.

**Why does the site work on my phone?**

The filter is on the Mac, not on the network. Your phone does not use it.

### Sources

- [Apple Support: Change App Store, Media, Web, & Games settings in Screen Time on Mac](https://support.apple.com/guide/mac-help/mchlbcf0dfe2/mac)
- [Apple Support: Change Login Items & Extensions settings on Mac](https://support.apple.com/guide/mac-help/mtusr003)
- [Apple Support: Use configuration profiles on Mac](https://support.apple.com/guide/mac-help/configuration-profiles-standardize-settings-mh35561/mac)
- [Tailscale: Interoperability with other software](https://tailscale.com/docs/reference/interoperability)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Little Snitch, LuLu and other network extensions conflict on a Mac](https://kilobat.app/guides/network-extension-conflicts.html): Firewalls, VPNs and content filters on macOS use network extensions.
- [A website works on your phone but not on your Mac](https://kilobat.app/guides/site-works-on-phone-not-mac.html): When a site opens on your phone but not on your Mac, the problem is usually on the Mac.
- [Safari can’t find the server on a Mac](https://kilobat.app/guides/safari-cant-find-server.html): “Safari can’t find the server” usually means that the Mac could not get an address for the site name.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.

---

Source: https://kilobat.app/guides/corporate-proxy-certificates.html

VPN, proxy and filters

## Corporate proxy certificates break Terminal tools on a Mac

Some company networks inspect HTTPS traffic. The proxy then signs the traffic with a company root certificate, and tools that do not trust it stop.

Applies to: All current macOS versions. Node.js `NODE_USE_SYSTEM_CA` needs Node.js 22.19, 24.6 or later. · Checked: 29 October 2026

### Symptoms

- npm or Node shows “self-signed certificate in certificate chain” or “unable to get local issuer certificate”.
- Git shows “SSL certificate problem” for HTTPS remotes.
- Safari opens the site, but curl or Python does not.
- The errors occur only on the company network or VPN.

### Likely causes

- **TLS inspection.** The proxy replaces the site's certificate with one that a company root certificate signs.
- **Separate trust stores.** Safari uses the macOS keychain. Many command-line tools use their own list of trusted certificates.
- **A missing proxy setting.** Tools in Terminal do not always use the system proxy. They need proxy variables or their own setting.

### How to check

1. Show the certificate chain that the server sends. Look at the issuer of the top certificate.

   ```
   openssl s_client -connect registry.npmjs.org:443 -servername registry.npmjs.org -showcerts </dev/null
   ```
2. Show the TLS handshake with curl.

   ```
   curl -v https://registry.npmjs.org/ -o /dev/null
   ```
3. Find the company root certificate in Keychain Access. Search for your company name in the System keychain.
4. Show the proxy variables in your shell.

   ```
   env | grep -i proxy
   ```

### How to fix it

1. Get the company root certificate from your IT team as a PEM file. Do not trust a certificate from an unknown source.
2. For Node.js tools, give the file in `NODE_EXTRA_CA_CERTS`. Start the tool again after you set it.

   ```
   export NODE_EXTRA_CA_CERTS=~/certs/company-root.pem
   ```
3. With Node.js 22.19, 24.6 or later, you can use the certificates that the keychain trusts.

   ```
   export NODE_USE_SYSTEM_CA=1
   ```
4. For npm, set the certificate file.

   ```
   npm config set cafile ~/certs/company-root.pem
   ```
5. For Git, set the certificate file.

   ```
   git config --global http.sslCAInfo ~/certs/company-root.pem
   ```
6. For curl, give the file with `--cacert`.

   ```
   curl --cacert ~/certs/company-root.pem https://example.com
   ```
7. Set the company proxy for Terminal tools if your IT team uses one.

   ```
   export https_proxy=http://proxy.example.com:8080
   ```
8. Do not turn off certificate checks, such as `strict-ssl` or `http.sslVerify`. This makes the connection unsafe.

### With Kilobat

1. Kilobat's connection check reports a TLS failure as its own layer. It also says if the system proxy works where the direct path does not.

   ```
   kilobat why https://registry.npmjs.org/
   ```
2. Add `--app` to use the proxy variables of that app's environment.

   ```
   kilobat why https://registry.npmjs.org/ --app process:node
   ```

### Questions

**Why does Safari work when npm fails?**

Safari trusts the certificates in the macOS keychain. npm uses the certificates that Node.js includes, unless you add the company certificate.

**Is it safe to set strict-ssl to false?**

No. It stops all certificate checks for the registry. Add the company root certificate instead.

### Sources

- [Node.js: Command-line API, NODE_EXTRA_CA_CERTS and --use-system-ca](https://nodejs.org/api/cli.html)
- [npm Docs: config (cafile, proxy, https-proxy, strict-ssl)](https://docs.npmjs.com/cli/v11/using-npm/config)
- git-config(1), http.sslCAInfo and http.proxy, man page installed with macOS 27.2 (Git 2.56)
- [Apple Support: Change the trust settings of a certificate in Keychain Access](https://support.apple.com/guide/keychain-access/kyca11871)
- curl(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Homebrew or npm downloads fail on a Mac](https://kilobat.app/guides/homebrew-npm-download-fails.html): Homebrew downloads with curl and Git.
- [Proxy settings stop apps from connecting on a Mac](https://kilobat.app/guides/proxy-settings-breaking-apps.html): A proxy setting sends traffic through another server.
- [“This Connection Is Not Private” and certificate warnings on a Mac](https://kilobat.app/guides/connection-not-private-mac.html): Safari shows a certificate warning when it cannot confirm the identity of a website.
- [SSH and Git time out on a Mac](https://kilobat.app/guides/ssh-git-timeouts.html): SSH and Git need a working TCP connection to the server.

---

Source: https://kilobat.app/guides/curl-could-not-resolve-host.html

Error messages

## “curl: (6) Could not resolve host” on Mac

curl exit code 6 means that curl could not get an address for the host name. The curl documentation says: “The given remote host was not resolved.”

Applies to: The curl that comes with macOS and the Homebrew curl, on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Terminal shows `curl: (6) Could not resolve host: example.com`.
- Scripts and installers that use curl stop with exit code 6.
- The same address opens in a browser, or it fails there too.

### Likely causes

- **A typing error or an empty host.** A variable in a script can be empty, so curl gets a wrong name.
- **No connection or no DNS.** The Mac cannot reach a DNS server.
- **A VPN with its own DNS.** Company names resolve only while the VPN is on.
- **A proxy that curl does not use.** On networks that allow only a proxy, curl needs the proxy settings. It then lets the proxy resolve the name.

### How to check

1. Print the exact command. Make sure that the host name is correct.
2. Look up the name through the macOS resolver.

   ```
   dscacheutil -q host -a name example.com
   ```
3. Ask a public DNS server directly. An answer here, but not above, points to your DNS settings.

   ```
   dig +short example.com @1.1.1.1
   ```
4. Show the proxy variables that curl reads.

   ```
   env | grep -i proxy
   ```
5. Run curl with details. The first lines show the lookup.

   ```
   curl -v https://example.com
   ```

### How to fix it

1. If the macOS lookup fails too, fix DNS. See [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html).
2. If the network needs a proxy, set it for curl.

   ```
   export https_proxy=http://proxy.example.com:8080
   ```
3. For a company name, connect the VPN first.
4. Flush the DNS cache, then try again. See [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html).

### With Kilobat

1. Kilobat's connection doctor tests the name layer by layer: network, proxy, DNS, rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why example.com
   ```
2. To use the proxy variables of a running process, add `--app` with its name.

   ```
   kilobat why https://example.com --app process:curl
   ```
3. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**Why does the browser work but curl does not?**

The browser can use the system proxy or its own DNS. curl reads proxy variables such as `https_proxy`. See [Proxy settings stop apps from connecting on a Mac](https://kilobat.app/guides/proxy-settings-breaking-apps.html).

### Sources

- [curl: libcurl error codes](https://curl.se/libcurl/c/libcurl-errors.html)
- curl(1), EXIT CODES, man page installed with macOS 27.2
- dscacheutil(1) and dig(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Git: “Could not resolve host: github.com” on Mac](https://kilobat.app/guides/git-could-not-resolve-host-github.html): Git could not get an address for github.com.
- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [Proxy settings stop apps from connecting on a Mac](https://kilobat.app/guides/proxy-settings-breaking-apps.html): A proxy setting sends traffic through another server.
- [Homebrew fails with “curl: (28)” on Mac](https://kilobat.app/guides/homebrew-curl-28-timed-out.html): Homebrew downloads with curl.
- [Internal names do not resolve on a VPN](https://kilobat.app/guides/vpn-split-dns-internal-names.html): macOS can send queries for one domain to one DNS server and other queries to another.

---

Source: https://kilobat.app/guides/dns-probe-finished-nxdomain.html

Error messages

## DNS_PROBE_FINISHED_NXDOMAIN in Chrome on Mac

Chrome shows this code when a DNS lookup failed and its own check says the name does not exist. The Chromium source says: “the domain must not exist.”

Applies to: Google Chrome and other Chromium browsers on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Chrome shows “This site can’t be reached” and the code DNS_PROBE_FINISHED_NXDOMAIN.
- Chrome says that the server IP address could not be found.
- Safari shows “Safari Can’t Find the Server” for the same name.

### Likely causes

- **A typing error in the address.** A wrong name does not exist in DNS.
- **A domain that expired or was removed.** The name existed before, but its owner removed it.
- **A DNS filter.** Some DNS filters and ad blockers answer that a blocked name does not exist.
- **An internal name without the VPN.** Company names exist only in the company's DNS. See [Internal names do not resolve on a VPN](https://kilobat.app/guides/vpn-split-dns-internal-names.html).
- **A wrong DNS server.** A DNS server can give a wrong “no such name” answer.

### How to check

1. Examine the address. Correct any typing errors.
2. Look up the name through the macOS resolver. No address lines means that the lookup failed.

   ```
   dscacheutil -q host -a name example.com
   ```
3. Ask a public DNS server directly. An answer here, but not above, points to your DNS settings.

   ```
   dig +short example.com @1.1.1.1
   ```
4. Show the DNS servers that the Mac uses now.

   ```
   scutil --dns
   ```
5. Open the same address on your phone, on cellular data. If it fails there too, the name does not exist.

### How to fix it

1. If only your DNS fails, set the network's own DNS or a public DNS for a test. See [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html).
2. If a DNS filter blocks the name, allow it in the filter.
3. For a company name, connect the VPN first.
4. Flush the DNS cache, then reload. See [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html).

### With Kilobat

1. Kilobat's connection doctor tests the name layer by layer: network, proxy, DNS, rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why example.com
   ```
2. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**What does NXDOMAIN mean?**

NXDOMAIN is the DNS answer for a name that does not exist.

**When does Chrome show this code?**

Chromium runs a DNS probe after a failed lookup. When the DNS servers work, it reports that the domain does not exist.

### Sources

- [Chromium source: components/error_page/common/net_error_info.h](https://source.chromium.org/chromium/chromium/src/+/main:components/error_page/common/net_error_info.h)
- [Chromium source: components/error_page_strings.grdp](https://source.chromium.org/chromium/chromium/src/+/main:components/error_page_strings.grdp)
- [Google Chrome Help: Fix connection and loading errors in Chrome](https://support.google.com/chrome/answer/6098869)
- [RFC 8020: NXDOMAIN: There Really Is Nothing Underneath](https://www.rfc-editor.org/rfc/rfc8020)
- dscacheutil(1) and dig(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [ERR_NAME_NOT_RESOLVED in Chrome on Mac](https://kilobat.app/guides/err-name-not-resolved.html): Chromium describes this error as: “The host name could not be resolved.” Chrome could not get an address for the site's name.
- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [Safari can’t find the server on a Mac](https://kilobat.app/guides/safari-cant-find-server.html): “Safari can’t find the server” usually means that the Mac could not get an address for the site name.
- [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html): macOS keeps DNS answers for some time.
- [Internal names do not resolve on a VPN](https://kilobat.app/guides/vpn-split-dns-internal-names.html): macOS can send queries for one domain to one DNS server and other queries to another.

---

Source: https://kilobat.app/guides/dns-server-not-found.html

DNS

## DNS not resolving on a Mac

When DNS fails, the Mac cannot change a name such as apple.com into an IP address. The connection can work, but every site by name fails.

Applies to: macOS 13 Ventura and later for the System Settings steps. The Terminal commands work on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Browsers show “server can't be found” or a similar error for many sites.
- Terminal tools show “Could not resolve host” or “nodename nor servname provided”.
- Apps that use IP addresses still work, but names do not.
- The problem starts after you change networks, connect a VPN or set custom DNS servers.

### Likely causes

- **No connection.** The Mac has no working path to the internet, so DNS queries cannot go out.
- **Wrong or unreachable DNS servers.** A DNS server that you typed in by hand can stop working, or it can be blocked on this network.
- **The router's DNS fails.** Many networks send DNS to the router. If the router stops answering, names fail on every device.
- **A VPN, profile or filter changes DNS.** VPNs, encrypted DNS profiles and content filters can send queries to other servers.
- **Old answers in the cache.** The Mac keeps answers for some time. After a site moves, an old answer can fail.

### How to check

1. Make sure that the connection works. Send pings to an IP address, so that DNS is not used.

   ```
   ping -c 3 1.1.1.1
   ```
2. Send pings to a name. If the IP address works and the name fails, DNS is the problem.

   ```
   ping -c 3 apple.com
   ```
3. Ask the macOS resolver for a name. This uses the same path as most apps.

   ```
   dscacheutil -q host -a name apple.com
   ```

   Output The `ip_address` and `ipv6_address` lines. No lines means that the lookup failed.
4. Show the DNS configuration that macOS uses now. The first resolver is the default one.

   ```
   scutil --dns
   ```
5. Show the DNS servers that you set by hand on the Wi-Fi service.

   ```
   networksetup -getdnsservers Wi-Fi
   ```

   Output A list of IP addresses, or a message that there are no DNS servers set. Then the network gives the servers.

### How to fix it

1. Remove DNS servers that you typed in by hand. Choose Apple menu > System Settings > Network.
2. Click the network service, click Details, then click DNS. Select each server that you added and click the Remove button.
3. You can also clear them in Terminal. Use the word `empty` in place of the server addresses.

   ```
   networksetup -setdnsservers Wi-Fi empty
   ```

   Needs an administrator password.
4. Clear the DNS cache. See [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html).

   ```
   sudo killall -HUP mDNSResponder
   ```

   Needs an administrator password.
5. Get a new address and new DNS servers from the router. See [Renew the DHCP lease on a Mac](https://kilobat.app/guides/renew-dhcp-lease-mac.html).
6. Disconnect the VPN for a test. If names then work, examine the VPN's DNS settings. See [DNS queries go outside the VPN on a Mac](https://kilobat.app/guides/vpn-dns-leak-mac.html).
7. If DNS fails on all devices, restart the router.

### With Kilobat

1. Kilobat measures one DNS lookup and lists the resolvers in use. Look at `dnsMilliseconds`, `dnsServers` and `captivePortal`.

   ```
   kilobat diagnose --json
   ```
2. For one site or API, find the layer that fails. It checks DNS before the connection.

   ```
   kilobat why api.example.com
   ```
3. The CLI is free. In the app, the Health tab shows the DNS servers and the lookup time. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**Why does ping to 1.1.1.1 work but sites fail?**

A ping to an IP address does not use DNS. If it works and names fail, the problem is DNS, not the connection.

**Why does dig work when apps fail?**

`dig` sends queries to the servers in `/etc/resolv.conf`. Apps use the macOS resolver, which can also use VPN and per-domain rules.

**Will the router give me DNS servers again?**

Yes. When the DNS list in Network settings is empty, macOS uses the servers that the network gives by DHCP.

### Sources

- [Apple Support: Change DNS settings on Mac](https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac)
- [Apple Support (archived): Reset the DNS cache in OS X](https://support.apple.com/en-us/101481)
- scutil(8), man page installed with macOS 27.2
- dscacheutil(1), man page installed with macOS 27.2
- networksetup(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Safari can’t find the server on a Mac](https://kilobat.app/guides/safari-cant-find-server.html): “Safari can’t find the server” usually means that the Mac could not get an address for the site name.
- [Slow DNS on a Mac](https://kilobat.app/guides/slow-dns-mac.html): Every new site needs a DNS lookup before it can load.
- [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html): macOS keeps DNS answers for some time.
- [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html): Public networks often hold all traffic until you sign in on a login page.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.
- [ERR_NAME_NOT_RESOLVED in Chrome on Mac](https://kilobat.app/guides/err-name-not-resolved.html): Chromium describes this error as: “The host name could not be resolved.” Chrome could not get an address for the site's name.

---

Source: https://kilobat.app/guides/docker-container-from-mac.html

Developers

## Cannot reach a Docker container from the Mac

Docker on a Mac runs containers in a Linux virtual machine. To reach a container from macOS, you usually publish a port to localhost.

Applies to: Docker Desktop and OrbStack on current macOS versions. · Checked: 29 October 2026

### Symptoms

- `curl localhost:8080` fails, but the service works inside the container.
- You cannot ping or connect to the container's IP address.
- No `docker0` interface shows on the Mac.
- The service works on Linux but not on the Mac.

### Likely causes

- **The port is not published.** Without `-p`, Docker Desktop does not forward the port to the Mac.
- **Container IPs on Docker Desktop.** Docker's documentation for Docker Desktop says that its bridge network is not reachable from the host.
- **The service listens on 127.0.0.1 in the container.** Then only the container itself can connect to it.
- **A wrong port pair.** In `-p 8080:80`, 8080 is the Mac port and 80 is the container port.

### How to check

1. List the running containers and their published ports.

   ```
   docker ps
   ```

   Output The PORTS column shows pairs such as `0.0.0.0:8080->80/tcp`. No pair means the port is not published.
2. Show the published ports of one container.

   ```
   docker port my-container
   ```
3. Test the service from inside the container, if the image includes wget. A reply means that the service works.

   ```
   docker exec my-container wget -qO- http://localhost:80
   ```
4. See which process on the Mac listens on the port.

   ```
   lsof -nP -iTCP:8080 -sTCP:LISTEN
   ```

### How to fix it

1. Start the container with a published port. The first number is the port on the Mac.

   ```
   docker run -d -p 8080:80 nginx
   ```
2. Connect from the Mac with localhost and the Mac port.

   ```
   curl http://localhost:8080
   ```
3. Make the service in the container listen on 0.0.0.0, not 127.0.0.1. See its own documentation for the setting.
4. If the Mac port is in use, choose another Mac port. See [Port already in use on a Mac](https://kilobat.app/guides/port-already-in-use.html).
5. With OrbStack, you can also use the container's IP address or its `container-name.orb.local` name.

### With Kilobat

1. Kilobat's checks run on the Mac. Use `--context container` when the failing code runs in a container. The report then ends with a command to run there.

   ```
   kilobat why http://localhost:8080 --context container
   ```

### Questions

**Why can I not ping a container on Docker Desktop?**

Docker's documentation says that Docker Desktop cannot route traffic to Linux containers from the Mac. Publish a port instead.

**Does OrbStack work differently?**

Yes. OrbStack's documentation says that you can connect to containers by IP address and by `.orb.local` names from the Mac.

### Sources

- [Docker Docs: Explore networking how-tos on Docker Desktop](https://docs.docker.com/desktop/features/networking/networking-how-tos/)
- [Docker Docs: Networking on Docker Desktop](https://docs.docker.com/desktop/features/networking/)
- [OrbStack Docs: Container networking](https://docs.orbstack.dev/docker/network)
- lsof(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [A container cannot reach localhost on the Mac](https://kilobat.app/guides/localhost-from-container.html): Each container has its own network stack.
- [Port already in use on a Mac](https://kilobat.app/guides/port-already-in-use.html): Only one process can listen on a TCP port and address.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.
- [Port 5000 or 7000 is in use on a Mac: AirPlay Receiver](https://kilobat.app/guides/airplay-receiver-port-5000.html): Apple lists TCP ports 5000 and 7000 for AirPlay.

---

Source: https://kilobat.app/guides/encrypted-dns-mac.html

DNS

## Use encrypted DNS on a Mac

Normal DNS queries are not encrypted. macOS 11 and later can send DNS over HTTPS or TLS when you install a DNS Settings profile.

Applies to: macOS 11 Big Sur and later for encrypted DNS. The profile steps are for macOS 13 Ventura and later. · Checked: 29 October 2026

### Symptoms

- You want DNS queries that other devices on the network cannot read.
- After you install a DNS profile, a hotel or café login page does not open.
- After you install a DNS profile, internal company names stop working.

### Likely causes

- **Plain DNS.** By default, the Mac sends DNS queries to the network's servers without encryption.
- **A DNS Settings profile.** Apple's DNS Settings payload sets an encrypted DNS server with the HTTPS or TLS protocol.
- **A profile that blocks the network's own DNS.** Captive portals and company networks often need their own DNS servers to work.

### How to check

1. Look for DNS profiles. On macOS 15 and later, choose Apple menu > System Settings > General > Device Management.
2. On macOS 13 and 14, choose Apple menu > System Settings > Privacy & Security > Profiles.
3. Show the DNS configuration that macOS uses now.

   ```
   scutil --dns
   ```

### How to fix it

1. Get a profile from your DNS provider. Many providers publish a profile for Apple devices.
2. Open the profile file. macOS adds it to the Downloaded section.
3. On macOS 15 and later, choose Apple menu > System Settings > General > Device Management.
4. On macOS 13 and 14, choose Apple menu > System Settings > Privacy & Security > Profiles.
5. Double-click the profile under Downloaded. Read its contents, then click Install.
6. To stop encrypted DNS, select the profile and click the Remove button.
7. If a login page does not open, remove the profile, log in, then install it again.

### With Kilobat

1. The CLI writes a DNS over HTTPS profile for an HTTPS endpoint that you give. Review it before you install it.

   ```
   kilobat dns-profile https://dns.quad9.net/dns-query > Kilobat-DNS.mobileconfig
   ```
2. Kilobat does not install the profile. Install it with the steps above.

### Questions

**Does the profile work on all networks?**

Apple's documentation says that a profile from an MDM applies only to managed Wi-Fi networks. A profile that you install yourself also applies to cellular networks.

**Can I remove the profile?**

Yes. Select it in Device Management or Profiles, then click the Remove button. Some profiles from an organization only an administrator can remove.

### Sources

- [Apple Developer: DNSSettings payload](https://developer.apple.com/documentation/devicemanagement/dnssettings)
- [Apple Support: Use configuration profiles to standardize settings on Mac computers](https://support.apple.com/guide/mac-help/configuration-profiles-standardize-settings-mh35561/mac)
- [Apple Support: Use configuration profiles (macOS 14 guide)](https://support.apple.com/guide/mac-help/mh35561/14.0/mac/14.0)
- [Apple Support: Change DNS settings on Mac](https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html): Public networks often hold all traffic until you sign in on a login page.
- [DNS queries go outside the VPN on a Mac](https://kilobat.app/guides/vpn-dns-leak-mac.html): With a VPN on, you usually want DNS queries to go to the VPN's servers.
- [Slow DNS on a Mac](https://kilobat.app/guides/slow-dns-mac.html): Every new site needs a DNS lookup before it can load.
- [Pick a faster DNS](https://kilobat.app/guides/recipes/pick-faster-dns.html): Slow DNS makes every new site slow to start.

---

Source: https://kilobat.app/guides/err-cert-date-invalid.html

Error messages

## NET::ERR_CERT_DATE_INVALID in Chrome on Mac

The server's certificate looks expired or not yet valid by the Mac's clock. Chromium names three causes: a wrong clock, a bad server certificate, or an attacker.

Applies to: Google Chrome and other Chromium browsers on all current macOS versions. The Date & Time path is for macOS 13 and later. · Checked: 29 October 2026

### Symptoms

- Chrome shows “Your connection is not private” with NET::ERR_CERT_DATE_INVALID.
- Chrome shows “Your clock is behind” or “Your clock is ahead”.
- Many secure sites fail at the same time.

### Likely causes

- **A wrong date or time on the Mac.** If many sites fail at once, the clock is the most likely cause.
- **An expired certificate on the server.** If only one site fails, its owner did not renew the certificate.
- **A network that shows its own certificate.** A login page or an inspecting proxy can answer with an old certificate.
- **An attack.** Chromium says that an attacker can present an old certificate. Do not continue to the site.

### How to check

1. Choose Apple menu > System Settings > General > Date & Time. Compare the date and time with your phone.
2. Show the date and time from Terminal.

   ```
   date
   ```
3. Open other secure sites. Note if many fail.
4. Show the dates of the site's certificate.

   ```
   curl -vI https://example.com 2>&1 | grep -E 'start date|expire date'
   ```

### How to fix it

1. Turn on “Set time and date automatically” in Date & Time. Make sure the time zone is correct.
2. Restart Chrome after you fix the clock.
3. If only one site has an expired certificate, wait for its owner to fix it. Do not enter passwords there.
4. On public Wi-Fi, sign in to the network first. See [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html).

### With Kilobat

1. Kilobat's connection doctor tests the site layer by layer: network, proxy, DNS, rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why https://example.com
   ```
2. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**Can I click through the warning?**

Not on a site where you enter a password or payment. An expired certificate does not prove that the site is safe.

### Sources

- [Chromium source: net/base/net_error_list.h](https://source.chromium.org/chromium/chromium/src/+/main:net/base/net_error_list.h)
- [Chromium source: components/security_interstitials_strings.grdp](https://source.chromium.org/chromium/chromium/src/+/main:components/security_interstitials_strings.grdp)
- [Apple Support: Set the date and time automatically on your Mac](https://support.apple.com/guide/mac-help/set-the-date-and-time-automatically-mchlp2996/mac)
- curl(1) and date(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [“This Connection Is Not Private” and certificate warnings on a Mac](https://kilobat.app/guides/connection-not-private-mac.html): Safari shows a certificate warning when it cannot confirm the identity of a website.
- [What is timed on Mac?](https://kilobat.app/guides/what-is-timed.html): timed keeps the Mac's clock correct.
- [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html): Public networks often hold all traffic until you sign in on a login page.
- [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html): Some company networks inspect HTTPS traffic.

---

Source: https://kilobat.app/guides/err-connection-timed-out.html

Error messages

## ERR_CONNECTION_TIMED_OUT in Chrome on Mac

Chromium describes this error as: “A connection attempt timed out.” Chrome found the address, but the server did not answer in time.

Applies to: Google Chrome and other Chromium browsers on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Chrome shows “This site can’t be reached” and ERR_CONNECTION_TIMED_OUT.
- Chrome says that the site took too long to respond.

### Likely causes

- **A firewall that drops the connection.** A company, school or hotel network can drop traffic to some sites or ports.
- **A broken IPv6 path.** The site has an IPv6 address, but IPv6 does not work on your network.
- **A VPN or proxy.** Traffic goes through a VPN or proxy that cannot reach the server.
- **A Wi-Fi login page.** Some public networks hold traffic until you sign in.
- **The server is down.** If every network fails, the server does not answer.

### How to check

1. Open the same address on another device on the same network. If it fails there too, the problem is the network or the server.
2. Test the port from Terminal, with a 5-second timeout.

   ```
   nc -vz -G 5 example.com 443
   ```
3. Try IPv4 only, then IPv6 only.

   ```
   curl -4 -I https://example.com
   curl -6 -I https://example.com
   ```
4. Show the system proxy settings.

   ```
   scutil --proxy
   ```

### How to fix it

1. If you are on public Wi-Fi, sign in to the network. See [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html).
2. If only IPv6 fails, read [IPv6 problems on a Mac](https://kilobat.app/guides/ipv6-problems-mac.html).
3. If a VPN, proxy or security app is on, turn it off for a short test. Turn it on again after the test.
4. If a company network blocks the site, ask the administrator.

### With Kilobat

1. Kilobat's connection doctor tests the site layer by layer: network, proxy, DNS, rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why https://example.com
   ```
2. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**Is a timeout different from a refused connection?**

Yes. A refused connection gets an answer at once. A timeout gets no answer, which often means that something drops the traffic.

### Sources

- [Chromium source: net/base/net_error_list.h](https://source.chromium.org/chromium/chromium/src/+/main:net/base/net_error_list.h)
- [Chromium source: components/error_page_strings.grdp](https://source.chromium.org/chromium/chromium/src/+/main:components/error_page_strings.grdp)
- [Google Chrome Help: Fix connection and loading errors in Chrome](https://support.google.com/chrome/answer/6098869)
- nc(1) and curl(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [“The request timed out.” on Mac](https://kilobat.app/guides/request-timed-out.html): This is the macOS text for error -1001.
- [IPv6 problems on a Mac](https://kilobat.app/guides/ipv6-problems-mac.html): Most networks give a Mac both IPv4 and IPv6 addresses.
- [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html): Public networks often hold all traffic until you sign in on a login page.
- [“Safari can’t connect to the server” on Mac](https://kilobat.app/guides/safari-cant-connect-to-server.html): Safari found the address of the site, but the connection to the server did not open.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.

---

Source: https://kilobat.app/guides/err-internet-disconnected.html

Error messages

## ERR_INTERNET_DISCONNECTED in Chrome on Mac

Chromium describes this error as: “The Internet connection has been lost.” Chrome found no working connection on the Mac.

Applies to: Google Chrome and other Chromium browsers on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Chrome shows the heading “No internet” and ERR_INTERNET_DISCONNECTED.
- Safari shows “You Are Not Connected to the Internet” at the same time.

### Likely causes

- **Wi-Fi is off or not joined.** The Mac is not on any network.
- **No valid IP address.** The Mac did not get an address from the router. See [Mac has a self-assigned IP address](https://kilobat.app/guides/self-assigned-ip-address.html).
- **A VPN that blocks traffic.** Some VPNs block all traffic while they connect.
- **The router or provider is down.** If other devices also fail, the problem is not the Mac.

### How to check

1. Click the Wi-Fi icon in the menu bar. Make sure that Wi-Fi is on and that the Mac joined your network.
2. Show the address and router of the Wi-Fi service.

   ```
   networksetup -getinfo Wi-Fi
   ```
3. Find the router address in the `gateway` line. Then ping it.

   ```
   route -n get default
   ping -c 5 192.168.1.1
   ```
4. Ping an address on the internet. This test does not use DNS.

   ```
   ping -c 5 1.1.1.1
   ```

### How to fix it

1. Turn Wi-Fi off and on, or join your network again.
2. If the address starts with 169.254, renew the DHCP lease. See [Renew the DHCP lease on a Mac](https://kilobat.app/guides/renew-dhcp-lease-mac.html).
3. Disconnect the VPN for a test.
4. Restart the router if other devices also fail.

### With Kilobat

1. Check Wi-Fi, the router, the internet, DNS and a login page in one command.

   ```
   kilobat diagnose
   ```
2. Show when the Mac lost the connection.

   ```
   kilobat outages
   ```
3. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**Why does Chrome say No internet while Wi-Fi is connected?**

The link to the router works, but the Mac has no path to the internet. See [Mac connected to Wi-Fi but no internet](https://kilobat.app/guides/wifi-connected-no-internet.html).

### Sources

- [Chromium source: net/base/net_error_list.h](https://source.chromium.org/chromium/chromium/src/+/main:net/base/net_error_list.h)
- [Chromium source: components/error_page_strings.grdp](https://source.chromium.org/chromium/chromium/src/+/main:components/error_page_strings.grdp)
- [Apple Support: If your Mac isn't connecting to the internet over Wi-Fi](https://support.apple.com/en-us/101588)
- networksetup(8) and ping(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Safari: “You Are Not Connected to the Internet” on Mac](https://kilobat.app/guides/safari-not-connected-to-internet.html): Safari shows this page when macOS has no internet connection for it.
- [Mac connected to Wi-Fi but no internet](https://kilobat.app/guides/wifi-connected-no-internet.html): A Wi-Fi connection is only the link to the router.
- [Mac has a self-assigned IP address](https://kilobat.app/guides/self-assigned-ip-address.html): If the Mac gets no answer from a DHCP server, it gives itself a link-local address from 169.254.0.0/16.
- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet.html): A VPN sends traffic through a tunnel.

---

Source: https://kilobat.app/guides/err-name-not-resolved.html

Error messages

## ERR_NAME_NOT_RESOLVED in Chrome on Mac

Chromium describes this error as: “The host name could not be resolved.” Chrome could not get an address for the site's name.

Applies to: Google Chrome and other Chromium browsers on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Chrome shows “This site can’t be reached” and ERR_NAME_NOT_RESOLVED.
- Chrome says that the server IP address could not be found.
- Other sites open, or no site opens.

### Likely causes

- **No internet connection.** If no site opens, the connection is the problem, not DNS.
- **A DNS server that does not answer.** Custom DNS servers or the router's DNS can fail.
- **A VPN that changes DNS.** The VPN's DNS server can fail, or it does not know the name.
- **A stale cache.** The Mac keeps an old failed answer.
- **A name that does not exist.** A typing error, or a removed domain.

### How to check

1. Open a different website. If no site opens, the problem is the connection, not this site.
2. Look up the name through the macOS resolver. No address lines means that the lookup failed.

   ```
   dscacheutil -q host -a name example.com
   ```
3. Ask a public DNS server directly. An answer here, but not above, points to your DNS settings.

   ```
   dig +short example.com @1.1.1.1
   ```
4. Show the DNS servers that the Mac uses now.

   ```
   scutil --dns
   ```

### How to fix it

1. If no site opens, fix the connection. See [Mac connected to Wi-Fi but no internet](https://kilobat.app/guides/wifi-connected-no-internet.html).
2. If public DNS answers and your DNS does not, change the DNS servers. See [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html).
3. Flush the DNS cache. See [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html).
4. If a VPN, proxy or security app is on, turn it off for a short test. Turn it on again after the test.

### With Kilobat

1. Kilobat's connection doctor tests the name layer by layer: network, proxy, DNS, rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why example.com
   ```
2. Compare the speed and answers of DNS servers from this Mac.

   ```
   kilobat dns-benchmark
   ```
3. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**Is ERR_NAME_NOT_RESOLVED the same as DNS_PROBE_FINISHED_NXDOMAIN?**

Both are failed lookups. NXDOMAIN means that Chrome's check says the name does not exist. See [DNS_PROBE_FINISHED_NXDOMAIN in Chrome on Mac](https://kilobat.app/guides/dns-probe-finished-nxdomain.html).

### Sources

- [Chromium source: net/base/net_error_list.h](https://source.chromium.org/chromium/chromium/src/+/main:net/base/net_error_list.h)
- [Chromium source: components/error_page_strings.grdp](https://source.chromium.org/chromium/chromium/src/+/main:components/error_page_strings.grdp)
- [Google Chrome Help: Fix connection and loading errors in Chrome](https://support.google.com/chrome/answer/6098869)
- [Apple Support: Change DNS settings on Mac](https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac)
- dscacheutil(1), dig(1) and scutil(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [DNS_PROBE_FINISHED_NXDOMAIN in Chrome on Mac](https://kilobat.app/guides/dns-probe-finished-nxdomain.html): Chrome shows this code when a DNS lookup failed and its own check says the name does not exist.
- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html): macOS keeps DNS answers for some time.
- [“A server with the specified hostname could not be found.” on Mac](https://kilobat.app/guides/server-hostname-not-found.html): This is the macOS text for error -1003.
- [Pick a faster DNS](https://kilobat.app/guides/recipes/pick-faster-dns.html): Slow DNS makes every new site slow to start.

---

Source: https://kilobat.app/guides/err-network-changed.html

Error messages

## ERR_NETWORK_CHANGED in Chrome on Mac

Chromium describes this error as: “The network changed.” Chrome stopped the load because the Mac's network changed during it.

Applies to: Google Chrome and other Chromium browsers on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Chrome shows ERR_NETWORK_CHANGED and says that a network change was detected.
- It happens again and again, or only when a VPN connects.

### Likely causes

- **A VPN that connects or reconnects.** Each time the VPN changes the routes, the network changes for Chrome.
- **Wi-Fi that switches networks.** The Mac moves between two known networks, for example a router and a hotspot.
- **An adapter that comes and goes.** A USB Ethernet adapter, a dock or a tethered phone connects and disconnects.
- **Virtual network interfaces.** Virtual machines and container tools can add and remove network interfaces.

### How to check

1. Note when the error appears. Compare it with VPN, Wi-Fi and dock events.
2. Watch the network state. Run it again when the error appears and compare.

   ```
   scutil --nwi
   ```
3. List the interfaces and their addresses.

   ```
   ifconfig -l
   ```
4. Hold the Option key and click the Wi-Fi icon. Make sure that the network does not change.

### How to fix it

1. If a VPN reconnects often, update it or ask its provider.
2. If the Mac switches between networks, change the order or turn off Auto-Join. See [Mac joins the wrong Wi-Fi network](https://kilobat.app/guides/mac-joins-wrong-wifi.html).
3. Connect the adapter or dock firmly, or try another port.
4. Reload the page. The error stops when the network stays the same.

### With Kilobat

1. Show network changes, drops and roams that the app recorded, with their times.

   ```
   kilobat outages
   ```
2. Show the route and the VPN that traffic uses now.

   ```
   kilobat ip
   ```
3. The CLI is free. Outage history in the app needs Pro.

### Questions

**Is ERR_NETWORK_CHANGED dangerous?**

No. Chrome stops the load to start it again on the new network.

### Sources

- [Chromium source: net/base/net_error_list.h](https://source.chromium.org/chromium/chromium/src/+/main:net/base/net_error_list.h)
- [Chromium source: components/error_page_strings.grdp](https://source.chromium.org/chromium/chromium/src/+/main:components/error_page_strings.grdp)
- scutil(8) and ifconfig(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [“The network connection was lost.” on Mac](https://kilobat.app/guides/network-connection-was-lost.html): This is the macOS text for error -1005.
- [Mac joins the wrong Wi-Fi network](https://kilobat.app/guides/mac-joins-wrong-wifi.html): The Mac joins known networks on its own.
- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet.html): A VPN sends traffic through a tunnel.
- [Tailscale and another VPN conflict on a Mac](https://kilobat.app/guides/tailscale-vpn-routing-conflicts.html): Tailscale gives each device an address in 100.64.0.0/10.
- [Mac uses the wrong network connection](https://kilobat.app/guides/network-service-order.html): When more than one connection is active, the Mac tries the service at the top of the list first.

---

Source: https://kilobat.app/guides/ethernet-adapter-not-detected.html

Ethernet and tethering

## Mac does not detect a USB or Thunderbolt Ethernet adapter

A USB or Thunderbolt Ethernet adapter must appear as a hardware port and as a network service. Find which one is missing, then add it.

Applies to: macOS 13 Ventura and later for the System Settings steps. `networksetup` is in all current macOS versions. · Checked: 29 October 2026

### Symptoms

- The adapter is connected, but Network settings does not show it.
- The adapter shows Not Connected, although the cable goes to the router.
- The adapter worked on another port or another Mac.

### Likely causes

- **The cable or port.** A damaged cable or a loose connector stops the link.
- **A hub or dock.** A hub can give too little power or bandwidth, or it can have a fault.
- **No network service.** macOS can see the hardware but have no network service for it.
- **The device at the other end.** The router or switch port can be off or have a fault.

### How to check

1. List the hardware ports that macOS knows. Look for the adapter by its name.

   ```
   networksetup -listallhardwareports
   ```

   Output Blocks of Hardware Port, Device (for example `en5`) and Ethernet Address.
2. List the network services. An asterisk means that a service is inactive.

   ```
   networksetup -listnetworkserviceorder
   ```
3. Look at the state of the device that the first command gave you. Replace en5 with that device.

   ```
   ifconfig en5
   ```

   Output A `status:` line that is `active` or `inactive`, and a `media:` line.
4. Open System Information from Applications > Utilities. Look for the adapter in the USB or Thunderbolt section.

### How to fix it

1. Make sure that the Ethernet cable is not damaged. Connect it firmly at both ends.
2. Connect the adapter directly to a port on the Mac, not through a hub.
3. Choose Apple menu > System Settings > Network. Look for a service with the adapter's name.
4. If there is no service, click the Action pop-up menu and choose Add Service. Choose the adapter as the Interface. Click Create.
5. Or let macOS find new hardware and make a default service for it.

   ```
   sudo networksetup -detectnewhardware
   ```

   Needs an administrator password.
6. Shut down the Mac. Turn off the router or switch, wait a few minutes, then turn it on.
7. Start the Mac again when the router or switch is ready.

### With Kilobat

1. See the counters of physical and VPN interfaces separately.

   ```
   kilobat interfaces --json
   ```
2. Find which layer fails when the adapter is up but the internet does not work.

   ```
   kilobat diagnose
   ```

### Questions

**Does the adapter need a driver?**

Read the instructions from the adapter's maker. If the maker supplies a driver for macOS, follow those instructions.

**The service is there, but it shows no IP address. What next?**

Make sure that the router gives addresses. See [Mac has a self-assigned IP address](https://kilobat.app/guides/self-assigned-ip-address.html) and [Renew the DHCP lease on a Mac](https://kilobat.app/guides/renew-dhcp-lease-mac.html).

### Sources

- [Apple Support: Troubleshoot an Ethernet device on Mac](https://support.apple.com/guide/mac-help/troubleshoot-an-ethernet-device-on-mac-mchlp2727/mac)
- [Apple Support: Set up a network service on Mac](https://support.apple.com/guide/mac-help/set-up-a-network-service-on-mac-mchlp1176/mac)
- networksetup(8), man page installed with macOS 27.2
- ifconfig(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Ethernet on a Mac is slower than expected](https://kilobat.app/guides/ethernet-slow-link-speed.html): An Ethernet link runs at the speed that both ends and the cable support.
- [Mac uses the wrong network connection](https://kilobat.app/guides/network-service-order.html): When more than one connection is active, the Mac tries the service at the top of the list first.
- [Mac has a self-assigned IP address](https://kilobat.app/guides/self-assigned-ip-address.html): If the Mac gets no answer from a DHCP server, it gives itself a link-local address from 169.254.0.0/16.
- [See Mac network settings in Terminal](https://kilobat.app/guides/network-settings-terminal.html): macOS includes command-line tools that show the same network settings as System Settings, and more.

---

Source: https://kilobat.app/guides/ethernet-slow-link-speed.html

Ethernet and tethering

## Ethernet on a Mac is slower than expected

An Ethernet link runs at the speed that both ends and the cable support. A slow link often comes from the cable, an adapter or a hub.

Applies to: macOS 13 Ventura and later for System Settings > Network > Details > Hardware. The commands work in all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Ethernet is not faster than Wi-Fi, or it is slower.
- Speed tests stop near 100 Mbit/s on a faster connection.
- The speed changes when you use another cable or port.

### Likely causes

- **The cable.** Apple says that Gigabit Ethernet needs a Gigabit Ethernet cable. An old or damaged cable can give 100 Mbit/s only.
- **The adapter or port.** A USB 2.0 port or hub has a maximum of 480 Mbit/s. It cannot carry Gigabit Ethernet at full speed.
- **A manual setting.** A speed or duplex that someone set by hand can stop the link from using its full speed.
- **The other end.** The router or switch port can support a lower speed.

### How to check

1. Find the device name of the Ethernet port.

   ```
   networksetup -listallhardwareports
   ```
2. Show the media setting and the active media. Replace en5 with your device.

   ```
   networksetup -getMedia en5
   ```

   Output A Current line and an Active line, for example `autoselect` and the negotiated media.
3. See the negotiated link in the media line. 1000baseT is 1 Gbit/s and 100baseTX is 100 Mbit/s.

   ```
   ifconfig en5 | grep media
   ```
4. Choose Apple menu > System Settings > Network. Click the Ethernet service, then click Details. Click Hardware.
5. Make sure that Configure is set to Automatic.

### How to fix it

1. Use a cable that supports Gigabit Ethernet, such as Cat 5e or better.
2. Connect the adapter directly to the Mac, not through a USB 2.0 hub.
3. Try another port on the router or switch.
4. If Configure is Manual and nobody told you to set it, set it to Automatic. Click OK.
5. Set the speed by hand only if your network administrator gives you a value. Apple says that wrong settings can reduce performance.
6. To go back to automatic media and MTU from Terminal, use this command.

   ```
   sudo networksetup -setMTUAndMediaAutomatically en5
   ```

   Needs an administrator password.

### With Kilobat

1. Test the speed to another computer on your local network. Install iperf3 on this Mac, and run `iperf3 -s` on the other computer.

   ```
   kilobat lan-test 192.168.1.20
   ```
2. Test the internet speed and the latency under load. It uses up to 80 MB.

   ```
   kilobat speedtest
   ```

### Questions

**Does a faster link make the internet faster?**

Only if the link is the slowest part. If your internet plan is slower than the link, the plan sets the speed.

**Should I set duplex by hand?**

No, not unless your network administrator tells you. Apple recommends the automatic settings.

### Sources

- [Apple Support: Use Gigabit Ethernet on Mac](https://support.apple.com/guide/mac-help/use-gigabit-ethernet-on-mac-mchlp2779/mac)
- [Apple Support: Change Hardware settings on Mac](https://support.apple.com/guide/mac-help/change-hardware-settings-on-mac-mchlp2505/mac)
- networksetup(8), man page installed with macOS 27.2
- ifconfig(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Mac does not detect a USB or Thunderbolt Ethernet adapter](https://kilobat.app/guides/ethernet-adapter-not-detected.html): A USB or Thunderbolt Ethernet adapter must appear as a hardware port and as a network service.
- [Slow internet on a Mac: find which part is slow](https://kilobat.app/guides/slow-internet-mac-cause.html): A slow connection has many possible causes.
- [Test internet speed from Terminal with networkQuality](https://kilobat.app/guides/networkquality-speed-test.html): macOS includes networkQuality, a command-line test.
- [MTU problems on a Mac](https://kilobat.app/guides/mtu-problems-mac.html): The MTU is the largest packet that an interface sends.

---

Source: https://kilobat.app/guides/find-devices-on-network.html

Local network

## Find the devices on your local network from a Mac

macOS has two built-in ways to see other devices: the ARP table and Bonjour. Neither one is a full scan of the network.

Applies to: All current macOS versions. Local Network privacy settings are in macOS 15 Sequoia and later. · Checked: 29 October 2026

### Symptoms

- You need the IP address of a printer, NAS or other device.
- You want to know which devices are on your network.
- An app cannot find a device on the local network.

### Likely causes

- **The ARP table holds only recent devices.** The Mac lists a device only after it has exchanged traffic with it.
- **Bonjour shows only devices that advertise services.** Devices that do not advertise a service do not appear.
- **Local Network access is off for an app.** On macOS 15 Sequoia and later, an app needs permission to find devices on the local network.
- **Client isolation on the network.** Some guest and public networks stop devices from seeing each other.

### How to check

1. Show the ARP table. It lists IP addresses and hardware (MAC) addresses that the Mac knows now.

   ```
   arp -a
   ```
2. To skip name lookups, add `-n`.

   ```
   arp -a -n
   ```
3. Browse for devices that advertise a service with Bonjour. This example finds printers. Press Control-C to stop.

   ```
   dns-sd -B _ipp._tcp
   ```
4. Browse for devices that share files over SMB.

   ```
   dns-sd -B _smb._tcp
   ```
5. If one app cannot find devices, open System Settings > Privacy & Security > Local Network. Look for the app in the list.

### How to fix it

1. If the app is off in Local Network, turn it on. See [An app cannot find devices on the local network](https://kilobat.app/guides/local-network-permission.html).
2. If you are on a guest network, connect to the main network to reach your devices.
3. To add a device to the ARP table, ping its address first. Then run `arp -a` again.

   ```
   ping -c 2 192.168.1.20
   ```
4. Give important devices a fixed address in your router settings. Then you can always find them.

### With Kilobat

1. Kilobat lists the devices that the Mac recently talked to, from the ARP neighbor cache. It is not a full scan.

   ```
   kilobat devices
   ```
2. To include Bonjour services, add `--bonjour`.

   ```
   kilobat devices --bonjour
   ```
3. To give a device a name that Kilobat remembers, use its hardware address.

   ```
   kilobat devices name aa:bb:cc:dd:ee:ff "Printer"
   ```
4. To wake a device that supports Wake-on-LAN, send a wake packet. Kilobat cannot confirm that it woke.

   ```
   kilobat wake aa:bb:cc:dd:ee:ff
   ```
5. The Devices tab in the dashboard needs Pro.

### Questions

**Why does arp -a not show all my devices?**

The table lists only devices that recently exchanged traffic with the Mac. A device that is asleep or silent does not appear.

**Do these commands need an administrator password?**

No. `arp -a` and `dns-sd -B` work for any user. Deleting ARP entries needs an administrator.

### Sources

- arp(8), man page installed with macOS 27.2
- dns-sd(1), man page installed with macOS 27.2
- [Apple Support: Control access to your local network on Mac](https://support.apple.com/guide/mac-help/control-access-to-your-local-network-on-mac-mchla4f49138/mac)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [An app cannot find devices on the local network](https://kilobat.app/guides/local-network-permission.html): macOS 15 Sequoia and later ask before an app connects to devices on your local network.
- [The macOS firewall blocks incoming connections](https://kilobat.app/guides/macos-firewall-incoming.html): The macOS firewall controls connections that other computers start to your Mac.
- [Mac has a self-assigned IP address](https://kilobat.app/guides/self-assigned-ip-address.html): If the Mac gets no answer from a DHCP server, it gives itself a link-local address from 169.254.0.0/16.
- [IP address conflict on a Mac](https://kilobat.app/guides/ip-address-conflict-mac.html): Two devices on one network cannot use the same IP address.

---

Source: https://kilobat.app/guides/find-saved-wifi-password.html

Wi-Fi

## Find a saved Wi-Fi password on a Mac

The Mac stores the password of each Wi-Fi network that it joins. You can see it, copy it or share it after you authenticate.

Applies to: The Passwords app is in macOS 15 Sequoia and later. Copy Password in System Settings is in macOS 13 Ventura and later. · Checked: 29 October 2026

### Symptoms

- A guest asks for the Wi-Fi password, and you do not remember it.
- You must enter the password on a new device.
- You want to share the network without saying the password.

### Likely causes

- **The password is in the keychain.** macOS saves Wi-Fi passwords, so you do not see them during normal use.
- **Authentication is necessary.** macOS asks for your password or Touch ID before it shows a saved password.

### How to check

1. Open the Passwords app. Click Wi-Fi in the sidebar.
2. If the sidebar is hidden, click the Sidebar button.
3. Select the network. The current network shows at the top.

### How to fix it

1. To see the password, hold the pointer over the dots next to Password.
2. To copy the password, click the dots.
3. To share with a QR code, click Show Network QR Code. The other person scans it with a phone.
4. On macOS 13 and later, you can also open System Settings > Wi-Fi. Click the More button next to a known network.
5. Then choose Copy Password. This option is not available for some networks.
6. To share with a nearby contact, keep the Mac unlocked and on the network. Click Share Password when the Mac asks.

### With Kilobat

1. Show a saved password. macOS asks you first.

   ```
   kilobat wifi password "Home"
   ```
2. Show the password and a QR code to scan with a phone.

   ```
   kilobat wifi share "Home"
   ```
3. In the Kilobat Wi-Fi menu, use Show saved password… or Share network… These are free. See [Share Wi-Fi with a QR code](https://kilobat.app/guides/recipes/share-wifi-qr-code.html).

### Questions

**Why does the Mac not show the password at once?**

macOS protects saved passwords. You must authenticate first.

**Can I find the password of an enterprise network?**

Networks that use 802.1X sign in with an account, not one shared password.

### Sources

- [Apple Support: Find and share your Wi-Fi password on Mac](https://support.apple.com/guide/passwords/wi-fi-mchl9f8f63cd/mac)
- [Apple Support: Wi-Fi settings on Mac](https://support.apple.com/guide/mac-help/mh11935/mac)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Share Wi-Fi with a QR code](https://kilobat.app/guides/recipes/share-wifi-qr-code.html): Kilobat makes a QR code from the saved password of a network.
- [Mac joins the wrong Wi-Fi network](https://kilobat.app/guides/mac-joins-wrong-wifi.html): The Mac joins known networks on its own.
- [“Weak security” warning on Mac Wi-Fi](https://kilobat.app/guides/wifi-weak-security-warning.html): The Mac shows a security warning when a network uses an old security mode.

---

Source: https://kilobat.app/guides/flush-dns-cache-mac.html

DNS

## Flush the DNS cache on a Mac

macOS keeps DNS answers for some time. A flush removes them, so that the next lookup asks the DNS server again.

Applies to: OS X 10.10.4 Yosemite and later, which includes all current macOS versions. · Checked: 29 October 2026

### Symptoms

- A site moved to a new server, but the Mac still goes to the old address.
- A change to `/etc/hosts` or to a DNS record does not show.
- A “server not found” error stays after the network works again.

### Likely causes

- **Cached answers.** mDNSResponder keeps a cache of DNS replies. The cache can hold an answer that is no longer correct.
- **The browser cache.** Some browsers keep their own DNS cache. A macOS flush does not clear it.
- **The DNS server cache.** The router or the provider also keeps answers. A flush on the Mac does not clear them.

### How to check

1. Ask the macOS resolver for the name. Compare the address with the address that you expect.

   ```
   dscacheutil -q host -a name example.com
   ```
2. Show the DNS servers that macOS uses.

   ```
   scutil --dns
   ```

### How to fix it

1. Open Terminal. Clear the Directory Service cache.

   ```
   sudo dscacheutil -flushcache
   ```

   Needs an administrator password.
2. Tell mDNSResponder to clear its cache. Apple gives this command for OS X 10.10.4 and later.

   ```
   sudo killall -HUP mDNSResponder
   ```

   Needs an administrator password.
3. Type your password when Terminal asks. The commands show no message when they work.
4. Quit and open the browser again, so that it does not use its own old answers.
5. Look up the name again. If the old address comes back, the DNS server still has it.

### With Kilobat

1. The CLI runs the same two commands. macOS asks for an administrator password.

   ```
   kilobat dns flush
   ```
2. In the app, open the Health tab and click Flush cache… in the DNS panel.
3. The MCP tool `set_dns` with `provider` set to `flush` does the same. It tells the agent to ask you first.

### Questions

**Does a flush make DNS faster?**

No. It removes old answers. The next lookups go to the DNS server again, so they can be a little slower.

**Is it safe to flush the DNS cache?**

Yes. macOS fills the cache again as apps look up names. The `dscacheutil` man page says to use its flush only when necessary.

**Do I need to restart the Mac?**

No. The commands take effect at once.

### Sources

- [Apple Support (archived): Reset the DNS cache in OS X](https://support.apple.com/en-us/101481)
- dscacheutil(1), man page installed with macOS 27.2
- mDNSResponder(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [Changes to /etc/hosts do not work on a Mac](https://kilobat.app/guides/hosts-file-not-working.html): The /etc/hosts file maps names to IP addresses on this Mac only.
- [Slow DNS on a Mac](https://kilobat.app/guides/slow-dns-mac.html): Every new site needs a DNS lookup before it can load.
- [Safari can’t find the server on a Mac](https://kilobat.app/guides/safari-cant-find-server.html): “Safari can’t find the server” usually means that the Mac could not get an address for the site name.
- [What is mDNSResponder on Mac?](https://kilobat.app/guides/what-is-mdnsresponder.html): mDNSResponder answers DNS lookups for every app on the Mac, and it runs Bonjour on the local network.

---

Source: https://kilobat.app/guides/git-could-not-resolve-host-github.html

Error messages

## Git: “Could not resolve host: github.com” on Mac

Git could not get an address for github.com. For HTTPS remotes, Git prints curl's message. For SSH remotes, ssh prints its own message.

Applies to: Git that macOS or Homebrew installs, on all current macOS versions. The text was checked with Git 2.56 and OpenSSH 10.5. · Checked: 29 October 2026

### Symptoms

- Git shows `fatal: unable to access 'https://github.com/…/': Could not resolve host: github.com`.
- With an SSH remote, ssh shows `Could not resolve hostname github.com: nodename nor servname provided, or not known`.
- `git clone`, `git pull` and `git push` all fail.

### Likely causes

- **No connection or no DNS.** The Mac cannot look up any name.
- **A proxy that Git does not use.** On a network that needs a proxy, Git needs `http.proxy` or proxy variables.
- **A VPN or DNS filter.** A VPN's DNS server or a filter can fail to answer for github.com.
- **A wrong remote URL.** A typing error in the remote gives a name that does not exist.

### How to check

1. Show the remote URLs of the repository.

   ```
   git remote -v
   ```
2. Look up github.com through the macOS resolver.

   ```
   dscacheutil -q host -a name github.com
   ```
3. Show Git's proxy setting and your proxy variables.

   ```
   git config --get http.proxy
   env | grep -i proxy
   ```
4. Test the HTTPS path with curl.

   ```
   curl -I https://github.com
   ```

### How to fix it

1. If the lookup fails for every name, fix DNS. See [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html).
2. If the network needs a proxy, set it for Git.

   ```
   git config --global http.proxy http://proxy.example.com:8080
   ```
3. If an old proxy setting is wrong, remove it.

   ```
   git config --global --unset http.proxy
   ```
4. Correct the remote URL if it has a typing error.

   ```
   git remote set-url origin https://github.com/OWNER/REPO.git
   ```

### With Kilobat

1. Kilobat's connection doctor tests the host layer by layer: network, proxy, DNS, rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why github.com
   ```
2. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**Is GitHub down?**

Maybe, but a lookup error is usually local. If `dscacheutil` finds other names but not github.com, look at your DNS or filter.

### Sources

- [curl: libcurl error codes](https://curl.se/libcurl/c/libcurl-errors.html)
- git-config(1), http.proxy, man page installed with macOS 27.2 (Git 2.56)
- ssh(1) and dscacheutil(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [“curl: (6) Could not resolve host” on Mac](https://kilobat.app/guides/curl-could-not-resolve-host.html): curl exit code 6 means that curl could not get an address for the host name.
- [ssh: connect to host port 22: Operation timed out on Mac](https://kilobat.app/guides/ssh-port-22-operation-timed-out.html): ssh sent a connection request to port 22 and got no answer.
- [SSH and Git time out on a Mac](https://kilobat.app/guides/ssh-git-timeouts.html): SSH and Git need a working TCP connection to the server.
- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html): Some company networks inspect HTTPS traffic.

---

Source: https://kilobat.app/guides/homebrew-curl-28-timed-out.html

Error messages

## Homebrew fails with “curl: (28)” on Mac

Homebrew downloads with curl. curl exit code 28 is a timeout. The curl documentation says: “The specified time-out period was reached.”

Applies to: Current Homebrew on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- `brew install` stops with `curl: (28)`, then a message that the time ran out.
- Homebrew says that it failed to download a resource.
- Downloads fail on a slow network, a VPN or a company network.

### Likely causes

- **A slow or lossy connection.** Large bottles time out on a weak Wi-Fi or a hotspot.
- **A proxy that curl does not use.** Homebrew uses `http_proxy`, `https_proxy` and `all_proxy`.
- **A firewall that drops traffic.** A network that drops connections to the download host causes a timeout.
- **A broken IPv6 path.** The download host has an IPv6 address, and IPv6 does not work.

### How to check

1. Let Homebrew check your system.

   ```
   brew doctor
   ```
2. Test the download host with curl, IPv4 only.

   ```
   curl -4 -I https://ghcr.io/v2/
   ```
3. Show the proxy variables.

   ```
   env | grep -i proxy
   ```
4. Measure the connection.

   ```
   networkQuality
   ```

### How to fix it

1. Let Homebrew try more times. The default is 3 retries.

   ```
   export HOMEBREW_CURL_RETRIES=5
   ```
2. If the network needs a proxy, set it in the same shell.

   ```
   export https_proxy=http://proxy.example.com:8080
   ```
3. If your company has a mirror, set `HOMEBREW_BOTTLE_DOMAIN` and `HOMEBREW_API_DOMAIN`.
4. Run the command again on a faster network, if you can.

### With Kilobat

1. Check if the network is metered, on a VPN or slow.

   ```
   kilobat conditions
   ```
2. Kilobat's connection doctor tests the host layer by layer: network, proxy, DNS, rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why https://ghcr.io/v2/
   ```
3. Keep the Mac awake while the install runs.

   ```
   kilobat awake -- brew upgrade
   ```
4. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**What is curl error 28?**

It is `CURLE_OPERATION_TIMEDOUT`. The curl man page lists exit code 28 as an operation timeout.

### Sources

- [curl: libcurl error codes](https://curl.se/libcurl/c/libcurl-errors.html)
- curl(1), EXIT CODES, man page installed with macOS 27.2
- [Homebrew Docs: Manpage, environment variables](https://docs.brew.sh/Manpage)
- brew(1), HOMEBREW_CURL_RETRIES, man page installed with Homebrew

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Homebrew or npm downloads fail on a Mac](https://kilobat.app/guides/homebrew-npm-download-fails.html): Homebrew downloads with curl and Git.
- [“curl: (6) Could not resolve host” on Mac](https://kilobat.app/guides/curl-could-not-resolve-host.html): curl exit code 6 means that curl could not get an address for the host name.
- [Check the network before a big download in an agent](https://kilobat.app/guides/recipes/check-network-before-download.html): An agent can ask Kilobat if now is a good time for a large transfer.
- [Proxy settings stop apps from connecting on a Mac](https://kilobat.app/guides/proxy-settings-breaking-apps.html): A proxy setting sends traffic through another server.

---

Source: https://kilobat.app/guides/homebrew-npm-download-fails.html

Developers

## Homebrew or npm downloads fail on a Mac

Homebrew downloads with curl and Git. npm downloads from its registry. Each tool reads its own proxy and certificate settings.

Applies to: Current Homebrew and npm on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- `brew install` stops with “curl: (28) … timed out” or “Failed to download resource”.
- `npm install` stops with ETIMEDOUT, ECONNRESET or a certificate error.
- Downloads fail on a company network or VPN only.
- Downloads start and then stop on a slow connection.

### Likely causes

- **A proxy that the tool does not know.** Homebrew uses `http_proxy`, `https_proxy` and `all_proxy`. npm uses its `proxy` and `https-proxy` settings or the same variables.
- **TLS inspection.** A company proxy signs traffic with its own certificate. See [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html).
- **A wrong npm registry.** An old `registry` setting can point to a server that you cannot reach.
- **A slow or metered connection.** Large downloads can time out on a weak Wi-Fi or a hotspot.

### How to check

1. Let Homebrew check your system.

   ```
   brew doctor
   ```
2. Show the Homebrew and system configuration.

   ```
   brew config
   ```
3. Show npm's registry and proxy settings.

   ```
   npm config get registry
   npm config get proxy
   npm config get https-proxy
   ```
4. Ask the npm registry for a reply.

   ```
   npm ping
   ```
5. Test the download host directly with curl.

   ```
   curl -v -o /dev/null https://formulae.brew.sh/api/formula.json
   ```

### How to fix it

1. For Homebrew behind a proxy, set the proxy variable in the same shell.

   ```
   export https_proxy=http://proxy.example.com:8080
   ```
2. For npm behind a proxy, set the npm proxy.

   ```
   npm config set https-proxy http://proxy.example.com:8080
   ```
3. Remove an old npm registry setting so npm uses its default.

   ```
   npm config delete registry
   ```
4. Let Homebrew try a failed download more times.

   ```
   export HOMEBREW_CURL_RETRIES=5
   ```
5. If your company uses a mirror, set it. Homebrew uses `HOMEBREW_BOTTLE_DOMAIN` and `HOMEBREW_API_DOMAIN` for mirrors.
6. For certificate errors, add the company root certificate. See [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html).

### With Kilobat

1. Before a big install, check whether the network is metered, on a VPN or slow.

   ```
   kilobat conditions
   ```
2. Find the layer that stops the download host. Add `--app` to use the proxy variables of that process.

   ```
   kilobat why https://ghcr.io/v2/homebrew/core --app process:curl
   ```
3. Keep the Mac awake while the install runs.

   ```
   kilobat awake -- brew upgrade
   ```
4. These commands are free. See [Check the network before a big download in an agent](https://kilobat.app/guides/recipes/check-network-before-download.html).

### Questions

**Does Homebrew use the System Settings proxy?**

Homebrew's documentation lists proxy variables for curl, Git and Subversion. Set `https_proxy` in your shell.

**How long does npm wait?**

npm's documentation gives a default `fetch-timeout` of 300000 ms, five minutes, and 2 `fetch-retries`.

### Sources

- [Homebrew Docs: Manpage, environment variables](https://docs.brew.sh/Manpage)
- [npm Docs: config](https://docs.npmjs.com/cli/v11/using-npm/config)
- curl(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html): Some company networks inspect HTTPS traffic.
- [Proxy settings stop apps from connecting on a Mac](https://kilobat.app/guides/proxy-settings-breaking-apps.html): A proxy setting sends traffic through another server.
- [Check the network before a big download in an agent](https://kilobat.app/guides/recipes/check-network-before-download.html): An agent can ask Kilobat if now is a good time for a large transfer.
- [SSH and Git time out on a Mac](https://kilobat.app/guides/ssh-git-timeouts.html): SSH and Git need a working TCP connection to the server.
- [“npm error code ETIMEDOUT” on Mac](https://kilobat.app/guides/npm-etimedout.html): ETIMEDOUT means that the other side did not answer in time.

---

Source: https://kilobat.app/guides/hosts-file-not-working.html

DNS

## Changes to /etc/hosts do not work on a Mac

The `/etc/hosts` file maps names to IP addresses on this Mac only. mDNSResponder reads it, but some apps and settings go around it.

Applies to: All current macOS versions. · Checked: 29 October 2026

### Symptoms

- You add a line to `/etc/hosts`, but the browser still opens the old site.
- The entry works in Terminal but not in one app.
- `example.com` works, but `www.example.com` does not.

### Likely causes

- **A wrong line format.** Each line must start with the IP address, then the host name. A `#` starts a comment.
- **A missing name.** The file maps exact names. Add each name that you need, for example `www.example.com` as well as `example.com`.
- **Cached answers.** macOS or the browser can keep the old address for some time.
- **A proxy or an app's own DNS.** With a proxy, the proxy server looks up the name. Some apps also have their own DNS settings.

### How to check

1. Show the file.

   ```
   cat /etc/hosts
   ```
2. Ask the macOS resolver for the name. It must show the address from the file.

   ```
   dscacheutil -q host -a name example.com
   ```
3. Show the system proxy settings. A proxy looks up names itself.

   ```
   scutil --proxy
   ```

### How to fix it

1. Open the file in a text editor as an administrator.

   ```
   sudo nano /etc/hosts
   ```

   Needs an administrator password.
2. Add one line for each name. Put the IP address first, then one or more names.

   ```
   127.0.0.1   example.com www.example.com
   ```
3. Save the file. In nano, press Control-O, then Return, then Control-X.
4. Clear the DNS cache. See [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html).

   ```
   sudo killall -HUP mDNSResponder
   ```

   Needs an administrator password.
5. Quit and open the browser again.
6. If the app uses a proxy, test without the proxy, or add the entry on the proxy server.

### Questions

**Do I need to restart the Mac?**

No. Save the file, clear the DNS cache, then open the app again.

**Can I use a wildcard such as *.example.com?**

No. The hosts file format has an address, an official host name and aliases. Add each name on the line.

### Sources

- hosts(5), man page installed with macOS 27.2
- mDNSResponder(8), man page installed with macOS 27.2
- [Apple Support (archived): Reset the DNS cache in OS X](https://support.apple.com/en-us/101481)
- scutil(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html): macOS keeps DNS answers for some time.
- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [Proxy settings stop apps from connecting on a Mac](https://kilobat.app/guides/proxy-settings-breaking-apps.html): A proxy setting sends traffic through another server.
- [Port already in use on a Mac](https://kilobat.app/guides/port-already-in-use.html): Only one process can listen on a TCP port and address.

---

Source: https://kilobat.app/guides/hotspot-background-data.html

Hotspots and data

## Mac uses Personal Hotspot data in the background

A Mac on a phone hotspot can use a lot of data with no action from you. Find the apps that use it, then pause them.

Applies to: macOS 13 Ventura and later for the System Settings paths. `nettop` is in all current macOS versions. · Checked: 29 October 2026

### Symptoms

- The phone's data plan goes down fast while the Mac is connected to its Personal Hotspot.
- The carrier sends a warning that the data limit is near.
- The hotspot is slow, although you only read email or web pages.

### Likely causes

- **Cloud sync.** iCloud Drive, iCloud Photos and other sync apps upload and download changes when a connection is available.
- **Updates.** macOS, the App Store and app updaters can download large updates in the background.
- **Backups and large uploads.** Cloud backup apps can upload many gigabytes after a long time offline.
- **Apps that ignore the network type.** macOS marks Personal Hotspot as an expensive network, but each app decides what to do with that information.
- **Video and streaming.** Video apps can choose a high quality when the hotspot is fast.

### How to check

1. Open Terminal. Show the processes that use expensive interfaces, such as a hotspot. Press q to stop.

   ```
   nettop -P -t expensive
   ```

   Output One row per process, with the bytes in and bytes out on the expensive interface.
2. To see only the change since you started, add `-d`. Let it run for one minute.

   ```
   nettop -P -d -t expensive
   ```
3. Open Activity Monitor from Applications > Utilities. Click Network.
4. Click the Sent Bytes or Rcvd Bytes column to sort the processes.

### How to fix it

1. Turn on Low Data Mode for the hotspot. Choose Apple menu > System Settings > Wi-Fi.
2. Click Details next to the hotspot network. Turn on Low data mode. Click OK.
3. Pause sync in apps that do not obey Low Data Mode. Use the menu or settings of each app.
4. Stop automatic macOS downloads while you tether. See [Stop Software Update downloading on a hotspot](https://kilobat.app/guides/software-update-on-hotspot.html).
5. Quit apps that you do not need. Quit cloud backup apps until you are on your usual network.
6. Run `nettop` again after some minutes. Make sure that the data use is lower.

### With Kilobat

1. See live upload and download for each app in the menu-bar popover. This is free. See [See which app uses data on a hotspot](https://kilobat.app/guides/recipes/hotspot-data-by-app.html).
2. Use the same view in Terminal.

   ```
   kilobat status --watch
   ```
3. Switch to the Travel profile to block the apps that you did not allow. This needs Pro and the network filter.

   ```
   kilobat profile travel
   ```
4. Set a data budget for the hotspot. With the filter on, new connections stop at the limit. See [Set a monthly data budget that resets on renewal day](https://kilobat.app/guides/recipes/monthly-data-budget.html).

   ```
   kilobat limit 2
   ```
5. With the filter on, Kilobat pauses updater helpers on metered networks. See [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html).

### Questions

**Does macOS know that my Mac uses a hotspot?**

Apple's documentation says that macOS marks cellular and Personal Hotspot connections as expensive. Apps can read this. Other phones' hotspots can look like usual Wi-Fi. See [Make a Mac treat a network as metered](https://kilobat.app/guides/metered-network-mac.html).

**Does Low Data Mode stop all background data?**

No. Apple describes it as a way to reduce data use on that network. Apps decide how much they reduce.

**Why does the carrier figure differ from what the Mac shows?**

The carrier counts all devices on the hotspot and the phone itself. The Mac counts only its own traffic. See [Compare Kilobat with your carrier's data figure](https://kilobat.app/guides/recipes/compare-carrier-usage.html).

### Sources

- nettop(1), man page installed with macOS 27.2
- [Apple Developer: NWPath isExpensive](https://developer.apple.com/documentation/network/nwpath/isexpensive)
- [Apple Support: Wi-Fi settings on Mac](https://support.apple.com/guide/mac-help/mh11935/mac)
- [Apple Support: View network activity in Activity Monitor on Mac](https://support.apple.com/guide/activity-monitor/view-network-activity-actmntr1006/mac)
- [Kilobat docs: Hotspots and data cost](https://kilobat.app/docs.html#data-cost)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Use Low Data Mode on a Mac](https://kilobat.app/guides/low-data-mode-mac.html): Low Data Mode tells macOS and apps to use less data on one Wi-Fi network.
- [Stop Software Update downloading on a hotspot](https://kilobat.app/guides/software-update-on-hotspot.html): macOS can download updates on its own.
- [Make a Mac treat a network as metered](https://kilobat.app/guides/metered-network-mac.html): macOS marks some connections as expensive, such as an iPhone Personal Hotspot.
- [See which app uses data on a hotspot](https://kilobat.app/guides/recipes/hotspot-data-by-app.html): Kilobat shows the upload and download of each app on your Mac.
- [Block an app on metered networks](https://kilobat.app/guides/recipes/block-app-on-metered.html): The Travel profile allows only the apps that you choose.
- [What is nsurlsessiond on Mac?](https://kilobat.app/guides/what-is-nsurlsessiond.html): nsurlsessiond is part of macOS.

---

Source: https://kilobat.app/guides/icloud-private-relay-sites.html

Public Wi-Fi and privacy

## iCloud Private Relay breaks some websites

iCloud Private Relay sends Safari traffic through two relays. Sites that depend on your IP address can then work differently.

Applies to: Private Relay needs an iCloud+ or Apple One subscription. It is not available in all countries or regions. Steps are for macOS 13 Ventura and later. · Checked: 29 October 2026

### Symptoms

- A site asks for extra steps to sign in, or shows a challenge page.
- A site shows content for the wrong region.
- A site works in another browser but not in Safari.
- A message says that a network is not compatible with Private Relay.

### Likely causes

- **The site uses your IP address.** Apple says that sites that use IP filtering, monitoring or rate limits can try to block Private Relay.
- **Location from the IP address.** Private Relay gives a temporary IP address, so the location can be less exact.
- **The network does not support it.** Some networks block Private Relay.
- **Other network software.** Apple says that a VPN or internet filter software can stop Private Relay from working.

### How to check

1. Choose Apple menu > System Settings. Click your name, then iCloud, then Private Relay.
2. Look at the state of Private Relay and the IP Address Location option.
3. In Safari, choose View > Reload and Show IP Address. If the site now works, Private Relay is the cause.

### How to fix it

1. For one site, use View > Reload and Show IP Address in Safari. This is only for the current page load.
2. For local content, set IP Address Location to Maintain general location.
3. For one network, turn off Limit IP address tracking in the network details. See [Limit IP address tracking on a Mac](https://kilobat.app/guides/limit-ip-address-tracking.html).
4. To turn off Private Relay for a short time, choose Turn Off Until Tomorrow.
5. If a VPN or filter app stops Private Relay, turn off that app or remove it.

### Questions

**Does Private Relay hide my IP address from my network provider?**

No. Apple says that your network provider and the first relay can see your IP address. They cannot see which site you visit.

**Why is my speed test slower with Private Relay on?**

Apple says that speed tests can show lower results, because Private Relay uses a single connection.

**Does Private Relay work like a VPN?**

No. Apple designed it to protect Safari browsing. It is not a VPN for all apps.

### Sources

- [Apple Support: About iCloud Private Relay](https://support.apple.com/en-us/102602)
- [Apple Support: Manage iCloud Private Relay for specific websites, networks, or system settings](https://support.apple.com/en-us/102022)
- [Apple Support: Use iCloud Private Relay on Mac](https://support.apple.com/guide/mac-help/mchlecadabe0/mac)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Limit IP address tracking on a Mac](https://kilobat.app/guides/limit-ip-address-tracking.html): Limit IP address tracking is a setting for each network.
- [A website works on your phone but not on your Mac](https://kilobat.app/guides/site-works-on-phone-not-mac.html): When a site opens on your phone but not on your Mac, the problem is usually on the Mac.
- [Safari can’t find the server on a Mac](https://kilobat.app/guides/safari-cant-find-server.html): “Safari can’t find the server” usually means that the Mac could not get an address for the site name.
- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet.html): A VPN sends traffic through a tunnel.

---

Source: https://kilobat.app/guides/instant-hotspot-not-showing.html

Hotspots and data

## iPhone hotspot does not show on the Mac

Instant Hotspot lets a Mac join your iPhone or iPad hotspot without a password. It needs Wi-Fi, Bluetooth and the same Apple Account on both devices.

Applies to: Current macOS and iOS versions. The Automatic option for hotspots is in macOS Tahoe 26 and later. · Checked: 29 October 2026

### Symptoms

- The iPhone or iPad does not appear in the Mac's Wi-Fi menu.
- The Mac asks for a password to join your own hotspot.
- The Mac joined the hotspot once, but it does not find it now.

### Likely causes

- **Bluetooth or Wi-Fi is off.** Both devices must have Wi-Fi and Bluetooth on, and they must be near each other.
- **Different Apple Accounts.** Instant Hotspot works for devices signed in with the same Apple Account, or for members of a family group.
- **Cellular data is off.** If Personal Hotspot is dimmed on the iPhone, Cellular Data is off.
- **The plan does not include Personal Hotspot.** The carrier plan must support Personal Hotspot.

### How to check

1. On the Mac and on the iPhone or iPad, make sure that Wi-Fi and Bluetooth are on.
2. Make sure that both devices use the same Apple Account.
3. On the iPhone, open Settings. Make sure that Personal Hotspot is not dimmed.
4. Put the two devices near each other.

### How to fix it

1. If Personal Hotspot is dimmed, turn on Cellular Data in the Cellular settings of the iPhone.
2. On the Mac, click the Wi-Fi icon in the menu bar or Control Center.
3. Choose the name of the iPhone or iPad that provides the hotspot.
4. To join on its own, open Wi-Fi Settings. Set “Ask to join hotspots” to Ask to Join or Automatic.
5. Restart the iPhone or iPad and the Mac if the hotspot still does not appear.
6. If nothing works, connect with a USB cable. See [Connect a Mac to an iPhone hotspot with a USB cable](https://kilobat.app/guides/usb-tethering-iphone-mac.html).

### With Kilobat

1. Kilobat's Wi-Fi menu does not join Instant Hotspot devices. Use the Wi-Fi controls of macOS for them.
2. After the Mac joins, Kilobat shows which apps use the hotspot data. See [See which app uses data on a hotspot](https://kilobat.app/guides/recipes/hotspot-data-by-app.html).

### Questions

**Do I need Allow Others to Join for Instant Hotspot?**

No. Apple says that Allow Others to Join is not necessary for Instant Hotspot. Other devices that join with the password need it.

**Can a family member use Instant Hotspot?**

Yes. On the iPhone, open Personal Hotspot > Family Sharing. Set each member to Automatic or Ask for Approval.

### Sources

- [Apple Support: Use Instant Hotspot to connect to your Personal Hotspot](https://support.apple.com/en-us/109321)
- [Apple Support: If Personal Hotspot is not working on your iPhone or iPad (Wi-Fi + Cellular)](https://support.apple.com/en-us/119837)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Connect a Mac to an iPhone hotspot with a USB cable](https://kilobat.app/guides/usb-tethering-iphone-mac.html): A USB cable gives a Mac the iPhone's internet connection and charges the iPhone.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.
- [Make a Mac treat a network as metered](https://kilobat.app/guides/metered-network-mac.html): macOS marks some connections as expensive, such as an iPhone Personal Hotspot.
- [See which app uses data on a hotspot](https://kilobat.app/guides/recipes/hotspot-data-by-app.html): Kilobat shows the upload and download of each app on your Mac.

---

Source: https://kilobat.app/guides/internet-connection-appears-offline.html

Error messages

## “The Internet connection appears to be offline.” on Mac

This is the macOS text for error -1009 in the URL Loading System. An app asked for a resource, and macOS had no internet connection for it.

Applies to: All current macOS versions. The text was checked on macOS 27.2. · Checked: 29 October 2026

### Symptoms

- An app shows “The Internet connection appears to be offline.”
- The app may show `NSURLErrorDomain` and `-1009` with the text.
- Only one app shows it, or every app does.

### Likely causes

- **The Mac has no connection.** Apple's documentation says that a connection has not been established and cannot be established automatically.
- **A VPN that is not ready.** A VPN that connects, reconnects or blocks traffic can leave the Mac without a usable path.
- **A firewall or filter that blocks one app.** If only one app fails, a firewall app or a content filter can block that app.
- **A router or provider fault.** The Mac is on the network, but the network has no internet.

### How to check

1. Open a different website. If no site opens, the problem is the connection, not this site.
2. Show the network state that apps see.

   ```
   scutil --nwi
   ```
3. Ping an address on the internet. This test does not use DNS.

   ```
   ping -c 5 1.1.1.1
   ```
4. If only one app fails, look at the rules of your firewall apps for that app.

### How to fix it

1. Fix the connection first. Follow [Mac connected to Wi-Fi but no internet](https://kilobat.app/guides/wifi-connected-no-internet.html).
2. Disconnect and connect the VPN again. Then try the app again.
3. If a firewall app blocks the app, allow it in that firewall app.
4. Quit and open the app again after the connection works.

### With Kilobat

1. Check Wi-Fi, the router, the internet, DNS and a login page in one command.

   ```
   kilobat diagnose
   ```
2. If one app fails, test the path of that app. The doctor also checks Kilobat's rules for it.

   ```
   kilobat why example.com --app com.example.App
   ```
3. List Kilobat's rules, if its filter is on.

   ```
   kilobat rules
   ```
4. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**What is NSURLErrorDomain -1009?**

It is the notConnectedToInternet error of Apple's URL Loading System. macOS shows this text for it.

**Is this the same as Safari's “You Are Not Connected to the Internet”?**

It is the same condition. Safari shows its own page. See [Safari: “You Are Not Connected to the Internet” on Mac](https://kilobat.app/guides/safari-not-connected-to-internet.html).

### Sources

- Error text in CFNetwork.framework, macOS 27.2 (Localizable.loctable)
- [Apple Developer: URLError.Code notConnectedToInternet (-1009)](https://developer.apple.com/documentation/foundation/urlerror/code/notconnectedtointernet)
- [Apple Support: If your Mac isn't connecting to the internet over Wi-Fi](https://support.apple.com/en-us/101588)
- scutil(8) and ping(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Safari: “You Are Not Connected to the Internet” on Mac](https://kilobat.app/guides/safari-not-connected-to-internet.html): Safari shows this page when macOS has no internet connection for it.
- [Mac connected to Wi-Fi but no internet](https://kilobat.app/guides/wifi-connected-no-internet.html): A Wi-Fi connection is only the link to the router.
- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet.html): A VPN sends traffic through a tunnel.
- [A content filter blocks websites on a Mac](https://kilobat.app/guides/content-filter-blocking.html): A content filter examines web traffic and blocks some sites.

---

Source: https://kilobat.app/guides/internet-sharing-mac.html

Ethernet and tethering

## Share a Mac's internet connection with other devices

Internet Sharing lets other devices use the Mac's internet connection. Choose the connection to share and the ports that other devices use.

Applies to: macOS 13 Ventura and later for System Settings > General > Sharing. · Checked: 29 October 2026

### Symptoms

- Other devices cannot find the network that the Mac shares.
- Devices join the shared network but have no internet.
- The network on the source port has problems after you turn on Internet Sharing.

### Likely causes

- **The wrong source.** “Share your connection from” must be the connection that has the internet, such as Ethernet.
- **The same port on both sides.** Apple warns that sharing can disrupt the network when the internet and the local network use the same port.
- **Wi-Fi security that devices do not support.** WPA3 Personal works only when all devices support WPA3.
- **The source has no internet.** Internet Sharing shares only the connection that the Mac has.

### How to check

1. Make sure that the Mac itself has internet on the source connection.
2. Choose Apple menu > System Settings, then click General. Click Sharing.
3. Make sure that Internet Sharing is on. Click Configure to see the source and the ports.

### How to fix it

1. In Sharing, turn on Internet Sharing, then click Configure.
2. In “Share your connection from”, choose the connection that has the internet.
3. In “To devices using”, turn on the port that other devices use, such as Wi-Fi.
4. For Wi-Fi, enter a Network Name and a Password. Change the Channel only if you need to.
5. Choose WPA3 Personal if all devices support it. If not, choose WPA2/WPA3 Personal. Click OK.
6. Click Done.
7. Do not share to the same port as the source. On a cable modem, this can affect other customers' network settings.

### With Kilobat

1. Kilobat counts what the Mac's Wi-Fi and Ethernet counters carry. Traffic for shared devices is not under one app. Hold the pointer over the budget's used figure to see it as “Not tied to an app”.
2. If the source is a hotspot, set a budget for it. See [Set a monthly data budget that resets on renewal day](https://kilobat.app/guides/recipes/monthly-data-budget.html).

### Questions

**Can I share a connection to IPv6-only devices?**

Apple describes a NAT64 option. Option-click the Info button next to Internet Sharing, then turn on Create NAT64 Network.

**Does Internet Sharing use my hotspot data?**

Yes, if the Mac's source connection is a hotspot. All shared devices use that data.

### Sources

- [Apple Support: Share the internet connection on Mac with other network users](https://support.apple.com/guide/mac-help/mchlp1540/mac)
- [Kilobat docs: What counts](https://kilobat.app/docs.html#what-counts)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Connect a Mac to an iPhone hotspot with a USB cable](https://kilobat.app/guides/usb-tethering-iphone-mac.html): A USB cable gives a Mac the iPhone's internet connection and charges the iPhone.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.
- [Mac does not detect a USB or Thunderbolt Ethernet adapter](https://kilobat.app/guides/ethernet-adapter-not-detected.html): A USB or Thunderbolt Ethernet adapter must appear as a hardware port and as a network service.
- [Mac uses the wrong network connection](https://kilobat.app/guides/network-service-order.html): When more than one connection is active, the Mac tries the service at the top of the list first.

---

Source: https://kilobat.app/guides/ip-address-conflict-mac.html

IP, routing and IPv6

## IP address conflict on a Mac

Two devices on one network cannot use the same IP address. macOS checks for a conflict before it uses an address.

Applies to: macOS 13 Ventura and later for the System Settings steps. The Terminal commands work on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- macOS shows a message that another device uses your IP address.
- The connection stops and starts again.
- The problem starts after a new device joins the network.

### Likely causes

- **A manual address that DHCP also gives.** A device with a fixed address inside the DHCP range can take an address that the router gives to the Mac.
- **Two devices with the same manual address.** Someone typed the same address on two devices.
- **Two DHCP servers.** A second router or a hotspot on the same network gives out addresses from the same range.

### How to check

1. Show the service's address and settings.

   ```
   networksetup -getinfo Wi-Fi
   ```
2. List the devices that the Mac has talked to on the local network.

   ```
   arp -a
   ```
3. Show which DHCP server gave the address. Look at the `server_identifier` line.

   ```
   ipconfig getpacket en0
   ```

### How to fix it

1. If the Mac uses DHCP, wait a few minutes. Apple says the DHCP server usually gives the Mac another address.
2. Renew the lease to get a new address now. See [Renew the DHCP lease on a Mac](https://kilobat.app/guides/renew-dhcp-lease-mac.html).
3. If you typed the address by hand, make sure that it is correct and not in the router's DHCP range.
4. On a managed network, ask the administrator for a free address.
5. Remove or turn off a second DHCP server, such as an extra router in router mode.

### With Kilobat

1. The CLI lists devices from the Mac's neighbor cache, with names that you gave them.

   ```
   kilobat devices
   ```

### Questions

**Can the router reserve an address for my Mac?**

Many routers can. Look for DHCP reservation in the router's settings.

### Sources

- [Apple Support: Resolve IP address conflicts on Mac](https://support.apple.com/guide/mac-help/resolve-ip-address-conflicts-on-mac-mh27606/mac)
- ipconfig(8), man page installed with macOS 27.2
- arp(8), man page installed with macOS 27.2
- [Apple Support: Change TCP/IP settings on Mac](https://support.apple.com/guide/mac-help/change-tcp-ip-settings-on-mac-mchlp2718/mac)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Renew the DHCP lease on a Mac](https://kilobat.app/guides/renew-dhcp-lease-mac.html): A DHCP lease gives the Mac its IP address, router and DNS servers.
- [Mac has a self-assigned IP address](https://kilobat.app/guides/self-assigned-ip-address.html): If the Mac gets no answer from a DHCP server, it gives itself a link-local address from 169.254.0.0/16.
- [Find the devices on your local network from a Mac](https://kilobat.app/guides/find-devices-on-network.html): macOS has two built-in ways to see other devices: the ARP table and Bonjour.
- [See Mac network settings in Terminal](https://kilobat.app/guides/network-settings-terminal.html): macOS includes command-line tools that show the same network settings as System Settings, and more.

---

Source: https://kilobat.app/guides/ipv6-problems-mac.html

IP, routing and IPv6

## IPv6 problems on a Mac

Most networks give a Mac both IPv4 and IPv6 addresses. If the IPv6 path is broken, some connections wait or fail.

Applies to: macOS 13 Ventura and later for the System Settings steps. The Terminal commands work on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Some sites or APIs hang, but others load at once.
- A tool connects after a delay, or after some retries.
- Connections work on one network but not on another network.

### Likely causes

- **A router that announces IPv6 but does not route it.** The Mac gets an IPv6 address, but traffic over IPv6 does not reach the internet.
- **A provider or VPN without full IPv6.** Some VPNs carry only IPv4. IPv6 traffic then goes outside the tunnel or fails.
- **A firewall that blocks IPv6.** A router or company firewall can block IPv6 traffic while it allows IPv4.

### How to check

1. Find the device name of each network port, for example `en0` for Wi-Fi.

   ```
   networksetup -listallhardwareports
   ```
2. Show the IPv6 addresses of the Wi-Fi interface. Addresses that start with `fe80` are link-local only.

   ```
   ifconfig en0 inet6
   ```
3. Show the router advertisement that the Mac accepted. An error means that no IPv6 router answered.

   ```
   ipconfig getra en0
   ```
4. Send pings over IPv6 to a public address.

   ```
   ping6 -c 3 2606:4700:4700::1111
   ```
5. Request a site over IPv4 only, then over IPv6 only. Compare the results.

   ```
   curl -4 -I https://www.apple.com
   ```
6. If the IPv4 request works and the IPv6 request fails, the IPv6 path is broken.

   ```
   curl -6 -I https://www.apple.com
   ```

### How to fix it

1. Restart the router. Then test again.
2. Update the router's firmware, or ask the provider about IPv6 on your line.
3. For a test, turn IPv6 off on the service.

   ```
   networksetup -setv6off Wi-Fi
   ```

   Needs an administrator password.
4. Turn IPv6 on again after the test. Use the automatic setting.

   ```
   networksetup -setv6automatic Wi-Fi
   ```

   Needs an administrator password.
5. You can also use the Configure IPv6 menu in System Settings > Network > the service > Details > TCP/IP.
6. If the problem stops only with IPv6 off, report it to the network owner or the provider.

### With Kilobat

1. `why` tries IPv4 and IPv6 apart and says which one fails.

   ```
   kilobat why api.example.com
   ```
2. The MCP tool `diagnose_connection` returns the same steps for an agent. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**Should I keep IPv6 off?**

No. Turn it off only for a test. Ask the network owner to fix IPv6, then turn it on again.

**What is a link-local address?**

An address that starts with `fe80` works only on the local link. It does not reach the internet.

### Sources

- networksetup(8), man page installed with macOS 27.2
- ipconfig(8), man page installed with macOS 27.2
- ping6(8), man page installed with macOS 27.2
- curl(1), man page installed with macOS 27.2
- [Apple Support: Change TCP/IP settings on Mac](https://support.apple.com/guide/mac-help/change-tcp-ip-settings-on-mac-mchlp2718/mac)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.
- [MTU problems on a Mac](https://kilobat.app/guides/mtu-problems-mac.html): The MTU is the largest packet that an interface sends.
- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet.html): A VPN sends traffic through a tunnel.
- [A website works on your phone but not on your Mac](https://kilobat.app/guides/site-works-on-phone-not-mac.html): When a site opens on your phone but not on your Mac, the problem is usually on the Mac.

---

Source: https://kilobat.app/guides/limit-ip-address-tracking.html

Public Wi-Fi and privacy

## Limit IP address tracking on a Mac

Limit IP address tracking is a setting for each network. It hides your IP address from known trackers in Mail and Safari. It also controls iCloud Private Relay on that network.

Applies to: macOS 13 Ventura and later. In macOS 12 Monterey, the setting is in the network settings with a checkmark. · Checked: 29 October 2026

### Symptoms

- A school or company network asks you to turn the setting off.
- A site works with the setting off and fails with it on.
- You are not sure if the setting is on for a network.

### Likely causes

- **Private Relay on the network.** Apple says that turning the setting off turns off Private Relay for that network.
- **Networks that filter traffic.** Some networks block or do not support Private Relay. Apple says that you can then turn it off for that network.

### How to check

1. Choose Apple menu > System Settings > Wi-Fi.
2. Click Details next to the network name.
3. Read the state of Limit IP address tracking.
4. For Ethernet, choose System Settings > Network. Click the Ethernet service, then Details.

### How to fix it

1. To turn the setting off for one network, turn off Limit IP address tracking in the network details.
2. Do this for each network separately. The setting is for each network.
3. To turn it on again, turn on the same setting.
4. If a network says that it does not support Private Relay, turn the setting off for that network only.

### Questions

**Does this setting hide my IP address from all apps?**

No. Apple says that it hides your IP address from known trackers in Mail and Safari.

**Does the setting apply to all my devices?**

Apple says that the setting for a network applies to all your devices that have Private Relay on.

### Sources

- [Apple Support: Wi-Fi settings on Mac](https://support.apple.com/guide/mac-help/mh11935/mac)
- [Apple Support: Manage iCloud Private Relay for specific websites, networks, or system settings](https://support.apple.com/en-us/102022)
- [Apple Support: Use iCloud Private Relay on Mac](https://support.apple.com/guide/mac-help/mchlecadabe0/mac)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [iCloud Private Relay breaks some websites](https://kilobat.app/guides/icloud-private-relay-sites.html): iCloud Private Relay sends Safari traffic through two relays.
- [Private Wi-Fi address on a Mac](https://kilobat.app/guides/private-wifi-address.html): A private Wi-Fi address replaces the hardware MAC address of the Mac on a network.
- [A website works on your phone but not on your Mac](https://kilobat.app/guides/site-works-on-phone-not-mac.html): When a site opens on your phone but not on your Mac, the problem is usually on the Mac.

---

Source: https://kilobat.app/guides/local-network-permission.html

Local network

## An app cannot find devices on the local network

macOS 15 Sequoia and later ask before an app connects to devices on your local network. If you deny it, the app cannot reach them.

Applies to: macOS 15 Sequoia and later. · Checked: 29 October 2026

### Symptoms

- An app cannot find a printer, NAS, camera or smart device that other apps find.
- A connection to a local IP address waits and then fails in one app only.
- The same command works in Terminal but not in the app.
- You clicked Don't Allow on an earlier prompt from the app.

### Likely causes

- **Local Network access is off for the app.** The app's switch in Privacy & Security > Local Network is off.
- **The app is not in the list yet.** macOS adds an app after it first asks for local network access.
- **A launch agent.** Apple's technote says that daemons and Terminal tools are exempt, but launch agents are not.

### How to check

1. Choose Apple menu > System Settings > Privacy & Security.
2. Click Local Network. Find the app in the list.
3. Run the same test from Terminal. Terminal tools do not need this permission. If Terminal works, the permission is the likely cause.

   ```
   ping -c 3 192.168.1.20
   ```

### How to fix it

1. In Privacy & Security > Local Network, turn on the switch for the app.
2. Quit the app and open it again.
3. If the app is not in the list, open it and start the action that uses the local network. Then click Allow at the prompt.
4. If your organization manages the Mac, ask your IT team. They can manage this setting.

### With Kilobat

1. Kilobat lists devices that the Mac talked to on the local network recently.

   ```
   kilobat devices --bonjour
   ```
2. Kilobat's own device discovery in the dashboard is part of Pro.

### Questions

**What counts as the local network?**

Apple's technote says Wi-Fi and Ethernet networks, plus multicast and broadcast addresses. VPN and cellular networks do not count.

**Does Safari need this permission?**

No. Apple's technote says that traffic from Safari and web views does not need local network access.

### Sources

- [Apple Support: Control access to your local network on Mac](https://support.apple.com/guide/mac-help/control-access-to-your-local-network-mchla4f49138/mac)
- [Apple Developer: TN3179 Understanding local network privacy](https://developer.apple.com/documentation/technotes/tn3179-understanding-local-network-privacy)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Find the devices on your local network from a Mac](https://kilobat.app/guides/find-devices-on-network.html): macOS has two built-in ways to see other devices: the ARP table and Bonjour.
- [The macOS firewall blocks incoming connections](https://kilobat.app/guides/macos-firewall-incoming.html): The macOS firewall controls connections that other computers start to your Mac.
- [Port 5000 or 7000 is in use on a Mac: AirPlay Receiver](https://kilobat.app/guides/airplay-receiver-port-5000.html): Apple lists TCP ports 5000 and 7000 for AirPlay.
- [A container cannot reach localhost on the Mac](https://kilobat.app/guides/localhost-from-container.html): Each container has its own network stack.

---

Source: https://kilobat.app/guides/localhost-from-container.html

Developers

## A container cannot reach localhost on the Mac

Each container has its own network stack. In a container, `localhost` is the container itself, not the Mac.

Applies to: Docker Desktop and OrbStack on current macOS versions. · Checked: 29 October 2026

### Symptoms

- An app in a container gets “connection refused” on `localhost:5432` or a similar port.
- The same URL works in Safari or Terminal on the Mac.
- A model server or API on the Mac is not reachable from a dev container.

### Likely causes

- **localhost points to the container.** The container looks for the service in its own network stack, where nothing listens.
- **The host address changes.** Docker's documentation says that the host IP address changes. It gives a special name for the host instead.
- **A firewall on the Mac.** The macOS firewall or another firewall app can block incoming connections to the service.

### How to check

1. Make sure that the service works on the Mac. Replace 8000 with your port.

   ```
   curl http://localhost:8000
   ```
2. See which address the Mac service listens on.

   ```
   lsof -nP -iTCP:8000 -sTCP:LISTEN
   ```

   Output `*:8000` means all addresses. `127.0.0.1:8000` means the loopback address only.
3. Test the host name from inside the container, if the image includes wget.

   ```
   docker exec my-container wget -qO- http://host.docker.internal:8000
   ```

### How to fix it

1. In the container, use `host.docker.internal` instead of `localhost`. Docker Desktop and OrbStack both support this name.
2. Set the address in the app's configuration, for example in an environment variable.

   ```
   docker run -e API_URL=http://host.docker.internal:8000 my-image
   ```
3. With OrbStack, you can use host networking instead. Then Mac services are on `localhost` in the container.

   ```
   docker run --net host my-image
   ```
4. If the connection still fails, look at the macOS firewall settings. See [The macOS firewall blocks incoming connections](https://kilobat.app/guides/macos-firewall-incoming.html).

### With Kilobat

1. Kilobat's checks run on the Mac, not in the container. Add `--context container` to get a command to run in the container.

   ```
   kilobat why http://localhost:8000 --context container
   ```
2. If a hosted service calls your Mac, use `--context provider`. Kilobat then says that localhost is private and out of its reach.

   ```
   kilobat why http://localhost:8000 --context provider
   ```

### Questions

**Does host.docker.internal work on Linux too?**

This page covers the Mac. On Docker Desktop for Mac and OrbStack, the name resolves to the host.

**Why does Safari reach the service when the container cannot?**

Safari runs on the Mac, so localhost is the Mac. The container has its own localhost.

### Sources

- [Docker Docs: Explore networking how-tos on Docker Desktop](https://docs.docker.com/desktop/features/networking/networking-how-tos/)
- [OrbStack Docs: Container networking](https://docs.orbstack.dev/docker/network)
- [OrbStack Docs: Host networking](https://docs.orbstack.dev/docker/host-networking)
- lsof(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Cannot reach a Docker container from the Mac](https://kilobat.app/guides/docker-container-from-mac.html): Docker on a Mac runs containers in a Linux virtual machine.
- [The macOS firewall blocks incoming connections](https://kilobat.app/guides/macos-firewall-incoming.html): The macOS firewall controls connections that other computers start to your Mac.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.
- [Port already in use on a Mac](https://kilobat.app/guides/port-already-in-use.html): Only one process can listen on a TCP port and address.

---

Source: https://kilobat.app/guides/low-data-mode-mac.html

Hotspots and data

## Use Low Data Mode on a Mac

Low Data Mode tells macOS and apps to use less data on one Wi-Fi network. It is a setting for each network, not for the whole Mac.

Applies to: macOS 13 Ventura and later. The setting is in Wi-Fi Details in System Settings. · Checked: 29 October 2026

### Symptoms

- You want the Mac to use less data on a hotspot, a plane or a hotel network.
- You cannot find a Low Data Mode switch for the whole Mac.
- Low Data Mode is on, but some apps still use a lot of data.

### Likely causes

- **The setting is for one network.** You set Low data mode in the Details of each Wi-Fi network. Other networks keep their own setting.
- **Apps decide what to reduce.** Apps read whether the network is in Low Data Mode. Each app decides how much background work it stops.
- **You are not connected to the network.** Wi-Fi Details shows the settings for networks that the Mac knows. Connect to the network first to change it.

### How to check

1. Choose Apple menu > System Settings, then click Wi-Fi in the sidebar.
2. Click Details next to the network that you use now.
3. Look at the Low data mode switch.

### How to fix it

1. In Wi-Fi Details, turn on Low data mode. Click OK.
2. Do this again for each network where you want to use less data.
3. To find apps that still use data, follow the steps in [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html).
4. Pause sync or updates in apps that do not reduce their data use.

### With Kilobat

1. Get Low Data Mode, the metered state and the VPN state in one line.

   ```
   kilobat conditions --json
   ```

   Output JSON with `lowDataMode`, `metered`, `osMetered`, `meteredSource` and one line of `advice`.
2. Kilobat does not change Low Data Mode. It can block apps on metered networks with Pro and the network filter. See [Block an app on metered networks](https://kilobat.app/guides/recipes/block-app-on-metered.html).

### Questions

**Is Low Data Mode the same as a metered network?**

No. Apple's Network framework reports them separately. `isConstrained` means Low Data Mode. `isExpensive` means a cellular or Personal Hotspot interface. See [Make a Mac treat a network as metered](https://kilobat.app/guides/metered-network-mac.html).

**Does Low Data Mode work on Ethernet?**

The Apple guide describes the setting in the Details of a Wi-Fi network. This guide covers Wi-Fi only.

### Sources

- [Apple Support: Wi-Fi settings on Mac](https://support.apple.com/guide/mac-help/mh11935/mac)
- [Apple Support: Change Wi-Fi settings on Mac (macOS 13)](https://support.apple.com/guide/mac-help/change-wi-fi-settings-on-mac-mh11935/13.0/mac/13.0)
- [Apple Developer: NWPath isConstrained](https://developer.apple.com/documentation/network/nwpath/isconstrained)
- [Apple Developer: NWPath isExpensive](https://developer.apple.com/documentation/network/nwpath/isexpensive)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.
- [Make a Mac treat a network as metered](https://kilobat.app/guides/metered-network-mac.html): macOS marks some connections as expensive, such as an iPhone Personal Hotspot.
- [Stop Software Update downloading on a hotspot](https://kilobat.app/guides/software-update-on-hotspot.html): macOS can download updates on its own.
- [Check the network before a big download in an agent](https://kilobat.app/guides/recipes/check-network-before-download.html): An agent can ask Kilobat if now is a good time for a large transfer.

---

Source: https://kilobat.app/guides/mac-joins-wrong-wifi.html

Wi-Fi

## Mac joins the wrong Wi-Fi network

The Mac joins known networks on its own. When several known networks are in range, it can select one that you do not want.

Applies to: macOS 13 Ventura and later for the System Settings steps. · Checked: 29 October 2026

### Symptoms

- The Mac joins a neighbor's guest network or an old network.
- The Mac joins your phone's hotspot when home Wi-Fi is available.
- After wake or restart, the Mac is on a different network.

### Likely causes

- **Auto-join is on for a network you do not want.** Each known network has its own Automatically join this network setting.
- **Hotspot auto-join.** With Ask to join hotspots, the Mac can join a Personal Hotspot when no known Wi-Fi network is found.
- **Different names for each band.** Apple says that different band names make devices connect unreliably, or to the wrong network.
- **Common default names.** Apple says that common default names make devices more likely to join the wrong network.

### How to check

1. Choose Apple menu > System Settings > Wi-Fi. Look at the Known Networks list.
2. List the known networks from Terminal.

   ```
   networksetup -listpreferredwirelessnetworks en0
   ```
3. Hold the Option key and click the Wi-Fi icon. Make sure of the name of the current network.

### How to fix it

1. In System Settings > Wi-Fi, click Details next to the network that you do not want.
2. Turn off Automatically join this network. The Mac keeps the network, but does not join it on its own.
3. To remove a network, click Forget This Network.
4. To remove a network from Terminal, enter its name.

   ```
   sudo networksetup -removepreferredwirelessnetwork en0 "Old Network"
   ```

   Needs an administrator password.
5. To control hotspots, change Ask to join hotspots in System Settings > Wi-Fi.
6. If you manage the router, give it a unique name, the same for all bands.

### With Kilobat

1. List the saved networks in order of preference.

   ```
   kilobat wifi known
   ```
2. Join the network that you want.

   ```
   kilobat wifi join "Home"
   ```

### Questions

**Can I change the order of known networks?**

The Wi-Fi settings on macOS 13 and later do not show a way to sort the list. Use the auto-join setting of each network instead.

**Does Forget This Network remove the password?**

Yes. You must enter the password again to join the network.

### Sources

- [Apple Support: Wi-Fi settings on Mac](https://support.apple.com/guide/mac-help/mh11935/mac)
- [Apple Support: Recommended settings for Wi-Fi routers and access points](https://support.apple.com/en-us/102766)
- networksetup(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Mac Wi-Fi disconnects after sleep](https://kilobat.app/guides/wifi-disconnects-after-sleep.html): After sleep, the Mac must join the Wi-Fi network again.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.
- [Find a saved Wi-Fi password on a Mac](https://kilobat.app/guides/find-saved-wifi-password.html): The Mac stores the password of each Wi-Fi network that it joins.
- [2.4 GHz, 5 GHz and 6 GHz Wi-Fi on a Mac](https://kilobat.app/guides/wifi-bands-2-4-5-6-ghz.html): Wi-Fi uses three bands.

---

Source: https://kilobat.app/guides/mac-sleep-stops-downloads.html

Sleep and power

## Mac sleep stops downloads

A Mac that goes to sleep stops most app activity, so a long download can stop or fail. Keep the Mac awake for the download, then let it sleep again.

Applies to: macOS 13 Ventura and later for the System Settings paths. `pmset` and `caffeinate` are in all current macOS versions. · Checked: 29 October 2026

### Symptoms

- A large download stops when you leave the Mac.
- The download app shows an error or starts again after the Mac wakes.
- Uploads and backups do not finish overnight.

### Likely causes

- **Idle sleep.** macOS puts the Mac to sleep after a time with no input. Network activity does not always stop this.
- **Display sleep on a laptop.** On a Mac laptop, the system can sleep when the display turns off, unless you change the setting.
- **Battery power.** On battery, the Mac uses its battery settings, which save power.
- **The lid.** Closing the lid of a Mac laptop puts it to sleep. See [Keep a Mac laptop working with the lid closed](https://kilobat.app/guides/clamshell-lid-closed-mac.html).

### How to check

1. See which processes now prevent sleep. If none is there for the download app, the Mac can sleep.

   ```
   pmset -g assertions
   ```
2. See the sleep and display sleep times that are in use.

   ```
   pmset -g
   ```
3. Choose Apple menu > System Settings > Lock Screen. Look at the times to turn the display off.

### How to fix it

1. Keep the Mac awake for one download with `caffeinate`. It stops when you press Control-C.

   ```
   caffeinate -i
   ```
2. Or keep it awake for a fixed time, in seconds. This example is four hours.

   ```
   caffeinate -i -t 14400
   ```
3. On a Mac laptop, choose System Settings > Battery > Options.
4. Turn on “Prevent automatic sleeping on power adapter when the display is off”. Connect the power adapter.
5. On a Mac desktop, choose System Settings > Energy. Turn on “Prevent automatic sleeping when the display is off”.
6. Turn the setting off again after the download if you do not need it. Apple says that it can increase power use.

### With Kilobat

1. Open Kilobat from the menu bar, click the teacup and choose Until Downloads Finish. The Mac can sleep again when transfers go quiet.
2. Or use the CLI. It ends after 3 minutes below 16 KB/s.

   ```
   kilobat awake --until-quiet
   ```
3. Watch one app only. Use the app's id from `kilobat status --json`.

   ```
   kilobat awake --until-quiet --app com.apple.Safari
   ```
4. Keeping the Mac awake is free. See [Keep your Mac awake until a download finishes](https://kilobat.app/guides/recipes/keep-mac-awake-download.html).

### Questions

**Does the laptop setting work on battery?**

No. The setting is “Prevent automatic sleeping on power adapter when the display is off”. It applies when the power adapter is connected.

**Will the Mac sleep when I close the lid?**

Yes. Closing the lid puts a Mac laptop to sleep, unless you use it with an external display. See [Keep a Mac laptop working with the lid closed](https://kilobat.app/guides/clamshell-lid-closed-mac.html).

### Sources

- [Apple Support: Set sleep and wake settings for your Mac](https://support.apple.com/guide/mac-help/prevent-your-mac-from-sleeping-mchle41a6ccd/mac)
- [Apple Support: Put your Mac to sleep or wake it](https://support.apple.com/guide/mac-help/mh10330/mac)
- caffeinate(8), man page installed with macOS 27.2
- pmset(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Keep a Mac awake from Terminal with caffeinate](https://kilobat.app/guides/caffeinate-keep-mac-awake.html): The caffeinate command stops a Mac from sleeping while a task runs.
- [Keep your Mac awake until a download finishes](https://kilobat.app/guides/recipes/keep-mac-awake-download.html): Kilobat keeps the Mac awake while transfers run.
- [Keep a Mac laptop working with the lid closed](https://kilobat.app/guides/clamshell-lid-closed-mac.html): Closing the lid puts a Mac laptop to sleep.
- [Use Wake for network access on a Mac](https://kilobat.app/guides/wake-for-network-access.html): Wake for network access lets a sleeping Mac wake when another computer uses its shared resources.

---

Source: https://kilobat.app/guides/macos-firewall-incoming.html

Local network

## The macOS firewall blocks incoming connections

The macOS firewall controls connections that other computers start to your Mac. It does not control connections that your apps start.

Applies to: macOS 13 Ventura and later for System Settings > Network > Firewall. Earlier versions use Security & Privacy. · Checked: 29 October 2026

### Symptoms

- Other devices cannot connect to a server, game or sharing service on your Mac.
- The Mac does not answer ping from another device.
- A dev server works on the Mac but not from your phone on the same Wi-Fi.
- macOS asks whether an app can accept incoming network connections.

### Likely causes

- **Block all incoming connections.** Apple says that this option blocks connections to nonessential services and to all other sharing services.
- **A denied app.** You clicked Deny at an earlier prompt, or the app is set to block in Firewall Options.
- **Stealth mode.** The Mac does not answer probe requests such as ping.
- **The server listens on 127.0.0.1.** Then only the Mac can connect, whatever the firewall setting.

### How to check

1. Choose Apple menu > System Settings > Network > Firewall. See whether Firewall is on.
2. Click Options. Look at the setting for your app and at Block all incoming connections.
3. Show the firewall state from Terminal.

   ```
   /usr/libexec/ApplicationFirewall/socketfilterfw --getglobalstate
   /usr/libexec/ApplicationFirewall/socketfilterfw --getblockall
   /usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode
   ```
4. Make sure that the server listens on all addresses, not 127.0.0.1 only.

   ```
   lsof -nP -iTCP:8000 -sTCP:LISTEN
   ```

### How to fix it

1. In Firewall Options, turn off Block all incoming connections if you need sharing or servers.
2. Click the Add button and select the app. Set it to allow incoming connections.
3. Click OK. Test the connection from the other device again.
4. You can also allow an app from Terminal. Replace the path with your app.

   ```
   sudo /usr/libexec/ApplicationFirewall/socketfilterfw --unblockapp /Applications/Example.app
   ```

   Needs an administrator password.
5. Keep the firewall on. Allow only the apps that must accept connections.

### With Kilobat

1. Kilobat's filter controls the connections that your apps start. It does not replace the macOS firewall for incoming connections.
2. To see the open sockets of a server process, use the destinations command.

   ```
   kilobat destinations --pid 12345
   ```

### Questions

**Does the macOS firewall block outgoing connections?**

No. Apple describes it as protection from connections that other computers start. Use a filter app for outgoing connections.

**What does stealth mode do?**

The Mac does not answer probe requests such as ping from unknown sources. Allowed apps still get their requests.

### Sources

- [Apple Support: Change Firewall settings on Mac](https://support.apple.com/guide/mac-help/change-firewall-preferences-on-mac-mh11783/mac)
- [Apple Support: Block connections to your Mac with a firewall](https://support.apple.com/guide/mac-help/block-connections-to-your-mac-with-a-firewall-mh34041/mac)
- [Apple Platform Security: Application Firewall](https://support.apple.com/guide/security/application-firewall-seca0e83763f/web)
- socketfilterfw(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [An app cannot find devices on the local network](https://kilobat.app/guides/local-network-permission.html): macOS 15 Sequoia and later ask before an app connects to devices on your local network.
- [A container cannot reach localhost on the Mac](https://kilobat.app/guides/localhost-from-container.html): Each container has its own network stack.
- [Little Snitch, LuLu and other network extensions conflict on a Mac](https://kilobat.app/guides/network-extension-conflicts.html): Firewalls, VPNs and content filters on macOS use network extensions.
- [Find the devices on your local network from a Mac](https://kilobat.app/guides/find-devices-on-network.html): macOS has two built-in ways to see other devices: the ARP table and Bonjour.

---

Source: https://kilobat.app/guides/metered-network-mac.html

Hotspots and data

## Make a Mac treat a network as metered

macOS marks some connections as expensive, such as an iPhone Personal Hotspot. Other phone hotspots can look like usual Wi-Fi to the Mac.

Applies to: macOS 10.14 and later for the expensive flag that apps read. macOS 13 Ventura and later for Low data mode in Wi-Fi Details. · Checked: 29 October 2026

### Symptoms

- Apps behave on an Android hotspot as they do on home Wi-Fi.
- Updates and sync run while the Mac is tethered to a phone over USB.
- Low Data Mode is off on a network that costs you money for each gigabyte.

### Likely causes

- **macOS knows only some connections.** Apple's documentation names cellular and Personal Hotspot as expensive interfaces. It does not name other phones' hotspots.
- **Tethering can look like Ethernet.** A phone connected with a cable can appear as a wired or USB network service.
- **macOS has no switch to mark a network as expensive.** System Settings has Low data mode for a Wi-Fi network. It does not have a metered switch.

### How to check

1. Show the processes that use expensive interfaces. If no process appears while apps use the network, macOS does not treat it as expensive.

   ```
   nettop -P -l 1 -t expensive
   ```
2. Choose Apple menu > System Settings > Wi-Fi. Click Details next to the network.
3. Look at the Low data mode switch for this network.

### How to fix it

1. On a Wi-Fi hotspot, turn on Low data mode in Wi-Fi Details. Click OK.
2. On an iPhone, use Personal Hotspot when you can. macOS marks it as expensive.
3. Pause sync, backups and updates by hand while you use the connection. See [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html).
4. Turn off automatic macOS downloads. See [Stop Software Update downloading on a hotspot](https://kilobat.app/guides/software-update-on-hotspot.html).

### With Kilobat

1. Kilobat gives each network a data cost: Automatic, Metered or Unmetered. Automatic follows macOS.
2. Mark the current network as metered. This works for Android hotspots and USB or Ethernet tethering.

   ```
   kilobat networks cost metered
   ```
3. You can also set it in the Wi-Fi menu, the budget menu, the Health tab or Settings.
4. See what Kilobat acts on and what macOS says.

   ```
   kilobat conditions --json
   ```

   Output `metered`, `osMetered` and `meteredSource`, which is `macOS` or `you`.
5. On a metered network, Kilobat switches to Travel and skips scheduled speed tests. Blocking needs Pro and the network filter.
6. For Wi-Fi, Kilobat needs Location access to tell networks apart. See [Block an app on metered networks](https://kilobat.app/guides/recipes/block-app-on-metered.html).

### Questions

**Can I mark a network as metered in System Settings?**

No. System Settings has Low data mode for each Wi-Fi network. Low Data Mode and expensive are two different flags.

**How do apps know that a connection is expensive?**

Apps that use Apple's Network framework can read `isExpensive` and `isConstrained` on the current path.

### Sources

- [Apple Developer: NWPath isExpensive](https://developer.apple.com/documentation/network/nwpath/isexpensive)
- [Apple Developer: NWPath isConstrained](https://developer.apple.com/documentation/network/nwpath/isconstrained)
- [Apple Support: Wi-Fi settings on Mac](https://support.apple.com/guide/mac-help/mh11935/mac)
- nettop(1), man page installed with macOS 27.2
- [Kilobat docs: Hotspots and data cost](https://kilobat.app/docs.html#data-cost)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Use Low Data Mode on a Mac](https://kilobat.app/guides/low-data-mode-mac.html): Low Data Mode tells macOS and apps to use less data on one Wi-Fi network.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.
- [Connect a Mac to an iPhone hotspot with a USB cable](https://kilobat.app/guides/usb-tethering-iphone-mac.html): A USB cable gives a Mac the iPhone's internet connection and charges the iPhone.
- [Block an app on metered networks](https://kilobat.app/guides/recipes/block-app-on-metered.html): The Travel profile allows only the apps that you choose.
- [Set a monthly data budget that resets on renewal day](https://kilobat.app/guides/recipes/monthly-data-budget.html): A Kilobat budget belongs to one network.

---

Source: https://kilobat.app/guides/mtu-problems-mac.html

IP, routing and IPv6

## MTU problems on a Mac

The MTU is the largest packet that an interface sends. If a link in the path takes only smaller packets, large transfers can stall.

Applies to: macOS 13 Ventura and later for the System Settings steps. The Terminal commands work on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Some sites start to load, then stop.
- Small requests work, but uploads or large downloads stall.
- Problems start only with a VPN on, or only on one network.

### Likely causes

- **A link with a smaller MTU.** PPPoE, VPN tunnels and some mobile links carry smaller packets than standard Ethernet, which uses 1500 bytes.
- **Blocked ICMP messages.** A firewall that blocks ICMP can stop the Mac from learning that a packet is too large.
- **A manual MTU setting.** A value set by hand can be too large or too small for this network.

### How to check

1. Find the device name of each network port, for example `en0` for Wi-Fi.

   ```
   networksetup -listallhardwareports
   ```
2. Show the MTU of the interface.

   ```
   networksetup -getMTU en0
   ```
3. Send a ping of 1472 data bytes with the Don't Fragment bit set. With 28 header bytes, it makes 1500 bytes.

   ```
   ping -D -s 1472 -c 3 1.1.1.1
   ```
4. If no replies come back, try smaller sizes. Find the largest size that gets replies, then add 28.

   ```
   ping -D -s 1464 -c 3 1.1.1.1
   ```
5. Show the MTU values that the interface accepts.

   ```
   networksetup -listValidMTURange en0
   ```

### How to fix it

1. Change the MTU only on the advice of your provider or administrator, or after the test above.
2. Choose Apple menu > System Settings > Network. Click the service, click Details, then click Hardware.
3. Set Configure to Manual, then enter the MTU.
4. Or set it in Terminal. This example uses 1492, a common value for PPPoE.

   ```
   networksetup -setMTU en0 1492
   ```

   Needs an administrator password.
5. To go back to the automatic MTU, use this command.

   ```
   networksetup -setMTUAndMediaAutomatically en0
   ```

   Needs an administrator password.
6. For a VPN, change the MTU in the VPN app, if it has this setting.

### Questions

**Why does 1472 give 1500?**

An IPv4 ping packet has a 20-byte IP header and an 8-byte ICMP header. 1472 data bytes plus 28 header bytes make 1500.

**Why 1492 for PPPoE?**

PPPoE adds its own header inside an Ethernet frame. RFC 2516 limits the PPPoE MRU to 1492 bytes.

### Sources

- networksetup(8), man page installed with macOS 27.2
- ping(8), man page installed with macOS 27.2
- [Apple Support: Change Hardware settings on Mac](https://support.apple.com/guide/mac-help/change-hardware-settings-on-mac-mchlp2505/mac)
- [RFC 2516: A Method for Transmitting PPP Over Ethernet (PPPoE)](https://www.rfc-editor.org/rfc/rfc2516)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [IPv6 problems on a Mac](https://kilobat.app/guides/ipv6-problems-mac.html): Most networks give a Mac both IPv4 and IPv6 addresses.
- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet.html): A VPN sends traffic through a tunnel.
- [SSH and Git time out on a Mac](https://kilobat.app/guides/ssh-git-timeouts.html): SSH and Git need a working TCP connection to the server.
- [See Mac network settings in Terminal](https://kilobat.app/guides/network-settings-terminal.html): macOS includes command-line tools that show the same network settings as System Settings, and more.

---

Source: https://kilobat.app/guides/network-connection-was-lost.html

Error messages

## “The network connection was lost.” on Mac

This is the macOS text for error -1005. A connection closed while a page or file was loading. The cause can be the Mac, the network or the server.

Applies to: All current macOS versions. The text was checked on macOS 27.2. · Checked: 29 October 2026

### Symptoms

- An app or Safari shows “The network connection was lost.”
- A download stops in the middle.
- It happens after the Mac wakes, or when you move between rooms.

### Likely causes

- **Wi-Fi dropped or roamed.** A short drop or a move to another access point closes open connections.
- **Sleep.** Connections that were open before sleep can close.
- **A VPN reconnected.** When a VPN reconnects, the connections through it close.
- **The network changed.** The Mac joined another network, or its address changed.
- **The server or a proxy closed it.** Apple's documentation says that a client or server connection was cut during a load.

### How to check

1. Note when the error appears. Compare it with sleep, a VPN or a move to another room.
2. Show the recent sleep and wake events.

   ```
   pmset -g log | grep -E ' (Sleep|Wake|DarkWake) ' | tail -20
   ```
3. Ping the router for one minute. Lost replies show Wi-Fi drops.

   ```
   ping -c 60 192.168.1.1
   ```
4. Try the same task on Ethernet or on another network.

### How to fix it

1. Try again. Most apps can resume after one lost connection.
2. If Wi-Fi drops, move closer to the router or use Ethernet. See [Weak Wi-Fi signal on a Mac](https://kilobat.app/guides/weak-wifi-signal-mac.html).
3. If it happens after sleep, read [Mac Wi-Fi disconnects after sleep](https://kilobat.app/guides/wifi-disconnects-after-sleep.html).
4. For a long download, keep the Mac awake. See [Mac sleep stops downloads](https://kilobat.app/guides/mac-sleep-stops-downloads.html).
5. If a VPN reconnects often, update it or ask its provider.

### With Kilobat

1. Show drops, roams and network changes that the app recorded, with their times.

   ```
   kilobat outages
   ```

   Output Events such as `Unreachable`, `Wi-Fi roam` and `Network changed`.
2. Keep the Mac awake until a download finishes.

   ```
   kilobat awake --until-quiet
   ```
3. The CLI is free. Outage history in the app needs Pro.

### Questions

**What is NSURLErrorDomain -1005?**

It is the networkConnectionLost error of Apple's URL Loading System. macOS shows this text for it.

### Sources

- Error text in CFNetwork.framework, macOS 27.2 (Localizable.loctable)
- [Apple Developer: URLError.Code networkConnectionLost (-1005)](https://developer.apple.com/documentation/foundation/urlerror/code/networkconnectionlost)
- pmset(1) and ping(8), man page installed with macOS 27.2
- [Apple Support: If your Mac isn't connecting to the internet over Wi-Fi](https://support.apple.com/en-us/101588)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Mac Wi-Fi disconnects after sleep](https://kilobat.app/guides/wifi-disconnects-after-sleep.html): After sleep, the Mac must join the Wi-Fi network again.
- [ERR_NETWORK_CHANGED in Chrome on Mac](https://kilobat.app/guides/err-network-changed.html): Chromium describes this error as: “The network changed.” Chrome stopped the load because the Mac's network changed during it.
- [Mac sleep stops downloads](https://kilobat.app/guides/mac-sleep-stops-downloads.html): A Mac that goes to sleep stops most app activity, so a long download can stop or fail.
- [Test for packet loss on a Mac with ping](https://kilobat.app/guides/packet-loss-mac.html): Packet loss makes calls break up and pages stall.
- [Weak Wi-Fi signal on a Mac](https://kilobat.app/guides/weak-wifi-signal-mac.html): Signal strength and noise decide how fast and how stable the Wi-Fi link is.

---

Source: https://kilobat.app/guides/network-extension-conflicts.html

VPN, proxy and filters

## Little Snitch, LuLu and other network extensions conflict on a Mac

Firewalls, VPNs and content filters on macOS use network extensions. When several of them run, one of them can block or redirect traffic that another needs.

Applies to: macOS 15 Sequoia and later for the Login Items & Extensions path. Earlier versions show these extensions in other places. · Checked: 29 October 2026

### Symptoms

- Connections fail after you install a firewall, VPN, antivirus or parental control app.
- A VPN connects, but no traffic goes through it while a firewall app runs.
- An app connects only when you quit another network app.
- macOS asks again to allow a filter or a VPN configuration.

### Likely causes

- **Two filters or firewalls.** Each filter can block a connection. A block rule in one app stops the connection, even if another app allows it.
- **A VPN with strict firewall rules.** Many VPNs block all traffic that does not go through their tunnel. This can block another VPN or a local network tool.
- **An old extension.** An app that you removed can leave its extension or configuration on the Mac.
- **A rule that you forgot.** A rule in a firewall app can block one app or one host for a long time.

### How to check

1. Choose Apple menu > System Settings > General > Login Items & Extensions.
2. Find Network Extensions. Click the Info button to see which network extensions are on.
3. Choose Apple menu > System Settings > Network. Look for VPN and filter configurations that you do not use.
4. List the VPN services that macOS knows.

   ```
   scutil --nc list
   ```
5. Open each firewall app and look at its recent blocked connections.

### How to fix it

1. Turn off the filter in each firewall app from its own menu. For example, Little Snitch and LuLu have this control.
2. Test the connection after you turn off each app. Do one change at a time.
3. When you find the app that blocks, change its rule or its settings. Then turn its filter on again.
4. To remove an extension, use the uninstaller or the remove command of its app.
5. In Login Items & Extensions, click the Info button for Network Extensions. Turn off the extension that you do not use. Then click Done.
6. Restart the Mac after you remove a VPN or filter extension.

### With Kilobat

1. Kilobat also uses a network filter for its rules. Its connection check names the Kilobat rule that applies to a host.

   ```
   kilobat why example.com --app com.example.App
   ```
2. See what Kilobat's filter blocked, with the reason for each block.

   ```
   kilobat blocked-history
   ```
3. To stop Kilobat's rules without removing them, switch to the Unrestricted profile.

   ```
   kilobat profile unrestricted
   ```
4. To remove the filter, open Kilobat Settings and choose Remove Kilobat. Blocking needs Pro, but these steps are free.

### Questions

**Can I use two firewalls at the same time?**

macOS lets several network extensions run. Each one can block traffic, so a connection must pass all of them. Use one firewall if you can.

**Does turning off the filter remove the app?**

No. In Little Snitch and LuLu, the filter switch stops filtering. The app stays installed.

### Sources

- [Apple Support: Change Login Items & Extensions settings on Mac](https://support.apple.com/guide/mac-help/mtusr003)
- [Tailscale: Interoperability with other software](https://tailscale.com/docs/reference/interoperability)
- [Objective-See: LuLu](https://objective-see.org/products/lulu.html)
- [Little Snitch 6 Help: General settings](https://help.obdev.at/littlesnitch6/pref-general)
- scutil(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [A content filter blocks websites on a Mac](https://kilobat.app/guides/content-filter-blocking.html): A content filter examines web traffic and blocks some sites.
- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet.html): A VPN sends traffic through a tunnel.
- [Tailscale and another VPN conflict on a Mac](https://kilobat.app/guides/tailscale-vpn-routing-conflicts.html): Tailscale gives each device an address in 100.64.0.0/10.
- [Get approvals for new apps](https://kilobat.app/guides/recipes/approve-new-apps.html): In Ask mode, Kilobat holds the first connections of an app that has no rule.

---

Source: https://kilobat.app/guides/network-service-order.html

IP, routing and IPv6

## Mac uses the wrong network connection

When more than one connection is active, the Mac tries the service at the top of the list first. You can change this order.

Applies to: macOS 13 Ventura and later for the System Settings steps. The Terminal commands work on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- The Mac uses Wi-Fi when an Ethernet cable is connected.
- Traffic goes through a phone connected by USB, not through the home network.
- Speed changes when you connect or disconnect a dock.

### Likely causes

- **The service order.** Apple says that the Mac tries the service at the top of the list first, then the others in order.
- **A new service at the top.** A dock, adapter or phone adds a new service, and it can go above the one you want.
- **A VPN.** VPN connections take priority over other connections. You cannot change their order.

### How to check

1. Show the service order.

   ```
   networksetup -listnetworkserviceorder
   ```
2. Show the interface that the default route uses now.

   ```
   route -n get default
   ```

   Output The `gateway` and the `interface`, for example `en0`.
3. Find the device name of each network port, for example `en0` for Wi-Fi.

   ```
   networksetup -listallhardwareports
   ```

### How to fix it

1. Choose Apple menu > System Settings > Network.
2. Click the Action pop-up menu, then choose Set Service Order.
3. Drag the services into the order that you want. Click OK.
4. In Terminal, give every service name in the new order. Get the names with `networksetup -listallnetworkservices`.

   ```
   networksetup -ordernetworkservices "Ethernet" "Wi-Fi" "Thunderbolt Bridge"
   ```

   Needs an administrator password.
5. Run `route -n get default` again to see the new interface.

### With Kilobat

1. `why` names the interface that a connection uses, such as Wi-Fi or a VPN. It tries each interface.

   ```
   kilobat why example.com
   ```
2. Show the counters of each interface, with VPN interfaces marked.

   ```
   kilobat interfaces
   ```

### Questions

**Can I put a VPN lower in the list?**

No. Apple says that VPN connections already take priority over other connections.

**Does the Mac use two connections at once?**

Most traffic uses the default route of the first active service. Other services stay ready.

### Sources

- [Apple Support: Change the order of the network services your Mac uses](https://support.apple.com/guide/mac-help/change-order-network-services-mac-mchlp2711/mac)
- networksetup(8), man page installed with macOS 27.2
- route(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [See Mac network settings in Terminal](https://kilobat.app/guides/network-settings-terminal.html): macOS includes command-line tools that show the same network settings as System Settings, and more.
- [Connect a Mac to an iPhone hotspot with a USB cable](https://kilobat.app/guides/usb-tethering-iphone-mac.html): A USB cable gives a Mac the iPhone's internet connection and charges the iPhone.
- [Mac does not detect a USB or Thunderbolt Ethernet adapter](https://kilobat.app/guides/ethernet-adapter-not-detected.html): A USB or Thunderbolt Ethernet adapter must appear as a hardware port and as a network service.
- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet.html): A VPN sends traffic through a tunnel.

---

Source: https://kilobat.app/guides/network-settings-terminal.html

IP, routing and IPv6

## See Mac network settings in Terminal

macOS includes command-line tools that show the same network settings as System Settings, and more. Reading settings does not need an administrator.

Applies to: All current macOS versions. · Checked: 29 October 2026

### Symptoms

- You want to see network settings fast, or copy them for a support request.
- System Settings does not show the detail that you need.
- You want to check settings in a script.

### Likely causes

- **Several tools.** `networksetup` reads and changes services. `scutil` shows the live DNS and proxy state. `ipconfig` shows DHCP data.
- **Services and devices.** A service has a name such as Wi-Fi. A device has a name such as `en0`. Commands take one or the other.

### How to check

1. List the hardware ports with their device names and MAC addresses.

   ```
   networksetup -listallhardwareports
   ```
2. List the services in the order that the Mac uses them.

   ```
   networksetup -listnetworkserviceorder
   ```
3. Show the IP address, subnet mask, router and hardware address of a service.

   ```
   networksetup -getinfo Wi-Fi
   ```
4. Show the IPv4 address of a device.

   ```
   ipconfig getifaddr en0
   ```
5. Show the default router and the interface that it uses.

   ```
   route -n get default
   ```
6. Show the routing tables.

   ```
   netstat -rn
   ```
7. Show the live DNS configuration, with all resolvers.

   ```
   scutil --dns
   ```
8. Show the system proxy configuration.

   ```
   scutil --proxy
   ```
9. Show the DHCP data that the Mac accepted.

   ```
   ipconfig getpacket en0
   ```
10. Find out if a host is reachable with the current configuration.

    ```
    scutil -r apple.com
    ```

### How to fix it

1. Most `networksetup` commands that change settings need administrator rights. Read the man page first.

   ```
   man networksetup
   ```
2. Before a change, save the current values, so that you can put them back.

   ```
   networksetup -getdnsservers Wi-Fi > ~/dns-before.txt
   ```

### With Kilobat

1. Kilobat gives many of these values as JSON, for scripts and agents.

   ```
   kilobat diagnose --json
   ```
2. Show the current Wi-Fi link with signal, channel and link rate.

   ```
   kilobat wifi status --json
   ```

### Questions

**Why does networksetup ask for a password?**

The networksetup man page says that it needs at least admin rights to change network settings.

**Is ipconfig the same as on Windows?**

No. The macOS `ipconfig` talks to the IPConfiguration agent. Its man page says to use it for test and debug only.

### Sources

- networksetup(8), man page installed with macOS 27.2
- scutil(8), man page installed with macOS 27.2
- ipconfig(8), man page installed with macOS 27.2
- route(8), man page installed with macOS 27.2
- netstat(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Mac uses the wrong network connection](https://kilobat.app/guides/network-service-order.html): When more than one connection is active, the Mac tries the service at the top of the list first.
- [Renew the DHCP lease on a Mac](https://kilobat.app/guides/renew-dhcp-lease-mac.html): A DHCP lease gives the Mac its IP address, router and DNS servers.
- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [Use Wireless Diagnostics and wdutil on a Mac](https://kilobat.app/guides/wireless-diagnostics-mac.html): Wireless Diagnostics is a Wi-Fi tool that comes with macOS.

---

Source: https://kilobat.app/guides/networkquality-speed-test.html

Websites and speed

## Test internet speed from Terminal with networkQuality

macOS includes `networkQuality`, a command-line test. It measures capacity and responsiveness, the number of round trips a network completes in one minute under load.

Applies to: macOS 12 Monterey and later. · Checked: 29 October 2026

### Symptoms

- You want a speed test without a browser or a separate app.
- Calls or games lag when other devices use the network.
- You want to compare Wi-Fi with Ethernet, or one interface with another.

### Likely causes

- **Capacity is not the full picture.** A connection can have high capacity but low responsiveness. Then calls and games lag while the network is busy.
- **Responsiveness drops under load.** Apple measures responsiveness in round trips per minute (RPM) while the network is busy.
- **The test itself uses data.** The man page says that the test connects to the internet and uses data on your plan.

### How to check

1. Open Terminal and run the test.

   ```
   networkQuality
   ```

   Output Upload and download capacity, and responsiveness in RPM with a rating.
2. To test upload and download one after the other, add `-s`. This also gives a separate responsiveness for each direction.

   ```
   networkQuality -s
   ```
3. To test one interface, give its name with `-I`. For example, `en0` is often the Wi-Fi interface.

   ```
   networkQuality -I en0
   ```
4. For JSON output, add `-c`.

   ```
   networkQuality -c
   ```
5. For more detail, add `-v`.

   ```
   networkQuality -v
   ```

### How to fix it

1. If the rating is Low, look for devices or apps that download or back up during the test. Apple says that connections can then be unreliable.
2. If capacity is good but responsiveness is low, read [Bufferbloat: calls lag when the network is busy](https://kilobat.app/guides/bufferbloat-mac.html).
3. If Wi-Fi is much slower than Ethernet, examine the Wi-Fi link. See [Wi-Fi is slow on the Mac but fast on the phone](https://kilobat.app/guides/slow-wifi-mac-fast-phone.html).
4. On a hotspot or a data plan, do not run many tests. Each test uses data.

### With Kilobat

1. Kilobat's speed test measures speed and latency under load, with verdicts for voice calls, video calls and streaming. It is free.

   ```
   kilobat speedtest
   ```
2. On a hotspot, limit the data that the test uses.

   ```
   kilobat speedtest --budget-mb 10
   ```
3. Kilobat uses one connection by default. To open four at once, as networkQuality does, add `--parallel`.

   ```
   kilobat speedtest --parallel
   ```
4. In the app, open the Speed tab and start a test. Kilobat skips scheduled speed tests on metered networks. See [Find out why two speed tests differ](https://kilobat.app/guides/recipes/compare-speed-tests.html).

### Questions

**What is a good RPM?**

Apple rates responsiveness as Low, Medium or High. With High, apps should keep a good connection however many devices share the network.

**Does networkQuality need an administrator password?**

No. Any user can run it.

### Sources

- [Apple Support: Test Wi-Fi networks with Apple Network Responsiveness](https://support.apple.com/en-us/101942)
- networkQuality(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Bufferbloat: calls lag when the network is busy](https://kilobat.app/guides/bufferbloat-mac.html): Bufferbloat is latency that network devices add when they hold too much data in their buffers.
- [Slow internet on a Mac: find which part is slow](https://kilobat.app/guides/slow-internet-mac-cause.html): A slow connection has many possible causes.
- [Video calls stutter or freeze on a Mac](https://kilobat.app/guides/video-call-stutter-mac.html): Calls need steady latency and steady upload more than high speed.
- [Test for packet loss on a Mac with ping](https://kilobat.app/guides/packet-loss-mac.html): Packet loss makes calls break up and pages stall.

---

Source: https://kilobat.app/guides/npm-econnreset.html

Error messages

## “npm error code ECONNRESET” on Mac

ECONNRESET means that the other side closed the connection by force. Node.js documentation calls it “Connection reset by peer”.

Applies to: npm 10 and later print “npm error”. Older versions print “npm ERR!”. All current macOS versions. · Checked: 29 October 2026

### Symptoms

- `npm install` stops with `npm error code ECONNRESET`.
- npm adds that this is a problem related to network connectivity.
- It happens on a company network, a VPN or with a security app.

### Likely causes

- **A proxy or filter that resets connections.** A company proxy or security software can close connections that it does not allow.
- **TLS inspection.** A proxy that inspects secure traffic can break the connection. See [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html).
- **A VPN that reconnects.** Connections through the VPN close when it reconnects.
- **An unstable connection.** Node.js documentation says that a timeout or a reboot on the remote side can cause it.

### How to check

1. Show npm's registry and proxy settings.

   ```
   npm config get registry
   npm config get proxy
   npm config get https-proxy
   ```
2. Ask the registry for an answer.

   ```
   npm ping
   ```
3. Test the registry with curl. Look for the certificate issuer.

   ```
   curl -v -o /dev/null https://registry.npmjs.org/ 2>&1 | grep -i issuer
   ```
4. Try the install on another network, such as a phone hotspot.

### How to fix it

1. If the network needs a proxy, set it for npm.

   ```
   npm config set https-proxy http://proxy.example.com:8080
   ```
2. If a company proxy inspects TLS, add its root certificate for Node.js. See [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html).
3. Give npm more retries.

   ```
   npm config set fetch-retries 5
   ```
4. If a VPN, proxy or security app is on, turn it off for a short test. Turn it on again after the test.

### With Kilobat

1. Kilobat's connection doctor tests the registry layer by layer: network, proxy, DNS, rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why https://registry.npmjs.org/
   ```
2. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**Is ECONNRESET a bug in my project?**

Usually not. The connection to the registry closed. Run the same install on another network to compare.

### Sources

- [Node.js documentation: Common system errors](https://nodejs.org/api/errors.html#common-system-errors)
- intro(2), ECONNRESET, man page installed with macOS 27.2
- [npm Docs: config](https://docs.npmjs.com/cli/v11/using-npm/config)
- curl(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [“npm error code ETIMEDOUT” on Mac](https://kilobat.app/guides/npm-etimedout.html): ETIMEDOUT means that the other side did not answer in time.
- [Homebrew or npm downloads fail on a Mac](https://kilobat.app/guides/homebrew-npm-download-fails.html): Homebrew downloads with curl and Git.
- [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html): Some company networks inspect HTTPS traffic.
- [Proxy settings stop apps from connecting on a Mac](https://kilobat.app/guides/proxy-settings-breaking-apps.html): A proxy setting sends traffic through another server.

---

Source: https://kilobat.app/guides/npm-etimedout.html

Error messages

## “npm error code ETIMEDOUT” on Mac

ETIMEDOUT means that the other side did not answer in time. Node.js documentation says: “the connected party did not properly respond after a period of time.”

Applies to: npm 10 and later print “npm error”. Older versions print “npm ERR!”. All current macOS versions. · Checked: 29 October 2026

### Symptoms

- `npm install` stops with `npm error code ETIMEDOUT`.
- npm adds that this is a problem related to network connectivity.
- It fails on one network, such as a company network or a hotspot.

### Likely causes

- **A proxy that npm does not know.** On a network that needs a proxy, npm needs its `proxy` and `https-proxy` settings.
- **A registry that you cannot reach.** An old `registry` setting can point to a private server.
- **A slow or lossy connection.** Large packages time out on a weak Wi-Fi or a hotspot.
- **A broken IPv6 path.** The registry has an IPv6 address, and IPv6 does not work on your network.

### How to check

1. Show npm's registry and proxy settings.

   ```
   npm config get registry
   npm config get proxy
   npm config get https-proxy
   ```
2. Ask the registry for an answer.

   ```
   npm ping
   ```
3. Test the registry with curl, IPv4 only.

   ```
   curl -4 -I https://registry.npmjs.org/
   ```
4. Measure the connection.

   ```
   networkQuality
   ```

### How to fix it

1. If the network needs a proxy, set it for npm.

   ```
   npm config set https-proxy http://proxy.example.com:8080
   ```
2. Remove an old registry setting, so npm uses its default.

   ```
   npm config delete registry
   ```
3. Give npm more retries on a slow connection.

   ```
   npm config set fetch-retries 5
   ```
4. Run the install again on a faster network, if you can.

### With Kilobat

1. Kilobat's connection doctor tests the registry layer by layer: network, proxy, DNS, rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why https://registry.npmjs.org/
   ```
2. Check if the network is metered, on a VPN or slow before a large install.

   ```
   kilobat conditions
   ```
3. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**How long does npm wait?**

npm's documentation gives a default `fetch-timeout` of 300000 ms, five minutes, and 2 `fetch-retries`.

### Sources

- [Node.js documentation: Common system errors](https://nodejs.org/api/errors.html#common-system-errors)
- [npm Docs: config](https://docs.npmjs.com/cli/v11/using-npm/config)
- curl(1) and networkQuality(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [“npm error code ECONNRESET” on Mac](https://kilobat.app/guides/npm-econnreset.html): ECONNRESET means that the other side closed the connection by force.
- [Homebrew or npm downloads fail on a Mac](https://kilobat.app/guides/homebrew-npm-download-fails.html): Homebrew downloads with curl and Git.
- [Proxy settings stop apps from connecting on a Mac](https://kilobat.app/guides/proxy-settings-breaking-apps.html): A proxy setting sends traffic through another server.
- [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html): Some company networks inspect HTTPS traffic.
- [Check the network before a big download in an agent](https://kilobat.app/guides/recipes/check-network-before-download.html): An agent can ask Kilobat if now is a good time for a large transfer.

---

Source: https://kilobat.app/guides/packet-loss-mac.html

Websites and speed

## Test for packet loss on a Mac with ping

Packet loss makes calls break up and pages stall. Use `ping` to measure loss to the router and to the internet, and compare them.

Applies to: All current macOS versions. · Checked: 29 October 2026

### Symptoms

- Audio in calls breaks up or sounds robotic.
- Games show lag or rubber-banding.
- Pages stop and then continue.

### Likely causes

- **A weak or noisy Wi-Fi link.** Radio interference and distance make packets fail on the link.
- **A busy router or network.** Full queues drop packets.
- **Problems past the router.** The provider's network or the route can drop packets.
- **Rate limits on ping replies.** Some routers and servers answer only some ping requests. That looks like loss, but it is not.

### How to check

1. Find the address of your router. It is the `gateway` line.

   ```
   route -n get default
   ```
2. Send 100 pings to the router. Replace the address with your gateway address.

   ```
   ping -c 100 192.168.1.1
   ```

   Output A summary line with packets transmitted, packets received and the percentage of packet loss.
3. Send 100 pings to a server on the internet.

   ```
   ping -c 100 1.1.1.1
   ```
4. Compare the two loss values. Loss to the router points to Wi-Fi or the router.
5. Loss only to the internet server points past the router.
6. Repeat the test over Ethernet, if you can. Loss that stops on Ethernet comes from Wi-Fi.
7. To see where loss starts on the path, read [Find where a connection slows down with traceroute](https://kilobat.app/guides/traceroute-mac.html).

### How to fix it

1. If the loss is on Wi-Fi, move closer to the router or use a less crowded channel. See [Weak Wi-Fi signal on a Mac](https://kilobat.app/guides/weak-wifi-signal-mac.html).
2. If the loss appears only while the network is busy, read [Bufferbloat: calls lag when the network is busy](https://kilobat.app/guides/bufferbloat-mac.html).
3. Restart the router and the modem.
4. If the loss is past the router, contact your provider. Give them the ping results with dates and times.

### With Kilobat

1. `kilobat diagnose` measures router and internet latency, jitter and loss in one run.

   ```
   kilobat diagnose
   ```
2. The stutter test pings the router every 50 ms for 20 seconds. It marks routers that answer only some fast pings, so you do not count that as loss.

   ```
   kilobat stutter
   ```
3. In the app, the Health tab shows the stutter test. It is free.

### Questions

**How much packet loss is too much?**

Any steady loss is worth a check. Kilobat's call check warns at more than 2% loss to the internet.

**Why do I see loss only in a fast ping test?**

Many routers limit how many ping requests they answer each second. Use the default interval of one second for a fair result.

### Sources

- ping(8), man page installed with macOS 27.2
- route(8), man page installed with macOS 27.2
- traceroute(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Find where a connection slows down with traceroute](https://kilobat.app/guides/traceroute-mac.html): traceroute shows each router on the path from your Mac to a host, with the time each one takes to answer.
- [Slow internet on a Mac: find which part is slow](https://kilobat.app/guides/slow-internet-mac-cause.html): A slow connection has many possible causes.
- [Video calls stutter or freeze on a Mac](https://kilobat.app/guides/video-call-stutter-mac.html): Calls need steady latency and steady upload more than high speed.
- [Test for call stutter](https://kilobat.app/guides/recipes/test-call-stutter.html): A speed test averages its pings, so short spikes disappear.

---

Source: https://kilobat.app/guides/port-already-in-use.html

Developers

## Port already in use on a Mac

Only one process can listen on a TCP port and address. A second server then stops with “address already in use”.

Applies to: All current macOS versions. · Checked: 29 October 2026

### Symptoms

- A dev server stops with “EADDRINUSE” or “address already in use”.
- Docker cannot publish a port because “port is already allocated”.
- The port was free before a crash or a restart of your editor.

### Likely causes

- **An old copy of your server.** A server from an earlier run still runs in the background.
- **Another app.** A different app uses the same port. On macOS 12 and later, AirPlay Receiver uses ports 5000 and 7000.
- **A container.** A running container publishes the same port on the Mac.

### How to check

1. Find the process that listens on the port. Replace 3000 with your port.

   ```
   lsof -nP -iTCP:3000 -sTCP:LISTEN
   ```

   Output The COMMAND and PID columns name the process.
2. To see processes of other users, run the same command with sudo.

   ```
   sudo lsof -nP -iTCP:3000 -sTCP:LISTEN
   ```

   Needs an administrator password.
3. Show more about the process.

   ```
   ps -p 12345 -o pid,command
   ```
4. Look for containers that publish the port.

   ```
   docker ps
   ```

### How to fix it

1. If the process is yours, stop it in its own Terminal window with Control-C.
2. Otherwise, send it the terminate signal. Use its PID.

   ```
   kill 12345
   ```
3. If it does not stop, use `kill -9`. The process cannot save its data.
4. If the process belongs to macOS, do not stop it. Choose another port for your server.
5. If the port is 5000 or 7000, read [Port 5000 or 7000 is in use on a Mac: AirPlay Receiver](https://kilobat.app/guides/airplay-receiver-port-5000.html).

### With Kilobat

1. List the open sockets of one process.

   ```
   kilobat destinations --pid 12345
   ```
2. Quit a process by PID. Add `--force` only if it does not stop.

   ```
   kilobat quit 12345
   ```

### Questions

**Why does lsof show nothing, but the port is in use?**

lsof shows only the processes that you can examine. Run it with sudo to see all processes.

**What do -n and -P do?**

They stop lsof from converting addresses to names and ports to service names. The output is faster and shows numbers.

### Sources

- lsof(8), man page installed with macOS 27.2
- kill(1) and ps(1), man page installed with macOS 27.2
- [Apple Support: TCP and UDP ports used by Apple software products](https://support.apple.com/en-us/103229)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Port 5000 or 7000 is in use on a Mac: AirPlay Receiver](https://kilobat.app/guides/airplay-receiver-port-5000.html): Apple lists TCP ports 5000 and 7000 for AirPlay.
- [Cannot reach a Docker container from the Mac](https://kilobat.app/guides/docker-container-from-mac.html): Docker on a Mac runs containers in a Linux virtual machine.
- [A container cannot reach localhost on the Mac](https://kilobat.app/guides/localhost-from-container.html): Each container has its own network stack.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.

---

Source: https://kilobat.app/guides/private-wifi-address.html

Public Wi-Fi and privacy

## Private Wi-Fi address on a Mac

A private Wi-Fi address replaces the hardware MAC address of the Mac on a network. It helps to reduce tracking by network operators.

Applies to: The Off, Fixed and Rotating options are in macOS 15 Sequoia and later. · Checked: 29 October 2026

### Symptoms

- A network that filters MAC addresses does not let the Mac join.
- The router shows the Mac as a new device.
- A network that needs a sign-in asks you to sign in again.

### Likely causes

- **Rotating address.** Apple says that a rotating address changes every 2 weeks. The network then sees a new device.
- **MAC address filtering or reservations.** A router that allows only known addresses does not know the private address.
- **Forgetting the network.** Apple says that forgetting a network also clears its private address, with some exceptions.
- **Network policy.** Apple says that some organizations must update their network security to work with private addresses.

### How to check

1. Choose Apple menu > System Settings > Wi-Fi.
2. Click Details next to the network name.
3. Read the value next to Private Wi-Fi address.
4. Show the address that the Mac uses now on Wi-Fi.

   ```
   ifconfig en0 ether
   ```

### How to fix it

1. Choose Fixed for your home network. The router then sees one address that does not change.
2. Keep Rotating for public networks. It reduces tracking on the network and across networks.
3. Choose Off only when the network needs the hardware address.
4. Before you choose Off, install the latest software updates and try again. Apple recommends this.
5. If you manage the router, do not use MAC address filtering. Apple says that MAC addresses can be copied.

### Questions

**Which option does the Mac select by default?**

Apple says that the Mac selects Fixed on networks with WPA2 or stronger security, and Rotating on networks with weak or no security.

**Is the private address a privacy guarantee?**

No. It reduces tracking by Wi-Fi network operators. Other tracking methods still work.

### Sources

- [Apple Support: Use private Wi-Fi addresses on Apple devices](https://support.apple.com/en-us/102509)
- [Apple Support: Use a private Wi-Fi address on Mac](https://support.apple.com/guide/mac-help/mchlb1cb3eb4/mac)
- [Apple Support: Recommended settings for Wi-Fi routers and access points](https://support.apple.com/en-us/102766)
- ifconfig(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Limit IP address tracking on a Mac](https://kilobat.app/guides/limit-ip-address-tracking.html): Limit IP address tracking is a setting for each network.
- [“Weak security” warning on Mac Wi-Fi](https://kilobat.app/guides/wifi-weak-security-warning.html): The Mac shows a security warning when a network uses an old security mode.
- [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html): Public networks often hold all traffic until you sign in on a login page.

---

Source: https://kilobat.app/guides/proxy-settings-breaking-apps.html

VPN, proxy and filters

## Proxy settings stop apps from connecting on a Mac

A proxy setting sends traffic through another server. If that server is wrong or not available, apps cannot connect, but other apps can work normally.

Applies to: macOS 13 Ventura and later for the System Settings path. The commands work on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Safari works, but one app or a Terminal tool shows a timeout or “proxy” error.
- Apps connect at home but fail on another network, or the opposite.
- Command-line tools fail with “Could not resolve proxy” or a connection refused to a local port.
- Connections stop after a VPN or proxy app quits.

### Likely causes

- **An old system proxy.** A proxy set in System Settings stays after you leave the network that needs it.
- **A PAC file or auto proxy discovery.** The Mac gets proxy rules from a URL. If the URL does not load, some apps cannot connect.
- **Proxy environment variables.** Terminal tools read `http_proxy`, `https_proxy` and `all_proxy`. These variables do not change the System Settings proxy, and apps from the Dock do not see them.
- **A proxy app that stopped.** Some apps set a proxy to a local port, such as 127.0.0.1. If the app stops, nothing listens on that port.
- **An app with its own proxy setting.** Some apps have a proxy field in their own settings. That field is separate from the system proxy.

### How to check

1. Open Terminal. Show the proxy configuration that macOS uses now.

   ```
   scutil --proxy
   ```

   Output Keys such as `HTTPEnable`, `HTTPSEnable`, `ProxyAutoConfigEnable` and `ProxyAutoDiscoveryEnable`. A value of 1 means on.
2. Show the HTTP and HTTPS proxy for one network service. Replace Wi-Fi with your service name if necessary.

   ```
   networksetup -getwebproxy Wi-Fi
   networksetup -getsecurewebproxy Wi-Fi
   ```
3. Show the PAC file and auto proxy discovery settings.

   ```
   networksetup -getautoproxyurl Wi-Fi
   networksetup -getproxyautodiscovery Wi-Fi
   ```
4. Show the proxy variables in your shell.

   ```
   env | grep -i proxy
   ```
5. If a proxy points to 127.0.0.1, find what listens on that port. Replace 7890 with the port.

   ```
   lsof -nP -iTCP:7890 -sTCP:LISTEN
   ```

### How to fix it

1. Choose Apple menu > System Settings > Network. Click the network service, then click Details.
2. Click Proxies. Turn off each proxy type that your network does not need.
3. Some hosts must not use the proxy. Add them to “Bypass proxy settings for these hosts & domains”.
4. Click OK to save the change.
5. To turn off a web proxy from Terminal, use networksetup. macOS can ask for an administrator password.

   ```
   networksetup -setwebproxystate Wi-Fi off
   networksetup -setsecurewebproxystate Wi-Fi off
   ```

   Needs an administrator password.
6. Remove old proxy variables from your shell startup file, such as `~/.zshrc`. Then open a new Terminal window.
7. Look in the settings of the failing app for its own proxy field. Make it agree with your network.

### With Kilobat

1. Kilobat's connection check reports the system proxy and the PAC file. It also tests the direct path and the proxy path.

   ```
   kilobat why api.example.com
   ```
2. Add `--app` to read the proxy variables in that app's environment. Passwords do not show.

   ```
   kilobat why https://api.example.com/v1/models --app com.example.App
   ```
3. If the app has its own proxy setting, give that address with `--proxy`.

   ```
   kilobat why huggingface.co --proxy http://127.0.0.1:7890
   ```
4. The check is free. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html) for the app and MCP steps.

### Questions

**Why does Safari work when Terminal fails?**

Safari uses the system proxy. Terminal tools use the proxy variables in your shell. The two settings can be different.

**What is auto proxy discovery?**

The Mac looks for proxy rules on the network. On a network that has no proxy, you can turn it off.

### Sources

- [Apple Support: Change proxy settings on Mac](https://support.apple.com/guide/mac-help/change-proxy-settings-on-mac-mchlp2591/mac)
- scutil(8), man page installed with macOS 27.2
- networksetup(8), man page installed with macOS 27.2
- lsof(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.
- [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html): Some company networks inspect HTTPS traffic.
- [Homebrew or npm downloads fail on a Mac](https://kilobat.app/guides/homebrew-npm-download-fails.html): Homebrew downloads with curl and Git.
- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet.html): A VPN sends traffic through a tunnel.

---

Source: https://kilobat.app/guides/renew-dhcp-lease-mac.html

IP, routing and IPv6

## Renew the DHCP lease on a Mac

A DHCP lease gives the Mac its IP address, router and DNS servers. A renewal asks the DHCP server for them again.

Applies to: macOS 13 Ventura and later for the System Settings steps. The Terminal commands work on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- The Mac has a self-assigned or wrong IP address.
- The router changed, but the Mac keeps old DNS servers.
- The connection stopped after the router restarted.

### Likely causes

- **An old lease.** The Mac keeps its lease until it ends. A change on the router does not always reach the Mac at once.
- **A short lease time on a busy network.** Apple says that you can need to renew often when many computers use one DHCP server.
- **A DHCP request that failed.** The request did not get an answer, for example after sleep or a cable change.

### How to check

1. Find the device name of each network port, for example `en0` for Wi-Fi.

   ```
   networksetup -listallhardwareports
   ```
2. Show the current address.

   ```
   ipconfig getifaddr en0
   ```
3. Show the lease from the DHCP server, with the router, DNS servers and lease time.

   ```
   ipconfig getpacket en0
   ```

### How to fix it

1. Choose Apple menu > System Settings > Network.
2. Click the network service, then click Details.
3. Click TCP/IP, then click Renew DHCP Lease. Click OK.
4. Run `ipconfig getpacket en0` again and compare the values.
5. If nothing changes, turn Wi-Fi off and on again.

   ```
   networksetup -setairportpower en0 off
   ```

   Needs an administrator password.
6. Turn Wi-Fi on again.

   ```
   networksetup -setairportpower en0 on
   ```

   Needs an administrator password.

### With Kilobat

1. The CLI turns Wi-Fi off and on in one step.

   ```
   kilobat wifi restart
   ```

### Questions

**Do I always get a new IP address?**

No. Many DHCP servers give the same address back to the same device.

**What does scutil --renew do?**

The scutil man page says that it starts a new check of the network configuration on the interface.

### Sources

- [Apple Support: Renew your IP address from the DHCP server on Mac](https://support.apple.com/guide/mac-help/mchlp1545/mac)
- ipconfig(8), man page installed with macOS 27.2
- networksetup(8), man page installed with macOS 27.2
- scutil(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Mac has a self-assigned IP address](https://kilobat.app/guides/self-assigned-ip-address.html): If the Mac gets no answer from a DHCP server, it gives itself a link-local address from 169.254.0.0/16.
- [IP address conflict on a Mac](https://kilobat.app/guides/ip-address-conflict-mac.html): Two devices on one network cannot use the same IP address.
- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [See Mac network settings in Terminal](https://kilobat.app/guides/network-settings-terminal.html): macOS includes command-line tools that show the same network settings as System Settings, and more.

---

Source: https://kilobat.app/guides/request-timed-out.html

Error messages

## “The request timed out.” on Mac

This is the macOS text for error -1001. The app waited for an answer, and the time ran out. Something in the path is slow or drops traffic.

Applies to: All current macOS versions. `networkQuality` needs macOS 12 or later. The text was checked on macOS 27.2. · Checked: 29 October 2026

### Symptoms

- An app shows “The request timed out.”
- The app may show `NSURLErrorDomain` and `-1001`.
- It happens on one network, or with a VPN on.

### Likely causes

- **A slow or lossy connection.** Weak Wi-Fi, a busy hotspot or packet loss delay the answer.
- **A broken IPv6 path.** The app tries IPv6 first, and IPv6 does not work.
- **A firewall that drops traffic.** A firewall that drops traffic, instead of refusing it, causes a timeout.
- **A proxy or VPN.** A slow or unreachable proxy holds the request.
- **A slow server.** If every network fails, the server answers too slowly.

### How to check

1. Measure the connection and its responsiveness.

   ```
   networkQuality
   ```
2. Ping an address on the internet. This test does not use DNS.

   ```
   ping -c 5 1.1.1.1
   ```
3. Time each step of one request. Use the address that the app uses.

   ```
   curl -o /dev/null -s -w 'dns %{time_namelookup}  connect %{time_connect}  tls %{time_appconnect}  total %{time_total}\n' https://example.com
   ```
4. Try IPv4 only. If this is fast, the IPv6 path is the problem.

   ```
   curl -4 -I https://example.com
   ```
5. Show the system proxy settings.

   ```
   scutil --proxy
   ```

### How to fix it

1. Move closer to the router, or use Ethernet.
2. Pause large uploads and downloads on the Mac. See [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html).
3. If IPv4 works and IPv6 does not, read [IPv6 problems on a Mac](https://kilobat.app/guides/ipv6-problems-mac.html).
4. If a proxy is set that you do not use, remove it. See [Proxy settings stop apps from connecting on a Mac](https://kilobat.app/guides/proxy-settings-breaking-apps.html).
5. If a VPN, proxy or security app is on, turn it off for a short test. Turn it on again after the test.

### With Kilobat

1. Kilobat's connection doctor tests the site layer by layer: network, proxy, DNS, rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why https://example.com
   ```
2. Show DNS, connect, TLS and first-byte times for one URL.

   ```
   kilobat http-check https://example.com
   ```
3. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**What is NSURLErrorDomain -1001?**

It is the timedOut error of Apple's URL Loading System. Apple describes it as an asynchronous operation that timed out.

### Sources

- Error text in CFNetwork.framework, macOS 27.2 (Localizable.loctable)
- [Apple Developer: URLError.Code timedOut (-1001)](https://developer.apple.com/documentation/foundation/urlerror/code/timedout)
- [Apple Support: Test Wi-Fi networks with Apple Network Responsiveness](https://support.apple.com/en-us/101942)
- curl(1), ping(8) and networkQuality(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Slow internet on a Mac: find which part is slow](https://kilobat.app/guides/slow-internet-mac-cause.html): A slow connection has many possible causes.
- [IPv6 problems on a Mac](https://kilobat.app/guides/ipv6-problems-mac.html): Most networks give a Mac both IPv4 and IPv6 addresses.
- [Proxy settings stop apps from connecting on a Mac](https://kilobat.app/guides/proxy-settings-breaking-apps.html): A proxy setting sends traffic through another server.
- [Test for packet loss on a Mac with ping](https://kilobat.app/guides/packet-loss-mac.html): Packet loss makes calls break up and pages stall.
- [ERR_CONNECTION_TIMED_OUT in Chrome on Mac](https://kilobat.app/guides/err-connection-timed-out.html): Chromium describes this error as: “A connection attempt timed out.” Chrome found the address, but the server did not answer in time.

---

Source: https://kilobat.app/guides/safari-cant-connect-proxy-server.html

Error messages

## “Safari can’t connect to the web proxy server” on Mac

A web proxy is set in the network settings, and Safari cannot reach it. Every web page then fails.

Applies to: Safari on macOS 13 Ventura and later. The text was checked on macOS 27.2. · Checked: 29 October 2026

### Symptoms

- Safari says: “Safari can’t open the page … because Safari can’t connect to the web proxy server (HTTP).”
- Or it says the same about the “secure web proxy server (HTTPS)”.
- Other browsers or apps that use the system proxy fail too.

### Likely causes

- **A proxy app that stopped.** A proxy or VPN app set a proxy on `127.0.0.1`, then quit or crashed.
- **An old company proxy.** The proxy works only on the company network or VPN.
- **A wrong address or port.** The proxy setting has a typing error.
- **A PAC file that points to a dead proxy.** Automatic proxy configuration can give a proxy that does not answer.

### How to check

1. Show the proxy configuration that macOS uses now.

   ```
   scutil --proxy
   ```
2. Show the HTTP and HTTPS proxy of the Wi-Fi service. Use your service name if it is not Wi-Fi.

   ```
   networksetup -getwebproxy Wi-Fi
   networksetup -getsecurewebproxy Wi-Fi
   ```
3. Show the PAC file setting.

   ```
   networksetup -getautoproxyurl Wi-Fi
   ```
4. If the proxy is on `127.0.0.1`, see if something listens on its port. Replace 7890 with the port.

   ```
   lsof -nP -iTCP:7890 -sTCP:LISTEN
   ```

### How to fix it

1. Safari's message says to open Safari Settings > Advanced and click Change Settings. This opens the network proxy settings.
2. Or choose Apple menu > System Settings > Network. Click the service, click Details, then click Proxies.
3. Turn off each proxy that you do not need. Click OK.
4. If a proxy app set the proxy, open the app again, or turn off its system proxy option.
5. On a company Mac, ask the administrator before you change the proxy.

### With Kilobat

1. Kilobat's connection doctor tests the site layer by layer: network, proxy, DNS, rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why https://example.com
   ```
2. The doctor reports the system proxy and the PAC file, and it tests the direct path too.
3. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**Why do only browsers fail, while Terminal works?**

Most Terminal tools do not read the system proxy. They read proxy variables such as `https_proxy`. See [Proxy settings stop apps from connecting on a Mac](https://kilobat.app/guides/proxy-settings-breaking-apps.html).

### Sources

- Error text in Safari.framework, macOS 27.2 (Localizable.strings)
- [Apple Support: Change proxy settings on Mac](https://support.apple.com/guide/mac-help/change-proxy-settings-on-mac-mchlp2591/mac)
- scutil(8), networksetup(8) and lsof(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Proxy settings stop apps from connecting on a Mac](https://kilobat.app/guides/proxy-settings-breaking-apps.html): A proxy setting sends traffic through another server.
- [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html): Some company networks inspect HTTPS traffic.
- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet.html): A VPN sends traffic through a tunnel.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.

---

Source: https://kilobat.app/guides/safari-cant-connect-to-server.html

Error messages

## “Safari can’t connect to the server” on Mac

Safari found the address of the site, but the connection to the server did not open. DNS works. The server or the path to it fails.

Applies to: Safari on macOS 13 Ventura and later. The text was checked on macOS 27.2. · Checked: 29 October 2026

### Symptoms

- Safari says: “Safari can’t open the page … because Safari can’t connect to the server …”.
- Other sites open.
- The address is a local server, such as `localhost:3000`, and the server does not run.

### Likely causes

- **The server is down or refuses connections.** Nothing listens on the port, or the server refuses the connection.
- **A local server that is not running.** For a `localhost` address, your own server must run. See [Port already in use on a Mac](https://kilobat.app/guides/port-already-in-use.html).
- **A firewall or filter.** A firewall, a content filter or a company network can block the port.
- **A VPN or proxy.** Traffic goes through a VPN or proxy that cannot reach the server.
- **A broken IPv6 path.** The site has an IPv6 address, but IPv6 does not work on your network.

### How to check

1. Open the same address on another device on the same network. If it fails there too, the problem is the network or the server.
2. Test the port from Terminal, with a 5-second timeout.

   ```
   nc -vz -G 5 example.com 443
   ```
3. Request the page and show each step of the connection.

   ```
   curl -v -o /dev/null https://example.com
   ```
4. Try IPv4 only, then IPv6 only. If only IPv6 fails, read [IPv6 problems on a Mac](https://kilobat.app/guides/ipv6-problems-mac.html).

   ```
   curl -4 -I https://example.com
   curl -6 -I https://example.com
   ```
5. For a local address, see if a server listens on the port.

   ```
   lsof -nP -iTCP:3000 -sTCP:LISTEN
   ```

### How to fix it

1. Reload the page after some minutes. A busy server can come back.
2. For a local server, start it. Then use the port that it prints.
3. If a VPN, proxy or security app is on, turn it off for a short test. Turn it on again after the test.
4. If only IPv6 fails, fix IPv6 or report it to your provider. See [IPv6 problems on a Mac](https://kilobat.app/guides/ipv6-problems-mac.html).
5. If a company network blocks the site, ask the administrator.

### With Kilobat

1. Kilobat's connection doctor tests the site layer by layer: network, proxy, DNS, rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why https://example.com
   ```
2. Show DNS, connect, TLS and first-byte times for one URL.

   ```
   kilobat http-check https://example.com
   ```
3. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**Why does Safari find the server but not connect?**

Finding the server is DNS. Connecting is a separate step. Here DNS worked, and the connection failed.

### Sources

- Error text in Safari.framework, macOS 27.2 (Localizable.strings)
- [Apple Developer: URLError.Code cannotConnectToHost (-1004)](https://developer.apple.com/documentation/foundation/urlerror/code/cannotconnecttohost)
- [Apple Support: If Safari doesn't work as expected on Mac](https://support.apple.com/en-us/102564)
- nc(1), curl(1) and lsof(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Safari can’t find the server on a Mac](https://kilobat.app/guides/safari-cant-find-server.html): “Safari can’t find the server” usually means that the Mac could not get an address for the site name.
- [Port already in use on a Mac](https://kilobat.app/guides/port-already-in-use.html): Only one process can listen on a TCP port and address.
- [IPv6 problems on a Mac](https://kilobat.app/guides/ipv6-problems-mac.html): Most networks give a Mac both IPv4 and IPv6 addresses.
- [A website works on your phone but not on your Mac](https://kilobat.app/guides/site-works-on-phone-not-mac.html): When a site opens on your phone but not on your Mac, the problem is usually on the Mac.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.

---

Source: https://kilobat.app/guides/safari-cant-establish-secure-connection.html

Error messages

## “Safari can’t establish a secure connection to the server” on Mac

Safari shows this when the secure connection to the server fails before the page loads. Often software or a network in the path causes it, not the site.

Applies to: Safari on macOS 13 Ventura and later. The text was checked on macOS 27.2. · Checked: 29 October 2026

### Symptoms

- Safari says: “Safari can’t open the page … because Safari can’t establish a secure connection to the server …”.
- Apps show “A TLS error caused the secure connection to fail.” This is the same failure in the URL Loading System.
- The site opens on another network or another device.

### Likely causes

- **Security, VPN or filter software.** Software that inspects or filters secure connections can break the handshake.
- **A network that blocks or changes the connection.** Company firewalls, school filters and hotel networks can stop secure connections to some sites.
- **A Wi-Fi login page.** Until you sign in, some public networks answer for every site.
- **iCloud Private Relay.** Some networks and sites do not work with Private Relay.
- **A problem on the server.** If every device and network fails, the server's TLS setup can be the cause.

### How to check

1. Open a different website. If no site opens, the problem is the connection, not this site.
2. Open the site in another browser, and on a different network, such as your phone's hotspot.
3. In Terminal, show the TLS handshake. The last lines show where it stops.

   ```
   curl -v -o /dev/null https://example.com
   ```
4. Look for filters and network extensions. Choose Apple menu > System Settings > General > Login Items & Extensions.
5. Click the Info button next to Network Extensions. Note each extension that is on.

### How to fix it

1. If you are on public Wi-Fi, sign in to the network first. See [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html).
2. If a VPN, proxy or security app is on, turn it off for a short test. Turn it on again after the test.
3. If Private Relay is on, choose View > Reload and Show IP Address in Safari. See [iCloud Private Relay breaks some websites](https://kilobat.app/guides/icloud-private-relay-sites.html).
4. If the site works on another network, ask the network's administrator about it.
5. Update macOS. Safari updates come with macOS updates.
6. If every network fails, contact the site owner.

### With Kilobat

1. Kilobat's connection doctor tests the site layer by layer: network, proxy, DNS, rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why https://example.com
   ```
2. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**Is this the same as “This Connection Is Not Private”?**

No. That warning means that Safari got a certificate but cannot trust it. This error means that the secure connection did not complete. See [“This Connection Is Not Private” and certificate warnings on a Mac](https://kilobat.app/guides/connection-not-private-mac.html).

**Does the date on my Mac matter?**

A wrong date usually causes certificate warnings instead. Make sure the date is correct anyway. See [NET::ERR_CERT_DATE_INVALID in Chrome on Mac](https://kilobat.app/guides/err-cert-date-invalid.html).

### Sources

- Error text in Safari.framework, macOS 27.2 (Localizable.strings)
- Error text in CFNetwork.framework, macOS 27.2 (Localizable.loctable)
- [Apple Developer: URLError.Code secureConnectionFailed (-1200)](https://developer.apple.com/documentation/foundation/urlerror/code/secureconnectionfailed)
- [Apple Support: If Safari doesn't work as expected on Mac](https://support.apple.com/en-us/102564)
- curl(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [“This Connection Is Not Private” and certificate warnings on a Mac](https://kilobat.app/guides/connection-not-private-mac.html): Safari shows a certificate warning when it cannot confirm the identity of a website.
- [A content filter blocks websites on a Mac](https://kilobat.app/guides/content-filter-blocking.html): A content filter examines web traffic and blocks some sites.
- [Little Snitch, LuLu and other network extensions conflict on a Mac](https://kilobat.app/guides/network-extension-conflicts.html): Firewalls, VPNs and content filters on macOS use network extensions.
- [iCloud Private Relay breaks some websites](https://kilobat.app/guides/icloud-private-relay-sites.html): iCloud Private Relay sends Safari traffic through two relays.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.

---

Source: https://kilobat.app/guides/safari-cant-find-server.html

Websites and speed

## Safari can’t find the server on a Mac

“Safari can’t find the server” usually means that the Mac could not get an address for the site name. Often DNS or the connection fails, not the site.

Applies to: Safari on macOS 13 Ventura and later. The Terminal commands work on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Safari shows “Safari can’t find the server” for one site or for all sites.
- Other apps on the Mac also cannot connect.
- The site opens on another device on the same network.

### Likely causes

- **A typing error in the address.** A wrong name has no address in DNS.
- **No internet connection.** If the Mac is not online, no name can resolve.
- **A DNS problem.** The DNS server does not answer, answers slowly, or gives an old answer from the cache.
- **Proxy, VPN or security software.** Apple says that custom proxy or DNS settings, and VPN or security software, can stop access to websites.
- **The site itself.** If every device and browser fails, the site or its DNS records can be the problem.

### How to check

1. Examine the address in the Smart Search field. Correct any typing errors.
2. Open a different website. If no site opens, examine the connection first. See [Mac connected to Wi-Fi but no internet](https://kilobat.app/guides/wifi-connected-no-internet.html).
3. In Terminal, look up the site name through the macOS resolver.

   ```
   dscacheutil -q host -a name example.com
   ```

   Output The `ip_address` or `ipv6_address` lines for the name. No lines means that the lookup failed.
4. Show the DNS servers that the Mac uses now.

   ```
   scutil --dns
   ```
5. Open the site in another browser or on another device on the same network. If it fails everywhere, the problem is probably the site.

### How to fix it

1. Reload the page. Choose View > Reload Page, or press Command-R.
2. If you use iCloud Private Relay, choose View > Reload and Show IP Address. See [iCloud Private Relay breaks some websites](https://kilobat.app/guides/icloud-private-relay-sites.html).
3. If a VPN or security app is on, turn it off for a short test.
4. Flush the DNS cache, then try again. See [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html).
5. If you set custom DNS servers, remove them for a test. Use System Settings > Network > the service > Details > DNS.
6. Update macOS. Safari updates come with macOS updates. Then restart the Mac.

### With Kilobat

1. Kilobat checks the DNS layer and the other layers in one command. It names the layer that failed.

   ```
   kilobat why example.com
   ```
2. To read or change the DNS servers, use `kilobat dns`. Changes need an administrator password.

   ```
   kilobat dns
   ```

   Output The DNS servers of the active network service.
3. To flush the DNS cache, use the same command.

   ```
   kilobat dns flush
   ```

   Needs an administrator password.

### Questions

**Does flushing the DNS cache make DNS faster?**

No. Flushing removes old answers. It helps after a site moved or after a stale error. It does not make the DNS server faster.

**Why does only Safari show the error?**

If other browsers work, look at Safari extensions and stored website data. Apple's Safari troubleshooting steps start there.

### Sources

- [Apple Support: If Safari doesn't work as expected on Mac](https://support.apple.com/en-us/102564)
- dscacheutil(1), man page installed with macOS 27.2
- scutil(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html): macOS keeps DNS answers for some time.
- [A website works on your phone but not on your Mac](https://kilobat.app/guides/site-works-on-phone-not-mac.html): When a site opens on your phone but not on your Mac, the problem is usually on the Mac.
- [iCloud Private Relay breaks some websites](https://kilobat.app/guides/icloud-private-relay-sites.html): iCloud Private Relay sends Safari traffic through two relays.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.
- [“A server with the specified hostname could not be found.” on Mac](https://kilobat.app/guides/server-hostname-not-found.html): This is the macOS text for error -1003.

---

Source: https://kilobat.app/guides/safari-not-connected-to-internet.html

Error messages

## Safari: “You Are Not Connected to the Internet” on Mac

Safari shows this page when macOS has no internet connection for it. Often Wi-Fi is off, the Mac has no address, or a VPN holds traffic.

Applies to: Safari on macOS 13 Ventura and later. The text was checked on macOS 27.2. · Checked: 29 October 2026

### Symptoms

- Safari shows the heading “You Are Not Connected to the Internet”.
- Other apps also say that they are offline.
- Wi-Fi shows as connected, but nothing loads.

### Likely causes

- **Wi-Fi is off or not joined.** The Mac is not on any network.
- **No valid IP address.** The Mac did not get an address from the router. See [Mac has a self-assigned IP address](https://kilobat.app/guides/self-assigned-ip-address.html).
- **The router or the provider has no internet.** If other devices also fail, the problem is not the Mac.
- **A VPN that blocks traffic.** Some VPNs block all traffic while they connect or after they disconnect.
- **Another network service comes first.** An Ethernet adapter or a tethered phone with no internet can be first in the service order. See [Mac uses the wrong network connection](https://kilobat.app/guides/network-service-order.html).

### How to check

1. Click the Wi-Fi icon in the menu bar. Make sure that Wi-Fi is on and that the Mac joined your network.
2. Show the address, router and subnet of the Wi-Fi service.

   ```
   networksetup -getinfo Wi-Fi
   ```
3. Show the network state that apps see. Each interface says if it is reachable.

   ```
   scutil --nwi
   ```
4. Find the router address in the `gateway` line. Then ping it.

   ```
   route -n get default
   ping -c 5 192.168.1.1
   ```
5. Ping an address on the internet. This test does not use DNS.

   ```
   ping -c 5 1.1.1.1
   ```

### How to fix it

1. Turn Wi-Fi off and on in the Wi-Fi menu, or join your network again.
2. If the address starts with 169.254, renew the DHCP lease. See [Renew the DHCP lease on a Mac](https://kilobat.app/guides/renew-dhcp-lease-mac.html).
3. Restart the router if other devices also fail.
4. Disconnect the VPN, or quit it, for a test.
5. If the problem continues, use Wireless Diagnostics. See [Use Wireless Diagnostics and wdutil on a Mac](https://kilobat.app/guides/wireless-diagnostics-mac.html).

### With Kilobat

1. Check Wi-Fi, the router, the internet, DNS and a login page in one command.

   ```
   kilobat diagnose
   ```
2. Show when the Mac lost the connection while the app ran.

   ```
   kilobat outages
   ```
3. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**Why does Safari say this when Wi-Fi has full bars?**

Full bars show a good link to the router. The router, the address or a VPN can still stop internet access. See [Mac connected to Wi-Fi but no internet](https://kilobat.app/guides/wifi-connected-no-internet.html).

### Sources

- Error text in Safari.framework, macOS 27.2 (Localizable.strings)
- [Apple Developer: URLError.Code notConnectedToInternet (-1009)](https://developer.apple.com/documentation/foundation/urlerror/code/notconnectedtointernet)
- [Apple Support: If your Mac isn't connecting to the internet over Wi-Fi](https://support.apple.com/en-us/101588)
- networksetup(8), scutil(8) and ping(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Mac connected to Wi-Fi but no internet](https://kilobat.app/guides/wifi-connected-no-internet.html): A Wi-Fi connection is only the link to the router.
- [“The Internet connection appears to be offline.” on Mac](https://kilobat.app/guides/internet-connection-appears-offline.html): This is the macOS text for error -1009 in the URL Loading System.
- [Mac has a self-assigned IP address](https://kilobat.app/guides/self-assigned-ip-address.html): If the Mac gets no answer from a DHCP server, it gives itself a link-local address from 169.254.0.0/16.
- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet.html): A VPN sends traffic through a tunnel.
- [Wi-Fi says “No Internet Connection” on Mac](https://kilobat.app/guides/wifi-no-internet-connection.html): macOS shows “No Internet Connection” under a Wi-Fi network when the Mac joined the network but cannot reach the internet through it.

---

Source: https://kilobat.app/guides/self-assigned-ip-address.html

IP, routing and IPv6

## Mac has a self-assigned IP address

If the Mac gets no answer from a DHCP server, it gives itself a link-local address from 169.254.0.0/16. This address does not reach the internet.

Applies to: macOS 13 Ventura and later for the System Settings steps. The Terminal commands work on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Network settings say that the service has a self-assigned IP address.
- The IP address starts with 169.254.
- The Mac is connected to Wi-Fi or Ethernet, but it has no internet.

### Likely causes

- **No DHCP answer.** The router or DHCP server did not answer. The ipconfig man page says macOS then can assign a link-local address.
- **A full DHCP pool.** The router has no free addresses to give.
- **A cable, adapter or Wi-Fi link fault.** The DHCP request does not reach the router.
- **A firewall or filter.** Security software can block the DHCP request or the answer.

### How to check

1. Find the device name of each network port, for example `en0` for Wi-Fi.

   ```
   networksetup -listallhardwareports
   ```
2. Show the IPv4 address of the interface.

   ```
   ipconfig getifaddr en0
   ```
3. Show the DHCP packet that the Mac accepted. No output means that DHCP did not work.

   ```
   ipconfig getpacket en0
   ```
4. Show the service's settings. Configure IPv4 must be Using DHCP for an automatic address.

   ```
   networksetup -getinfo Wi-Fi
   ```

### How to fix it

1. Renew the DHCP lease. Choose Apple menu > System Settings > Network. Click the service, then click Details.
2. Click TCP/IP, then click Renew DHCP Lease. Click OK.
3. If Configure IPv4 is Manually, set it to Using DHCP, or use this command.

   ```
   networksetup -setdhcp Wi-Fi
   ```

   Needs an administrator password.
4. Restart the router. Then renew the lease again.
5. For Ethernet, try another cable, port or adapter.
6. Turn off security software for a test. If DHCP then works, examine its settings.

### With Kilobat

1. `kilobat diagnose` checks the router and the internet, and gives advice when the router does not answer.

   ```
   kilobat diagnose
   ```

### Questions

**Is a 169.254 address always bad?**

No. Two Macs on one cable can talk with link-local addresses. But it does not reach the internet.

**Will the Mac try DHCP again by itself?**

Yes, it keeps trying. Renew the lease to try at once.

### Sources

- ipconfig(8), man page installed with macOS 27.2
- [Apple Support: Renew your IP address from the DHCP server on Mac](https://support.apple.com/guide/mac-help/mchlp1545/mac)
- [Apple Support: Change TCP/IP settings on Mac](https://support.apple.com/guide/mac-help/change-tcp-ip-settings-on-mac-mchlp2718/mac)
- [RFC 3927: Dynamic Configuration of IPv4 Link-Local Addresses](https://www.rfc-editor.org/rfc/rfc3927)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Renew the DHCP lease on a Mac](https://kilobat.app/guides/renew-dhcp-lease-mac.html): A DHCP lease gives the Mac its IP address, router and DNS servers.
- [IP address conflict on a Mac](https://kilobat.app/guides/ip-address-conflict-mac.html): Two devices on one network cannot use the same IP address.
- [Mac connected to Wi-Fi but no internet](https://kilobat.app/guides/wifi-connected-no-internet.html): A Wi-Fi connection is only the link to the router.
- [Mac does not detect a USB or Thunderbolt Ethernet adapter](https://kilobat.app/guides/ethernet-adapter-not-detected.html): A USB or Thunderbolt Ethernet adapter must appear as a hardware port and as a network service.

---

Source: https://kilobat.app/guides/server-hostname-not-found.html

Error messages

## “A server with the specified hostname could not be found.” on Mac

This is the macOS text for error -1003. The Mac could not turn the server's name into an address. DNS failed, or the name does not exist.

Applies to: All current macOS versions. The text was checked on macOS 27.2. · Checked: 29 October 2026

### Symptoms

- An app shows “A server with the specified hostname could not be found.”
- The app may show `NSURLErrorDomain` and `-1003`.
- Safari shows “Safari Can’t Find the Server” for the same name.

### Likely causes

- **No internet connection.** Without a connection, no name resolves.
- **A DNS problem.** The DNS server does not answer, or it has no answer for the name.
- **A VPN with its own DNS.** Names inside a company network resolve only through the company's DNS. See [Internal names do not resolve on a VPN](https://kilobat.app/guides/vpn-split-dns-internal-names.html).
- **A name that does not exist.** A typing error, or a server that was removed.
- **A DNS filter.** Some DNS services and filters answer that blocked names do not exist.

### How to check

1. Look up the name through the macOS resolver. No address lines means that the lookup failed.

   ```
   dscacheutil -q host -a name example.com
   ```
2. Ask a public DNS server directly. An answer here, but not above, points to your DNS settings.

   ```
   dig +short example.com @1.1.1.1
   ```
3. Show the DNS servers that the Mac uses now.

   ```
   scutil --dns
   ```
4. Ping an address on the internet. This test does not use DNS.

   ```
   ping -c 5 1.1.1.1
   ```

### How to fix it

1. If ping works but lookups fail, fix DNS. See [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html).
2. Flush the DNS cache, then try again. See [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html).
3. For a company name, connect the VPN first.
4. If a DNS filter blocks the name, allow it in the filter.

### With Kilobat

1. Kilobat's connection doctor tests the name layer by layer: network, proxy, DNS, rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why example.com
   ```
2. Read the DNS servers, or set a public DNS service for a test. Changes need an administrator password.

   ```
   kilobat dns
   ```
3. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**What is NSURLErrorDomain -1003?**

It is the cannotFindHost error of Apple's URL Loading System. Apple describes it as a host name that could not be resolved.

### Sources

- Error text in CFNetwork.framework, macOS 27.2 (Localizable.loctable)
- [Apple Developer: URLError.Code cannotFindHost (-1003)](https://developer.apple.com/documentation/foundation/urlerror/code/cannotfindhost)
- [Apple Support: Change DNS settings on Mac](https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac)
- dscacheutil(1), dig(1) and scutil(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [Safari can’t find the server on a Mac](https://kilobat.app/guides/safari-cant-find-server.html): “Safari can’t find the server” usually means that the Mac could not get an address for the site name.
- [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html): macOS keeps DNS answers for some time.
- [Internal names do not resolve on a VPN](https://kilobat.app/guides/vpn-split-dns-internal-names.html): macOS can send queries for one domain to one DNS server and other queries to another.
- [ERR_NAME_NOT_RESOLVED in Chrome on Mac](https://kilobat.app/guides/err-name-not-resolved.html): Chromium describes this error as: “The host name could not be resolved.” Chrome could not get an address for the site's name.

---

Source: https://kilobat.app/guides/site-works-on-phone-not-mac.html

Websites and speed

## A website works on your phone but not on your Mac

When a site opens on your phone but not on your Mac, the problem is usually on the Mac. Compare the two devices one layer at a time.

Applies to: macOS 13 Ventura and later for the System Settings paths. The Terminal commands work on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Safari or another browser shows an error or an empty page for one site.
- The same site opens on your phone.
- Other sites open on the Mac.
- The site fails in every browser on the Mac, or only in one browser.

### Likely causes

- **A different network.** Your phone can use cellular data while the Mac uses Wi-Fi. Then the two devices do not use the same network path.
- **Custom DNS or proxy settings.** Apple says that custom DNS or proxy settings on the Mac can stop access to some content.
- **VPN or security software.** Software that monitors or changes network connections can stop some websites.
- **Browser extensions or stored website data.** A content blocker or bad cookies can stop one site in one browser.
- **A different IP version.** The phone and the Mac can reach the site over IPv4 or IPv6. One path can fail while the other works.

### How to check

1. Connect your phone to the same Wi-Fi network as the Mac. Turn off cellular data on the phone for this test.
2. Open the site on the phone again. If it fails now too, the problem is the network or the site, not the Mac.
3. On the Mac, open the site in a private window. In Safari, choose File > New Private Window.
4. Open the site in a different browser on the Mac. If it works there, the problem is in the first browser.
5. In Terminal, request the site and show each step of the connection.

   ```
   curl -v -I https://example.com
   ```
6. Try the request over IPv4 only, then over IPv6 only. Compare the results.

   ```
   curl -4 -I https://example.com
   curl -6 -I https://example.com
   ```
7. Show the DNS servers that the Mac uses now.

   ```
   scutil --dns
   ```
8. Show the system proxy settings.

   ```
   scutil --proxy
   ```

### How to fix it

1. If the site works in a private window, remove its stored data. In Safari, choose Safari > Settings > Privacy > Manage Website Data. Select the site, then click Remove.
2. If the site works in another browser, turn off the extensions. In Safari, choose Safari > Settings > Extensions and clear each checkbox.
3. If a VPN or security app is on, turn it off for a short test. Turn it on again after the test.
4. If `scutil --proxy` shows a proxy that you do not expect, remove it.
5. Open System Settings > Network. Select the service, click Details, then click Proxies.
6. If you use custom DNS servers, set DNS back to the network's own servers for a test. See [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html).
7. If IPv6 fails and IPv4 works, read [IPv6 problems on a Mac](https://kilobat.app/guides/ipv6-problems-mac.html).
8. To reset all network settings, make a new network location. In System Settings > Network, click the Action pop-up menu, then choose Locations > Edit Locations.

### With Kilobat

1. Kilobat's connection doctor tests one site layer by layer: network, proxy, DNS, Kilobat rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why https://example.com
   ```
2. To test the path of one app, add its bundle ID. The doctor then also checks the proxy in that app's environment.

   ```
   kilobat why https://example.com --app com.apple.Safari
   ```
3. In the app, use Why can’t it connect? in the Health tab. This feature is free. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**Why does the site work on cellular data but not on my Wi-Fi?**

The two networks use different DNS servers and different routes. Test the phone on the same Wi-Fi as the Mac to compare the same path.

**Can I go back to my old network settings?**

Yes. A new location keeps the old one. Choose the old location from the Apple menu, or from the Action pop-up menu in System Settings > Network.

### Sources

- [Apple Support: If Safari doesn't work as expected on Mac](https://support.apple.com/en-us/102564)
- [Apple Support: Manage network locations on Mac](https://support.apple.com/guide/mac-help/mchlp1175/mac)
- scutil(8), man page installed with macOS 27.2
- curl(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Safari can’t find the server on a Mac](https://kilobat.app/guides/safari-cant-find-server.html): “Safari can’t find the server” usually means that the Mac could not get an address for the site name.
- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [Proxy settings stop apps from connecting on a Mac](https://kilobat.app/guides/proxy-settings-breaking-apps.html): A proxy setting sends traffic through another server.
- [IPv6 problems on a Mac](https://kilobat.app/guides/ipv6-problems-mac.html): Most networks give a Mac both IPv4 and IPv6 addresses.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.

---

Source: https://kilobat.app/guides/slow-dns-mac.html

DNS

## Slow DNS on a Mac

Every new site needs a DNS lookup before it can load. A slow resolver adds a delay to the start of each page, even on a fast connection.

Applies to: macOS 13 Ventura and later for the System Settings steps. The Terminal commands work on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- A page waits for some seconds, then loads quickly.
- The first visit to a site is slow, and the second visit is fast.
- Speed tests show a good result, but browsing feels slow.

### Likely causes

- **A slow or busy DNS server.** The router or the provider's DNS server answers slowly.
- **A DNS server that does not answer.** If the first server times out, the resolver tries the next one. Each timeout adds a delay.
- **Too many search domains.** For a short name, the resolver tries each search domain in turn. Servers that are far away make this slow.
- **A VPN or filter in the path.** A VPN can send all DNS queries through the tunnel to a server that is far away.

### How to check

1. Show the DNS servers and search domains that macOS uses.

   ```
   scutil --dns
   ```
2. Measure one lookup through the macOS resolver. Do it two times. The second result can come from the cache.

   ```
   time dscacheutil -q host -a name example.org
   ```
3. Look for search domains that you do not need.

   ```
   networksetup -getsearchdomains Wi-Fi
   ```

### How to fix it

1. Remove DNS servers that do not answer. Choose Apple menu > System Settings > Network.
2. Click the network service, click Details, then click DNS. Remove the servers that do not answer.
3. To use other DNS servers, click the Add button below the DNS Servers list and type the IP address.
4. Remove search domains that you do not need. Use the Remove button below the Search Domains list.
5. Restart the router if its DNS is slow for all devices.
6. If nothing improves, remove your changes. An empty DNS Servers list uses the servers from the network again.

### With Kilobat

1. Compare the system resolver with Cloudflare, Google and Quad9. Run it two times before you decide.

   ```
   kilobat dns-benchmark
   ```

   Output One entry per resolver with `resolver`, `milliseconds` and `replies` out of 3.
2. Split one slow site into DNS, connect, TLS and first byte.

   ```
   kilobat http-check https://example.org --json
   ```
3. Change DNS from the CLI. macOS asks for an administrator password. Use `automatic` to go back.

   ```
   kilobat dns cloudflare
   ```
4. The CLI is free. In the app, DNS switching is part of Pro, and Automatic stays free. See [Pick a faster DNS](https://kilobat.app/guides/recipes/pick-faster-dns.html).

### Questions

**Is a public DNS server always faster?**

No. A resolver near you can be faster. Measure the system resolver and the public ones before you change.

**Does flushing the DNS cache make DNS faster?**

No. A flush removes old answers. The next lookups must go to the server again.

### Sources

- [Apple Support: Change DNS settings on Mac](https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac)
- resolver(5), man page installed with macOS 27.2
- scutil(8), man page installed with macOS 27.2
- networksetup(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Pick a faster DNS](https://kilobat.app/guides/recipes/pick-faster-dns.html): Slow DNS makes every new site slow to start.
- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [Use encrypted DNS on a Mac](https://kilobat.app/guides/encrypted-dns-mac.html): Normal DNS queries are not encrypted.
- [Slow internet on a Mac: find which part is slow](https://kilobat.app/guides/slow-internet-mac-cause.html): A slow connection has many possible causes.

---

Source: https://kilobat.app/guides/slow-internet-mac-cause.html

Websites and speed

## Slow internet on a Mac: find which part is slow

A slow connection has many possible causes. Test each part of the path in order: the Wi-Fi link, the router, the internet, DNS and the other apps.

Applies to: macOS 12 Monterey and later for `networkQuality`. The other commands work on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Pages start slowly or load slowly.
- Downloads are slower than your plan.
- Video calls freeze while other devices use the network.
- The connection is slow only in some rooms or at some times.

### Likely causes

- **A weak or crowded Wi-Fi link.** Distance, walls and nearby networks lower the speed between the Mac and the router.
- **A busy router or network.** Other devices that upload or download share the same connection.
- **The internet provider or the route.** Congestion past your router adds latency and limits speed.
- **Slow DNS.** Slow name lookups make every new site start slowly.
- **Apps on the Mac.** Backups, cloud sync and updates use the connection in the background.

### How to check

1. Find the address of your router. It is the `gateway` line.

   ```
   route -n get default
   ```
2. Ping the router 20 times. Replace the address with your gateway address.

   ```
   ping -c 20 192.168.1.1
   ```

   Output A summary with packet loss and the minimum, average and maximum round-trip times.
3. Ping a server on the internet 20 times.

   ```
   ping -c 20 1.1.1.1
   ```
4. Compare the two results. High times or loss to the router point to Wi-Fi or the router. Good router times and poor internet times point past the router.
5. Measure capacity and responsiveness. This test uses data.

   ```
   networkQuality
   ```
6. Look for apps that use the connection. See [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html).
7. Connect the Mac with an Ethernet cable, if you can. Test again. If it is fast now, the Wi-Fi link is the problem.

### How to fix it

1. If the Wi-Fi link is weak, move closer to the router or remove obstacles. See [Weak Wi-Fi signal on a Mac](https://kilobat.app/guides/weak-wifi-signal-mac.html).
2. If many networks share your channel, change the channel in the router settings. See [Crowded Wi-Fi channels near your Mac](https://kilobat.app/guides/wifi-channel-congestion.html).
3. If latency rises a lot while the network is busy, read [Bufferbloat: calls lag when the network is busy](https://kilobat.app/guides/bufferbloat-mac.html).
4. If DNS is slow, read [Slow DNS on a Mac](https://kilobat.app/guides/slow-dns-mac.html).
5. Pause or schedule large backups and sync while you need the connection.
6. If the internet test is poor with a good router test, contact your provider. Give them your ping and networkQuality results.

### With Kilobat

1. One command checks the Wi-Fi signal, the router, the internet, DNS and captive portals. It names the slow part.

   ```
   kilobat diagnose
   ```

   Output A health verdict (good, degraded, poor or unknown), the measurements and advice.
2. In the app, open the Health tab. It shows signal, router and internet latency. The advice on the slow part needs Pro.
3. A speed test shows speed, latency under load and verdicts for calls and streaming. It uses up to 80 MB.

   ```
   kilobat speedtest --budget-mb 20
   ```
4. `kilobat status --watch` shows live traffic for each app. It is free.

### Questions

**Why is my speed test fast but pages still slow?**

Page loads depend on latency and DNS, not only on capacity. Compare the ping times and the DNS lookup time.

**Why does ping to my router show loss when everything works?**

Some routers give a low priority to ping replies. Look at the loss to the internet server too, and test over Ethernet.

### Sources

- ping(8), man page installed with macOS 27.2
- route(8), man page installed with macOS 27.2
- networkQuality(8), man page installed with macOS 27.2
- [Apple Support: Test Wi-Fi networks with Apple Network Responsiveness](https://support.apple.com/en-us/101942)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Test internet speed from Terminal with networkQuality](https://kilobat.app/guides/networkquality-speed-test.html): macOS includes networkQuality, a command-line test.
- [Test for packet loss on a Mac with ping](https://kilobat.app/guides/packet-loss-mac.html): Packet loss makes calls break up and pages stall.
- [Bufferbloat: calls lag when the network is busy](https://kilobat.app/guides/bufferbloat-mac.html): Bufferbloat is latency that network devices add when they hold too much data in their buffers.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.
- [Wi-Fi is slow on the Mac but fast on the phone](https://kilobat.app/guides/slow-wifi-mac-fast-phone.html): When the phone is fast on the same network, the internet connection is not the problem.

---

Source: https://kilobat.app/guides/slow-wifi-mac-fast-phone.html

Wi-Fi

## Wi-Fi is slow on the Mac but fast on the phone

When the phone is fast on the same network, the internet connection is not the problem. The difference is in the Wi-Fi link or in the software on the Mac.

Applies to: macOS 13 Ventura and later for the System Settings steps. The Terminal commands work on all current versions. · Checked: 29 October 2026

### Symptoms

- A speed test on the phone shows a much higher result than on the Mac, in the same room.
- Pages and downloads on the Mac are slow, but video on the phone plays well.
- The Mac was fast on this network before, then became slow.

### Likely causes

- **A different band.** The Mac can be on 2.4 GHz while the phone is on 5 GHz or 6 GHz. 2.4 GHz is slower and more crowded.
- **A weaker signal at the Mac.** The Mac can be farther from the router, or behind walls or metal. Apple rates metal as very high interference.
- **Software on the Mac.** A VPN, proxy, content filter or iCloud Private Relay changes the path of the traffic. Apple says that speed tests can show lower results with Private Relay on.
- **Uploads or downloads in the background.** Sync, backups and updates on the Mac share the same link.
- **Interference near the Mac.** USB 3 and Thunderbolt 3 devices and hubs near the Mac can interfere with Wi-Fi.

### How to check

1. Hold the Option key and click the Wi-Fi icon. Write down the channel, band and 802.11 protocol.
2. On the phone, find the same values in its Wi-Fi details, or in the router app.
3. Show the signal and noise of the current network.

   ```
   system_profiler SPAirPortDataType | grep -E 'Channel|Signal / Noise|Transmit Rate|PHY Mode' | head -4
   ```

   Output `Signal / Noise` in dBm, the channel with its band and width, and the `Transmit Rate`.
4. See which processes use the network now. Press q to stop.

   ```
   nettop -m route
   ```
5. Show the network services in their order. A VPN service at the top can carry all traffic.

   ```
   networksetup -listnetworkserviceorder
   ```
6. Run Apple's speed test on the Mac. Compare it with the phone.

   ```
   networkQuality
   ```

### How to fix it

1. If the Mac is on 2.4 GHz, move nearer to the router. A stronger signal lets the Mac use 5 GHz or 6 GHz.
2. If the router uses a different name for each band, give all bands one name. Apple recommends this.
3. Move USB 3 and Thunderbolt 3 devices and hubs away from the Mac. Do not put them on top of it.
4. Pause the apps that sync or back up. Then test again.
5. Turn off the VPN or proxy for a test, if you can. Then test again.
6. For a test, turn off Limit IP address tracking. In System Settings > Wi-Fi, click Details next to the network.
7. Install all macOS updates. Choose Apple menu > System Settings > General > Software Update.

### With Kilobat

1. Show the band, channel, signal and link rate of the Mac in one line.

   ```
   kilobat wifi status
   ```
2. Find which part is slow: Wi-Fi, the router, the internet or DNS.

   ```
   kilobat diagnose
   ```
3. See live upload and download for each app. Press q to stop.

   ```
   kilobat status --watch
   ```
4. The menu-bar app shows the same live traffic for each app. This is free.

### Questions

**Is a speed test on the Mac and on the phone a fair comparison?**

Only in the same place and at the same time. Run both tests one after the other, next to each other.

**Why does the link rate not match the speed test?**

The link rate is the speed between the Mac and the router. The speed test also includes the internet connection.

### Sources

- [Apple Support: Resolve Wi-Fi and Bluetooth issues caused by wireless interference](https://support.apple.com/en-us/102319)
- [Apple Support: Recommended settings for Wi-Fi routers and access points](https://support.apple.com/en-us/102766)
- [Apple Support: About iCloud Private Relay](https://support.apple.com/en-us/102602)
- [Apple Support: Use the Wi-Fi status menu on Mac](https://support.apple.com/guide/mac-help/use-the-wi-fi-status-menu-on-mac-mchlfad426fa/mac)
- system_profiler(8), nettop(1) and networkQuality(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [2.4 GHz, 5 GHz and 6 GHz Wi-Fi on a Mac](https://kilobat.app/guides/wifi-bands-2-4-5-6-ghz.html): Wi-Fi uses three bands.
- [Weak Wi-Fi signal on a Mac](https://kilobat.app/guides/weak-wifi-signal-mac.html): Signal strength and noise decide how fast and how stable the Wi-Fi link is.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.
- [Test internet speed from Terminal with networkQuality](https://kilobat.app/guides/networkquality-speed-test.html): macOS includes networkQuality, a command-line test.
- [Find a better Wi-Fi spot](https://kilobat.app/guides/recipes/find-better-wifi-spot.html): The signal radar scores your Wi-Fi several times a second.

---

Source: https://kilobat.app/guides/software-update-on-hotspot.html

Hotspots and data

## Stop Software Update downloading on a hotspot

macOS can download updates on its own. On a hotspot this can use gigabytes. Turn off automatic downloads while you tether, then update later.

Applies to: macOS 13 Ventura and later for System Settings > General > Software Update. The `softwareupdate` command is in all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Hotspot data goes down fast, and `softwareupdated` is high in Activity Monitor or `nettop`.
- App Store apps update while the Mac is on the hotspot.
- An update is ready to install after a day on a hotspot.

### Likely causes

- **Download new updates when available.** With this option on, the Mac downloads macOS updates without asking.
- **App Store automatic updates.** The App Store can update apps on its own. This is a separate setting from macOS updates.
- **App updaters.** Some apps download their own updates with their own helper, outside Software Update.

### How to check

1. Choose Apple menu > System Settings, then click General. Click Software Update.
2. Click the Info button next to Automatic Updates. Look at the options that are on.
3. See the updates that macOS can install. This command does not need an administrator password.

   ```
   softwareupdate --list
   ```
4. Look for `softwareupdated` and `appstored` in the list of processes on the hotspot.

   ```
   nettop -P -t expensive
   ```

### How to fix it

1. In Automatic Updates, turn off “Download new updates when available”. Click Done.
2. Open the App Store. Choose App Store > Settings, then turn off Automatic Updates.
3. Turn off automatic updates in apps that update themselves. Use the settings of each app.
4. On your usual network, open Software Update again and install the updates.
5. To install all recommended updates from Terminal, use `softwareupdate`. It asks for an administrator password.

   ```
   softwareupdate --install --recommended
   ```

   Needs an administrator password.

### With Kilobat

1. With the network filter on, Kilobat pauses updater helpers on metered networks. This includes macOS Software Update and App Store downloads. It needs Pro.
2. See which updaters are covered and which update bytes got through on this network.

   ```
   kilobat updaters
   ```

   Output The covered helpers, the update bytes that got through, paused connections and apps that update from inside themselves.
3. A download that started before the network became metered can finish. See [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html).

### Questions

**Do I lose updates if I turn off automatic downloads?**

No. Software Update still shows available updates. You install them when you choose.

**Does Low Data Mode stop Software Update?**

Apple describes Low Data Mode only as a way to reduce data use. To be sure, turn off automatic downloads.

**Do laptops download updates on battery?**

Apple says that a Mac laptop must have the power adapter connected to download updates automatically.

### Sources

- [Apple Support: Software Update settings on Mac](https://support.apple.com/guide/mac-help/software-update-settings-on-mac-mchla7037245/mac)
- [Apple Support: Keep your Mac up to date](https://support.apple.com/guide/mac-help/keep-your-mac-up-to-date-mchlpx1065/mac)
- [Apple Support: How to manually update apps from the App Store](https://support.apple.com/en-us/102629)
- softwareupdate(8), man page installed with macOS 27.2
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.
- [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html): On a metered network, Kilobat can pause the helpers that download updates.
- [Use Low Data Mode on a Mac](https://kilobat.app/guides/low-data-mode-mac.html): Low Data Mode tells macOS and apps to use less data on one Wi-Fi network.
- [Make a Mac treat a network as metered](https://kilobat.app/guides/metered-network-mac.html): macOS marks some connections as expensive, such as an iPhone Personal Hotspot.
- [What is softwareupdated on Mac?](https://kilobat.app/guides/what-is-softwareupdated.html): softwareupdated is the macOS Software Update daemon.

---

Source: https://kilobat.app/guides/ssh-git-timeouts.html

Developers

## SSH and Git time out on a Mac

SSH and Git need a working TCP connection to the server. A network that blocks port 22, a broken IPv6 path or a proxy can stop them.

Applies to: All current macOS versions with the OpenSSH and Git that macOS or Homebrew installs. · Checked: 29 October 2026

### Symptoms

- `git push` or `git clone` waits, then shows “Operation timed out”.
- `ssh` shows “Connection timed out” on one network but works on another.
- An SSH session freezes after some idle minutes.
- HTTPS Git remotes work, but SSH remotes do not.

### Likely causes

- **Port 22 is blocked.** Some company, hotel and public networks block SSH. GitHub says that firewalls sometimes refuse SSH connections.
- **A broken IPv6 path.** The Mac tries IPv6 first. If IPv6 does not work, the connection waits.
- **Idle connections close.** A router or firewall can drop a connection that sends no data for some time.
- **A proxy is necessary.** HTTPS Git on a company network can need `http.proxy` or proxy variables.

### How to check

1. Connect with verbose output. The last lines show where the connection stops.

   ```
   ssh -vT git@github.com
   ```
2. Test the TCP port alone, with a 5-second timeout.

   ```
   nc -vz -G 5 github.com 22
   ```
3. Try IPv4 only. If this works, the IPv6 path is the problem.

   ```
   ssh -4 -T git@github.com
   ```
4. Test GitHub's SSH service on port 443.

   ```
   ssh -T -p 443 git@ssh.github.com
   ```
5. Show Git's proxy setting and your proxy variables.

   ```
   git config --get http.proxy
   env | grep -i proxy
   ```

### How to fix it

1. If port 22 is blocked, use SSH over port 443 for GitHub. Add this block to `~/.ssh/config`.

   ```
   Host github.com
       Hostname ssh.github.com
       Port 443
       User git
   ```
2. If IPv6 fails, use IPv4 for that host. Add `AddressFamily inet` to its block in `~/.ssh/config`.
3. To keep idle sessions open, send a message every 60 seconds. Add `ServerAliveInterval 60` to the host block.
4. To stop long waits, add `ConnectTimeout 10` to the host block.
5. For HTTPS remotes behind a proxy, set Git's proxy.

   ```
   git config --global http.proxy http://proxy.example.com:8080
   ```
6. As a test, use the HTTPS URL of the repository instead of the SSH URL.

### With Kilobat

1. Kilobat's connection check tests IPv4 and IPv6 separately, so a broken IPv6 path gets a clear answer.

   ```
   kilobat why github.com
   ```
2. See the open connections of one process.

   ```
   kilobat destinations --pid 12345
   ```

### Questions

**Why does ssh -4 work when plain ssh does not?**

The Mac tried IPv6 first, and the IPv6 path did not work. With `-4`, ssh uses IPv4 only.

**What does ServerAliveInterval do?**

ssh sends a message through the connection after that many seconds without data. The default is 0, which sends none.

### Sources

- [GitHub Docs: Using SSH over the HTTPS port](https://docs.github.com/en/authentication/troubleshooting-ssh/using-ssh-over-the-https-port)
- ssh(1) and ssh_config(5), man page installed with macOS 27.2
- nc(1), man page installed with macOS 27.2
- git-config(1), http.proxy, man page installed with macOS 27.2 (Git 2.56)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [IPv6 problems on a Mac](https://kilobat.app/guides/ipv6-problems-mac.html): Most networks give a Mac both IPv4 and IPv6 addresses.
- [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html): Some company networks inspect HTTPS traffic.
- [Homebrew or npm downloads fail on a Mac](https://kilobat.app/guides/homebrew-npm-download-fails.html): Homebrew downloads with curl and Git.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.
- [ssh: connect to host port 22: Operation timed out on Mac](https://kilobat.app/guides/ssh-port-22-operation-timed-out.html): ssh sent a connection request to port 22 and got no answer.

---

Source: https://kilobat.app/guides/ssh-port-22-operation-timed-out.html

Error messages

## ssh: connect to host port 22: Operation timed out on Mac

ssh sent a connection request to port 22 and got no answer. On a Mac, the system error text is “Operation timed out”. Linux says “Connection timed out”.

Applies to: The OpenSSH that comes with macOS, on all current versions. The text was checked with OpenSSH 10.5 on macOS 27.2. · Checked: 29 October 2026

### Symptoms

- Terminal shows `ssh: connect to host github.com port 22: Operation timed out`.
- Git then shows `fatal: Could not read from remote repository.`
- SSH works on another network, such as your home network.

### Likely causes

- **The network blocks port 22.** Company, school, hotel and public networks often block SSH. GitHub says that firewalls sometimes refuse SSH connections.
- **A broken IPv6 path.** The Mac tries IPv6 first, and IPv6 does not work.
- **A VPN or proxy.** Traffic goes through a VPN that does not pass SSH.
- **The server is down or filtered.** The server does not answer on port 22.

### How to check

1. Test the TCP port alone, with a 5-second timeout.

   ```
   nc -vz -G 5 github.com 22
   ```
2. Try IPv4 only.

   ```
   ssh -4 -T git@github.com
   ```
3. For GitHub, test SSH on port 443.

   ```
   ssh -T -p 443 git@ssh.github.com
   ```
4. Connect with details. The last lines show where it stops.

   ```
   ssh -vT git@github.com
   ```

### How to fix it

1. If port 443 works, use it for GitHub. Add this block to `~/.ssh/config`.

   ```
   Host github.com
       Hostname ssh.github.com
       Port 443
       User git
   ```
2. If only IPv4 works, add `AddressFamily inet` to the host's block in `~/.ssh/config`.
3. Use the HTTPS URL of the repository instead, as a test.
4. For your own server, ask the network administrator to allow its SSH port.

### With Kilobat

1. Kilobat's connection doctor tests the host layer by layer: network, proxy, DNS, rules, IPv4, IPv6, TLS and the server. It names the layer that failed.

   ```
   kilobat why github.com
   ```
2. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**Why does my Mac say Operation timed out, not Connection timed out?**

ssh prints the system's text for the error. On macOS, the text for ETIMEDOUT is “Operation timed out”.

### Sources

- [GitHub Docs: Using SSH over the HTTPS port](https://docs.github.com/en/authentication/troubleshooting-ssh/using-ssh-over-the-https-port)
- ssh(1), ssh_config(5) and nc(1), man page installed with macOS 27.2
- intro(2), ETIMEDOUT, man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [SSH and Git time out on a Mac](https://kilobat.app/guides/ssh-git-timeouts.html): SSH and Git need a working TCP connection to the server.
- [Git: “Could not resolve host: github.com” on Mac](https://kilobat.app/guides/git-could-not-resolve-host-github.html): Git could not get an address for github.com.
- [IPv6 problems on a Mac](https://kilobat.app/guides/ipv6-problems-mac.html): Most networks give a Mac both IPv4 and IPv6 addresses.
- [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html): Some company networks inspect HTTPS traffic.

---

Source: https://kilobat.app/guides/tailscale-vpn-routing-conflicts.html

VPN, proxy and filters

## Tailscale and another VPN conflict on a Mac

Tailscale gives each device an address in 100.64.0.0/10. Another VPN can block Tailscale traffic or use the same addresses.

Applies to: Current Tailscale for macOS on macOS 13 Ventura and later. The route commands work on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Tailscale devices stop answering when the other VPN connects.
- The other VPN stops working when Tailscale connects.
- Some 100.x.y.z addresses go to the wrong network.
- An exit node stops working when a second VPN is on.

### Likely causes

- **Strict VPN firewall rules.** Tailscale says that most VPNs block traffic that does not go through them. This can drop Tailscale traffic.
- **An address overlap.** A VPN that also uses the CGNAT range, 100.64.0.0 to 100.127.255.255, conflicts with Tailscale addresses.
- **Exit nodes.** Tailscale says that exit nodes support only one VPN at a time.
- **Overlapping subnet routes.** Two tunnels can claim the same local network range. The Mac sends the traffic to one of them only.

### How to check

1. Show the state of your Tailscale connections. With the App Store version, use the full path to the CLI.

   ```
   tailscale status
   ```
2. Test one device over Tailscale only. Replace the name with your device name.

   ```
   tailscale ping my-server
   ```
3. Show which interface carries traffic to a Tailscale address.

   ```
   route -n get 100.101.102.103
   ```
4. Show all routes. Look for two `utun` interfaces with the same ranges.

   ```
   netstat -rn
   ```
5. Get a report on the network under the tunnel.

   ```
   tailscale netcheck
   ```

### How to fix it

1. Disconnect the other VPN. Make sure that Tailscale works alone.
2. Ask the other VPN provider if it can exclude 100.64.0.0/10 and fd7a:115c:a1e0::/48 from its tunnel.
3. Add your Tailscale subnet routes to that exclusion list too.
4. Do not use a Tailscale exit node while another VPN is on.
5. If the address ranges overlap, ask your network admin to change one range.
6. If nothing helps, use one VPN at a time.

### With Kilobat

1. Kilobat's connection check names the interface for each path, such as Wi-Fi or a VPN. It compares the direct path with the tunnel.

   ```
   kilobat why my-server.example.ts.net
   ```
2. List the VPN interfaces and their counters.

   ```
   kilobat interfaces --json
   ```
3. If a hosted service must reach a Tailscale address, add `--context provider`. Kilobat then says that the address is private.

   ```
   kilobat why http://100.101.102.103:8080 --context provider
   ```

### Questions

**Where is the Tailscale CLI on a Mac?**

The App Store version includes it at /Applications/Tailscale.app/Contents/MacOS/Tailscale. The standalone version can install `tailscale` in /usr/local/bin.

**Why does Tailscale use 100.x.y.z addresses?**

Tailscale uses the CGNAT range 100.64.0.0/10 for device addresses. Other VPNs can use the same range.

### Sources

- [Tailscale: Can I use Tailscale alongside other VPNs?](https://tailscale.com/kb/1105/other-vpns)
- [Tailscale: CLI](https://tailscale.com/kb/1080/cli)
- [Tailscale: Interoperability with other software](https://tailscale.com/docs/reference/interoperability)
- route(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet.html): A VPN sends traffic through a tunnel.
- [Little Snitch, LuLu and other network extensions conflict on a Mac](https://kilobat.app/guides/network-extension-conflicts.html): Firewalls, VPNs and content filters on macOS use network extensions.
- [Internal names do not resolve on a VPN](https://kilobat.app/guides/vpn-split-dns-internal-names.html): macOS can send queries for one domain to one DNS server and other queries to another.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.

---

Source: https://kilobat.app/guides/traceroute-mac.html

Websites and speed

## Find where a connection slows down with traceroute

`traceroute` shows each router on the path from your Mac to a host, with the time each one takes to answer.

Applies to: All current macOS versions. · Checked: 29 October 2026

### Symptoms

- One site or service is slow, but others are fast.
- You want to know if a delay is in your network or past it.
- Your provider asks for a trace of the route.

### Likely causes

- **Congestion on one part of the route.** A delay that starts at one hop and stays to the last hop shows a slow part of the path.
- **Routers that give low priority to probes.** One slow hop that recovers at the next hop is usually not a problem.
- **Routers that do not answer.** The man page says that an asterisk means no answer before the timeout. Some routers do not send the answers that traceroute needs.

### How to check

1. Open Terminal and trace the route to the host.

   ```
   traceroute example.com
   ```

   Output One line for each hop, with its address and three response times. An asterisk means that no answer came.
2. To skip name lookups and get results faster, add `-n`.

   ```
   traceroute -n example.com
   ```
3. If many hops show only asterisks, try ICMP probes with `-I`.

   ```
   traceroute -I example.com
   ```
4. Find the first hop where the times go up and stay up to the end.
5. Run the trace two or three times. Use the same pattern in all runs, not one result.

### How to fix it

1. If the delay starts at the first hop, examine your Wi-Fi or router. See [Slow internet on a Mac: find which part is slow](https://kilobat.app/guides/slow-internet-mac-cause.html).
2. If the delay starts in your provider's network, send the trace to your provider.
3. If the delay starts near the destination, contact the service or wait.
4. Do not use one slow middle hop as proof. Look at the last hop too.

### With Kilobat

1. Kilobat runs a bounded 12-hop route probe and saves it with the route history.

   ```
   kilobat trace example.com
   ```
2. To see whether a slow hop stays slow, trace three times. Kilobat combines every saved trace to the host hop by hop, like mtr.

   ```
   kilobat trace example.com --rounds 3
   ```
3. Show the loss, best, average and worst delay for each hop, and where lasting delay starts.

   ```
   kilobat route-history --host example.com
   ```
4. Agents can call the MCP tool `trace_route` with a `host` and `rounds`, and `get_route_history`.

### Questions

**Why does a hop show * * *?**

That router did not answer in time. Many routers do not answer probes. If later hops answer, the path works.

**Does traceroute need an administrator password?**

No. The default UDP probes and `-I` work for any user.

### Sources

- traceroute(8), man page installed with macOS 27.2
- ping(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Test for packet loss on a Mac with ping](https://kilobat.app/guides/packet-loss-mac.html): Packet loss makes calls break up and pages stall.
- [Slow internet on a Mac: find which part is slow](https://kilobat.app/guides/slow-internet-mac-cause.html): A slow connection has many possible causes.
- [A website works on your phone but not on your Mac](https://kilobat.app/guides/site-works-on-phone-not-mac.html): When a site opens on your phone but not on your Mac, the problem is usually on the Mac.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.

---

Source: https://kilobat.app/guides/usb-tethering-iphone-mac.html

Ethernet and tethering

## Connect a Mac to an iPhone hotspot with a USB cable

A USB cable gives a Mac the iPhone's internet connection and charges the iPhone. The Mac shows the connection as the iPhone USB network service.

Applies to: macOS 13 Ventura and later for the System Settings steps. Earlier versions use System Preferences > Network. · Checked: 29 October 2026

### Symptoms

- The iPhone is connected with a cable, but the Mac has no internet.
- iPhone USB does not appear in Network settings.
- iPhone USB appears, but it is not connected.

### Likely causes

- **The Mac is not trusted.** The iPhone asks “Trust This Computer?” the first time. Without Trust, the Mac cannot use the connection.
- **The service is missing or inactive.** The iPhone USB network service can be missing or turned off in Network settings.
- **Personal Hotspot is not available.** The carrier plan must include Personal Hotspot, and Cellular Data must be on.
- **Out-of-date software.** Apple recommends that you update macOS first.

### How to check

1. Connect the iPhone to the Mac with a USB cable.
2. If the iPhone asks to trust the computer, tap Trust. Enter the passcode if it asks.
3. Make sure that the iPhone appears in the Finder sidebar.
4. Choose Apple menu > System Settings, then click Network. Look for iPhone USB.
5. List the network services from Terminal. An asterisk means that a service is inactive.

   ```
   networksetup -listnetworkserviceorder
   ```

### How to fix it

1. Update macOS. Choose Apple menu > System Settings > General > Software Update.
2. If iPhone USB is in the list, click it. Click Make Inactive, then click Make Active.
3. If iPhone USB is not in the list, add it. In Network settings, click the Action pop-up menu, then choose Add Service.
4. Choose iPhone USB from the Interface pop-up menu. Click Create.
5. Restart the iPhone and the Mac if the connection still does not work.

### With Kilobat

1. If macOS does not mark the tethered connection as metered, mark it in Kilobat.

   ```
   kilobat networks cost metered
   ```
2. Then see which apps use the data, and set a budget. See [See which app uses data on a hotspot](https://kilobat.app/guides/recipes/hotspot-data-by-app.html) and [Set a monthly data budget that resets on renewal day](https://kilobat.app/guides/recipes/monthly-data-budget.html).

### Questions

**Does the Mac treat USB tethering as expensive?**

Find out with `nettop -P -l 1 -t expensive` while apps use the network. If no process appears, pause sync and updates by hand. See [Make a Mac treat a network as metered](https://kilobat.app/guides/metered-network-mac.html).

**Can I add the service from Terminal?**

Yes. `sudo networksetup -detectnewhardware` finds new network hardware and creates a default service for it. It needs an administrator password.

### Sources

- [Apple Support: If Personal Hotspot is not working on your iPhone or iPad (Wi-Fi + Cellular)](https://support.apple.com/en-us/119837)
- [Apple Support: Share the internet connection from your iPhone or iPad with your Mac](https://support.apple.com/guide/mac-help/mchl7403f0ee/mac)
- [Apple Support: Set up a network service on Mac](https://support.apple.com/guide/mac-help/set-up-a-network-service-on-mac-mchlp1176/mac)
- networksetup(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [iPhone hotspot does not show on the Mac](https://kilobat.app/guides/instant-hotspot-not-showing.html): Instant Hotspot lets a Mac join your iPhone or iPad hotspot without a password.
- [Make a Mac treat a network as metered](https://kilobat.app/guides/metered-network-mac.html): macOS marks some connections as expensive, such as an iPhone Personal Hotspot.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.
- [Mac uses the wrong network connection](https://kilobat.app/guides/network-service-order.html): When more than one connection is active, the Mac tries the service at the top of the list first.

---

Source: https://kilobat.app/guides/video-call-stutter-mac.html

Websites and speed

## Video calls stutter or freeze on a Mac

Calls need steady latency and steady upload more than high speed. Short latency spikes, packet loss and background uploads cause most freezes.

Applies to: All current macOS versions. `networkQuality` needs macOS 12 Monterey or later. · Checked: 29 October 2026

### Symptoms

- Video freezes for a moment, then continues.
- Audio sounds robotic or cuts out.
- Other people say that you freeze, but you see them clearly.
- Calls are worse when other devices use the network.

### Likely causes

- **Short latency spikes.** Spikes of a few hundred milliseconds freeze video. An average latency value does not show them.
- **Packet loss.** Lost packets break audio, even on a fast connection.
- **Background uploads.** A backup or sync that fills the upload link delays your video.
- **Bufferbloat.** Latency rises when the network is busy.
- **A weak Wi-Fi link.** Distance and interference cause both loss and spikes.

### How to check

1. Ping your router for one minute. Look for single times that are much higher than the others.

   ```
   ping -c 60 192.168.1.1
   ```
2. Find the router address first, if you do not know it. It is the `gateway` line.

   ```
   route -n get default
   ```
3. Ping a server on the internet for one minute.

   ```
   ping -c 60 1.1.1.1
   ```
4. Look for uploads in Activity Monitor > Network, or with `nettop`. See [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html).
5. Measure responsiveness. Do this before the call, not during it.

   ```
   networkQuality
   ```

### How to fix it

1. Pause cloud sync and backups during calls.
2. Move closer to the router, or connect with an Ethernet cable.
3. If Bluetooth headphones share 2.4 GHz with your Wi-Fi, use a 5 GHz network. See [Bluetooth headphones and Wi-Fi interference on a Mac](https://kilobat.app/guides/bluetooth-wifi-interference.html).
4. If spikes repeat at a regular interval, read [AirDrop, AWDL and latency spikes in games and calls](https://kilobat.app/guides/awdl-airdrop-latency-spikes.html).
5. If latency rises when the network is busy, read [Bufferbloat: calls lag when the network is busy](https://kilobat.app/guides/bufferbloat-mac.html).
6. If loss or spikes are past the router, turn off video and use audio only.

### With Kilobat

1. Kilobat's stutter test pings the router every 50 ms for 20 seconds. It shows each spike, and whether spikes repeat at a regular interval.

   ```
   kilobat stutter
   ```
2. To test the internet path instead of the router, add a target.

   ```
   kilobat stutter --target internet
   ```
3. `kilobat diagnose` reports latency, jitter and loss. Kilobat warns about calls above 300 ms latency, 30 ms jitter or 2% loss.
4. To test whether AirDrop and AWDL cause the spikes, pause them. macOS asks for an administrator password.

   ```
   kilobat low-latency on --for 1h
   ```

   Needs an administrator password.
5. The stutter test is free in the Health tab. Compare with low-latency on needs Pro. See [Test for call stutter](https://kilobat.app/guides/recipes/test-call-stutter.html).

### Questions

**Why do calls stutter when the speed test is fast?**

A speed test averages its measurements. Short spikes and small amounts of loss disappear in the average, but they freeze calls.

**Should I run a speed test during a call?**

No. The test fills the link and makes the call worse while it runs.

### Sources

- [Apple Support: Test Wi-Fi networks with Apple Network Responsiveness](https://support.apple.com/en-us/101942)
- [Bufferbloat.net: Introduction](https://www.bufferbloat.net/projects/bloat/wiki/Introduction/)
- ping(8), man page installed with macOS 27.2
- networkQuality(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Test for call stutter](https://kilobat.app/guides/recipes/test-call-stutter.html): A speed test averages its pings, so short spikes disappear.
- [Bufferbloat: calls lag when the network is busy](https://kilobat.app/guides/bufferbloat-mac.html): Bufferbloat is latency that network devices add when they hold too much data in their buffers.
- [AirDrop, AWDL and latency spikes in games and calls](https://kilobat.app/guides/awdl-airdrop-latency-spikes.html): AWDL is the Apple Wireless Direct Link.
- [Bluetooth headphones and Wi-Fi interference on a Mac](https://kilobat.app/guides/bluetooth-wifi-interference.html): Bluetooth and 2.4 GHz Wi-Fi use the same radio band.
- [Test for packet loss on a Mac with ping](https://kilobat.app/guides/packet-loss-mac.html): Packet loss makes calls break up and pages stall.

---

Source: https://kilobat.app/guides/vpn-connected-no-internet.html

VPN, proxy and filters

## VPN connected but no internet on a Mac

A VPN sends traffic through a tunnel. If the tunnel, its routes or its DNS do not work, the VPN shows Connected but sites do not load.

Applies to: macOS 13 Ventura and later for System Settings. The commands work on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- The VPN shows Connected, but no site loads.
- Sites load by IP address but not by name.
- Company sites work, but public sites do not, or the opposite.
- Everything works again when you disconnect the VPN.

### Likely causes

- **The network under the VPN.** The VPN needs a working Wi-Fi or Ethernet connection. A captive portal or a weak signal stops the tunnel.
- **Routes.** A full-tunnel VPN sends all traffic to the VPN server. If that server cannot reach the internet, nothing loads.
- **DNS.** The VPN can set its own DNS servers. If they do not answer, names do not resolve.
- **An address overlap.** If your local network uses the same address range as the company network, traffic can go to the wrong place.
- **Another VPN or filter.** A second VPN, firewall or content filter can block the tunnel traffic.

### How to check

1. Disconnect the VPN. Make sure that sites load without it.
2. Connect the VPN again. Show the VPN services and their status.

   ```
   scutil --nc list
   ```
3. Show which interface the default route uses now.

   ```
   route -n get default
   ```

   Output The `interface` line shows a `utun` interface when a full-tunnel VPN is on.
4. Show the full routing table.

   ```
   netstat -rn
   ```
5. Show the DNS servers that the VPN added.

   ```
   scutil --dns
   ```
6. Test the name and the address separately. A reply to the address but not the name points to DNS.

   ```
   ping -c 3 1.1.1.1
   ping -c 3 example.com
   ```

### How to fix it

1. Disconnect and connect the VPN again.
2. If you are on public Wi-Fi, disconnect the VPN. Complete the network login page first, then connect the VPN.
3. Quit other VPN, proxy and firewall apps. Then test again.
4. If DNS fails, ask your VPN provider or IT team for the correct DNS settings. Do not change them without their advice.
5. Restart the Mac if the VPN still fails.
6. Remove and add the VPN configuration again. Choose Apple menu > System Settings > Network, or use the VPN app.

### With Kilobat

1. Kilobat's connection check compares the direct path with the VPN path. It also checks a private VPN resolver.

   ```
   kilobat why intranet.example.com
   ```
2. List the physical and VPN interfaces with their counters.

   ```
   kilobat interfaces --json
   ```
3. Find whether the problem is the Wi-Fi, the router, the internet or DNS.

   ```
   kilobat diagnose
   ```
4. These commands are free. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html) for the app steps.

### Questions

**Why do sites load by IP address but not by name?**

The tunnel works, but DNS does not. The VPN's DNS servers do not answer, or the Mac sends names to the wrong server.

**Can I run two VPNs at the same time?**

Sometimes, but many VPNs block traffic that does not use their tunnel. Use one VPN at a time if you can.

### Sources

- [Apple Support: Set up a VPN connection on Mac](https://support.apple.com/en-us/guide/mac-help/mchlp2963/mac)
- scutil(8), man page installed with macOS 27.2
- route(8), man page installed with macOS 27.2
- netstat(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Internal names do not resolve on a VPN](https://kilobat.app/guides/vpn-split-dns-internal-names.html): macOS can send queries for one domain to one DNS server and other queries to another.
- [Tailscale and another VPN conflict on a Mac](https://kilobat.app/guides/tailscale-vpn-routing-conflicts.html): Tailscale gives each device an address in 100.64.0.0/10.
- [DNS queries go outside the VPN on a Mac](https://kilobat.app/guides/vpn-dns-leak-mac.html): With a VPN on, you usually want DNS queries to go to the VPN's servers.
- [Little Snitch, LuLu and other network extensions conflict on a Mac](https://kilobat.app/guides/network-extension-conflicts.html): Firewalls, VPNs and content filters on macOS use network extensions.
- [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html): Public networks often hold all traffic until you sign in on a login page.

---

Source: https://kilobat.app/guides/vpn-dns-leak-mac.html

DNS

## DNS queries go outside the VPN on a Mac

With a VPN on, you usually want DNS queries to go to the VPN's servers. Some settings send them to the local network's servers instead.

Applies to: macOS 13 Ventura and later for the System Settings steps. The Terminal commands work on all current macOS versions. · Checked: 29 October 2026

### Symptoms

- The VPN is connected, but a DNS test shows the local provider's servers.
- Sites see your local network's DNS server while the VPN is on.
- Internal names work, but other names use the local network's DNS.

### Likely causes

- **Manual DNS servers on Wi-Fi or Ethernet.** Servers that you typed in for a network service can stay in use beside the VPN's servers.
- **A split-tunnel VPN.** Some VPNs send only some domains or networks through the tunnel. Other queries use the local servers.
- **An encrypted DNS profile or a DNS app.** A DNS Settings profile or another DNS app can send queries to its own server.
- **The VPN app's settings.** Many VPN apps have their own DNS options. These options decide which servers macOS gets.

### How to check

1. Connect the VPN. Show the DNS configuration. Resolver #1 is the default for most names.

   ```
   scutil --dns
   ```

   Output Each resolver with its `nameserver` addresses, its `if_index` interface and, for some, a `domain`.
2. Find the interface of resolver #1. A VPN interface often has a name such as `utun`.

   ```
   ifconfig -l
   ```
3. Look for DNS servers that you set by hand on the physical service.

   ```
   networksetup -getdnsservers Wi-Fi
   ```
4. Look for profiles. On macOS 15 and later, choose Apple menu > System Settings > General > Device Management.
5. On macOS 13 and 14, choose Apple menu > System Settings > Privacy & Security > Profiles.

### How to fix it

1. Remove DNS servers that you set by hand on Wi-Fi or Ethernet, if you do not need them.

   ```
   networksetup -setdnsservers Wi-Fi empty
   ```

   Needs an administrator password.
2. Open the VPN app's settings. Turn on its option to use the VPN's DNS, if it has one.
3. Remove a DNS profile that you do not need. Select it in Device Management or Profiles, then click the Remove button.
4. Disconnect and connect the VPN again. Run `scutil --dns` again and compare.
5. Ask the VPN provider or your administrator which DNS servers the tunnel should use.

### With Kilobat

1. Kilobat lists the VPN interfaces beside the physical ones.

   ```
   kilobat interfaces --json
   ```
2. For a private name, `why` says which VPN resolver it went to and if it answers. It also compares the direct path with the tunnel.

   ```
   kilobat why intranet.corp.example
   ```

### Questions

**Does a VPN always handle all DNS?**

No. The VPN decides. A split-tunnel VPN can send only some domains to its DNS servers.

**Why do I see more than one resolver?**

macOS can use many resolvers. Resolvers with a `domain` line answer only for that domain. The scutil man page explains this.

### Sources

- scutil(8), man page installed with macOS 27.2
- resolver(5), man page installed with macOS 27.2
- [Apple Support: Change DNS settings on Mac](https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac)
- [Apple Support: Change the order of the network services your Mac uses](https://support.apple.com/guide/mac-help/change-order-network-services-mac-mchlp2711/mac)
- [Apple Support: Use configuration profiles to standardize settings on Mac computers](https://support.apple.com/guide/mac-help/configuration-profiles-standardize-settings-mh35561/mac)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Internal names do not resolve on a VPN](https://kilobat.app/guides/vpn-split-dns-internal-names.html): macOS can send queries for one domain to one DNS server and other queries to another.
- [Use encrypted DNS on a Mac](https://kilobat.app/guides/encrypted-dns-mac.html): Normal DNS queries are not encrypted.
- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet.html): A VPN sends traffic through a tunnel.
- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.

---

Source: https://kilobat.app/guides/vpn-split-dns-internal-names.html

DNS

## Internal names do not resolve on a VPN

macOS can send queries for one domain to one DNS server and other queries to another. VPNs use this split DNS for internal names.

Applies to: All current macOS versions. · Checked: 29 October 2026

### Symptoms

- Internal names such as `intranet.corp.example` fail, but public sites work.
- An internal IP address works, but its name does not.
- `dig` or `nslookup` fail, but the browser works, or the opposite.

### Likely causes

- **The VPN does not add a resolver for the domain.** The VPN must tell macOS which domains go to its DNS servers.
- **A test tool that skips the macOS rules.** `dig` uses the servers in `/etc/resolv.conf`, not the per-domain resolvers that apps use.
- **Manual DNS servers.** DNS servers set by hand on Wi-Fi do not know internal names.
- **A short name without a search domain.** A short name such as `intranet` needs a search domain to become a full name.

### How to check

1. Connect the VPN. Show all resolvers. Look for a resolver with a `domain` line for your company domain.

   ```
   scutil --dns
   ```
2. Look up the name through the macOS resolver, not through `dig`.

   ```
   dscacheutil -q host -a name intranet.corp.example
   ```
3. Show the search domains of the service.

   ```
   networksetup -getsearchdomains Wi-Fi
   ```

### How to fix it

1. Ask your administrator which domain and DNS server the VPN should use.
2. Make the folder for per-domain resolvers, if it does not exist.

   ```
   sudo mkdir -p /etc/resolver
   ```

   Needs an administrator password.
3. Make a file named after the domain. Put one `nameserver` line in it for each server.

   ```
   sudo nano /etc/resolver/corp.example
   ```

   Needs an administrator password.
4. Type the address of the internal DNS server on one line.

   ```
   nameserver 10.0.0.53
   ```
5. Save the file. Run `scutil --dns` and look for the new domain.
6. Use full names, or add the search domain in System Settings > Network > the service > Details > DNS.
7. Remove the file when you no longer need it.

   ```
   sudo rm /etc/resolver/corp.example
   ```

   Needs an administrator password.

### With Kilobat

1. For a private name, `why` says which VPN resolver it went to and if that resolver answers.

   ```
   kilobat why intranet.corp.example
   ```

### Questions

**Why does dig fail when the browser works?**

`dig` asks the servers in `/etc/resolv.conf`. The browser uses the macOS resolver, which also uses the per-domain resolvers.

**Can I edit /etc/resolv.conf?**

No. The resolver man page says that macOS maintains this file automatically. Use Network settings or `/etc/resolver`.

### Sources

- resolver(5), man page installed with macOS 27.2
- scutil(8), man page installed with macOS 27.2
- dig(1), man page installed with macOS 27.2
- [Apple Support: Change DNS settings on Mac](https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [DNS queries go outside the VPN on a Mac](https://kilobat.app/guides/vpn-dns-leak-mac.html): With a VPN on, you usually want DNS queries to go to the VPN's servers.
- [VPN connected but no internet on a Mac](https://kilobat.app/guides/vpn-connected-no-internet.html): A VPN sends traffic through a tunnel.
- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.

---

Source: https://kilobat.app/guides/wake-for-network-access.html

Sleep and power

## Use Wake for network access on a Mac

Wake for network access lets a sleeping Mac wake when another computer uses its shared resources. Turn it on for file sharing, or off to stop network wakes.

Applies to: macOS 13 Ventura and later for the System Settings paths. `pmset` is in all current macOS versions. · Checked: 29 October 2026

### Symptoms

- Other computers cannot reach a shared folder or printer while the Mac sleeps.
- The Mac wakes at night for no clear reason.
- A Wake-on-LAN packet does not wake the Mac.

### Likely causes

- **The setting is off.** Without Wake for network access, the Mac does not wake for other computers.
- **Regular wakes are normal.** Apple says that the Mac also wakes at intervals to tell the network that its resources are available.
- **The network equipment.** Apple says that this feature needs an Apple wireless device that supports 802.11n with the latest firmware.
- **Other causes of wakes.** Shared printers, files, input devices and connected devices can also wake the Mac or keep it awake.

### How to check

1. On a Mac laptop, choose Apple menu > System Settings > Battery. Click Options.
2. Look at the “Wake for network access” pop-up menu.
3. On a Mac desktop, choose Apple menu > System Settings > Energy. Look at “Wake for network access”.
4. See the setting from Terminal. In the `womp` line, 1 means on.

   ```
   pmset -g
   ```
5. See a history of sleeps and wakes, with the reasons.

   ```
   pmset -g log | grep -e " Sleep " -e " Wake "
   ```

### How to fix it

1. To let other computers wake the Mac, turn on “Wake for network access”.
2. On a laptop, choose an option in the pop-up menu, then click Done.
3. To stop network wakes on a laptop, set “Wake for network access” to Never.
4. On a desktop, turn off “Wake for network access” in Energy.
5. Turn off sharing services that you do not use. Choose General > Sharing in System Settings.
6. Set the same setting from Terminal for all power sources. 1 is on and 0 is off.

   ```
   sudo pmset -a womp 1
   ```

   Needs an administrator password.

### With Kilobat

1. Send a Wake-on-LAN packet to another computer on your network.

   ```
   kilobat wake AA:BB:CC:DD:EE:FF
   ```
2. To keep this Mac awake for a task instead, see [Keep your Mac awake until a download finishes](https://kilobat.app/guides/recipes/keep-mac-awake-download.html).

### Questions

**Is Wake for network access the same as Wake-on-LAN?**

The pmset man page says that `womp` is the same as “Wake for network access” in System Settings. `womp` means wake on Ethernet magic packet.

**Why does my Mac wake at night?**

With this setting on, the Mac wakes at intervals to tell the network about its shared resources. Other devices and apps can also wake it.

### Sources

- [Apple Support: Share your Mac resources when it’s in sleep](https://support.apple.com/guide/mac-help/mh27905/mac)
- [Apple Support: Set sleep and wake settings for your Mac](https://support.apple.com/guide/mac-help/prevent-your-mac-from-sleeping-mchle41a6ccd/mac)
- [Apple Support: If your Mac sleeps or wakes unexpectedly](https://support.apple.com/guide/mac-help/mchlp2995/mac)
- pmset(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Mac sleep stops downloads](https://kilobat.app/guides/mac-sleep-stops-downloads.html): A Mac that goes to sleep stops most app activity, so a long download can stop or fail.
- [Keep a Mac awake from Terminal with caffeinate](https://kilobat.app/guides/caffeinate-keep-mac-awake.html): The caffeinate command stops a Mac from sleeping while a task runs.
- [Find the devices on your local network from a Mac](https://kilobat.app/guides/find-devices-on-network.html): macOS has two built-in ways to see other devices: the ARP table and Bonjour.
- [Keep a Mac laptop working with the lid closed](https://kilobat.app/guides/clamshell-lid-closed-mac.html): Closing the lid puts a Mac laptop to sleep.

---

Source: https://kilobat.app/guides/weak-wifi-signal-mac.html

Wi-Fi

## Weak Wi-Fi signal on a Mac

Signal strength and noise decide how fast and how stable the Wi-Fi link is. The Mac shows both values in dBm.

Applies to: All current macOS versions. · Checked: 29 October 2026

### Symptoms

- The Wi-Fi icon shows one or two bars.
- The connection is fast in one room and slow or lost in another.
- Video calls break up when you move the Mac.

### Likely causes

- **Distance from the router.** The signal becomes weaker with distance. 5 GHz and 6 GHz lose strength faster through walls than 2.4 GHz.
- **Obstacles.** Apple rates metal as very high interference, and plaster, concrete and bulletproof glass as high.
- **Noise.** Other devices and networks add noise. A high noise level lowers the useful signal.
- **Router position.** A router in a cabinet, behind a television or on the floor covers less area.

### How to check

1. Show the signal and noise of the current network.

   ```
   system_profiler SPAirPortDataType | grep -m1 'Signal / Noise'
   ```

   Output For example `Signal / Noise: -58 dBm / -94 dBm`. A value nearer to 0 is stronger.
2. Subtract the noise from the signal. The result is the signal-to-noise ratio in dB.
3. Show more details of the Wi-Fi interface.

   ```
   wdutil info
   ```
4. Move to the place where you use the Mac. Read the values again.

### How to fix it

1. Move the Mac nearer to the router, or remove obstacles between them.
2. Put the router in an open, central and high position.
3. Keep the router away from metal, microwave ovens and cordless phones.
4. If the house is large, add an access point or a mesh node. A wired connection to the node is best.
5. Use Ethernet for a desk that stays in one place.

### With Kilobat

1. Kilobat rates the signal. −65 dBm or stronger is good, and weaker than −75 dBm is poor.
2. Walk with the Mac and follow the signal score, four times each second. Press q to stop.

   ```
   kilobat radar --watch
   ```
3. Save a reading under the name of the room, to compare rooms later.

   ```
   kilobat spots save "Kitchen"
   ```
4. In the app, Signal radar is part of Kilobat Pro. The CLI is free. See [Find a better Wi-Fi spot](https://kilobat.app/guides/recipes/find-better-wifi-spot.html).

### Questions

**When does a Mac look for a better access point?**

Apple says that a Mac keeps its access point until the signal is weaker than −75 dBm. A new access point must be 12 dB stronger.

**Does a stronger signal always mean faster internet?**

No. The internet connection or the router can still be the slow part. See [Slow internet on a Mac: find which part is slow](https://kilobat.app/guides/slow-internet-mac-cause.html).

### Sources

- [Apple Support: Resolve Wi-Fi and Bluetooth issues caused by wireless interference](https://support.apple.com/en-us/102319)
- [Apple Platform Deployment: Wi-Fi roaming support in Apple devices](https://support.apple.com/guide/deployment/wi-fi-roaming-support-dep98f116c0f/web)
- [Apple Platform Deployment: Optimize your Wi-Fi networks for Apple devices](https://support.apple.com/guide/deployment/optimize-your-wi-fi-networks-dep2af1caf35/web)
- system_profiler(8) and wdutil(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Find a better Wi-Fi spot](https://kilobat.app/guides/recipes/find-better-wifi-spot.html): The signal radar scores your Wi-Fi several times a second.
- [Crowded Wi-Fi channels near your Mac](https://kilobat.app/guides/wifi-channel-congestion.html): Networks on the same channel share the air time.
- [2.4 GHz, 5 GHz and 6 GHz Wi-Fi on a Mac](https://kilobat.app/guides/wifi-bands-2-4-5-6-ghz.html): Wi-Fi uses three bands.
- [Slow internet on a Mac: find which part is slow](https://kilobat.app/guides/slow-internet-mac-cause.html): A slow connection has many possible causes.

---

Source: https://kilobat.app/guides/what-is-appstoreagent.html

macOS processes

## What are appstoreagent and appstored on Mac?

`appstoreagent` and `appstored` support the App Store. App downloads and app updates show under them, not under the App Store app.

Process: `appstoreagent` · Process: `appstored` · Process: `storedownloadd` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `appstoreagent` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `appstoreagent` can connect.
- `appstored` moves a lot of data while the App Store app is closed.

### What it is

The man pages call `appstoreagent` the “App Store support agent” and `appstored` the “App Store support daemon”. Both are in the AppStoreDaemon framework of macOS.

Kilobat also counts `storedownloadd` as an App Store download service. Apple does not document storedownloadd in a man page.

### Why it uses the network

- **App updates.** With automatic updates on, the App Store updates apps on its own.
- **App downloads.** Apps that you get or download again from the App Store.
- **Store checks.** The App Store also checks your purchases and updates.

### Is it normal?

Yes. Bursts of traffic when apps update are usual. Large apps can be several gigabytes.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `appstored` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p appstored -P
   ```
4. Do the same for `appstoreagent` and `storedownloadd`.

### Reduce or pause it safely

1. Open the App Store. Choose App Store > Settings.
2. Turn off Automatic Updates. The App Store then shows updates, and you install them when you choose.
3. To update an app now, click Updates in the sidebar of the App Store.
4. Do not quit `appstored` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `appstored`. Its row shows the live rate and the bytes it moved.
2. Kilobat puts this service in the System downloads group, with one line about what it does. Expand the group to see each service.
3. With the network filter on, click the service. The panel names the apps that the downloads were for, for example “For Music”.
4. Without the filter, macOS shows only the service. Then Kilobat cannot say which app a download was for.
5. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
6. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth appstored day
   ```
7. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `appstored`.
8. With Pro and the network filter, Kilobat pauses this updater on metered networks. The app keeps working. See [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html).

   ```
   kilobat updaters
   ```
9. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Do apps from the App Store update with Software Update?**

No. App Store apps update in the App Store. macOS updates use Software Update.

**Why does a download continue after I close the App Store?**

The download runs in appstored, not in the App Store app. It continues until it is complete or you pause it.

### Sources

- appstoreagent(8) and appstored(8), man page installed with macOS 27.2
- [Apple Support: How to manually update apps from the App Store](https://support.apple.com/en-us/102629)
- [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555)
- nettop(1), man page installed with macOS 27.2
- [Kilobat docs: System downloads](https://kilobat.app/docs.html#system-downloads)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Stop Software Update downloading on a hotspot](https://kilobat.app/guides/software-update-on-hotspot.html): macOS can download updates on its own.
- [What is softwareupdated on Mac?](https://kilobat.app/guides/what-is-softwareupdated.html): softwareupdated is the macOS Software Update daemon.
- [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html): On a metered network, Kilobat can pause the helpers that download updates.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.

---

Source: https://kilobat.app/guides/what-is-apsd.html

macOS processes

## What is apsd on Mac?

`apsd` keeps one connection open to the Apple Push Notification service. Apps and iCloud use it to get notifications.

Process: `apsd` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `apsd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `apsd` can connect.
- `apsd` keeps a connection open all the time, also when the Mac does nothing.

### What it is

The man page calls apsd the “Apple Push Notification service daemon”. It is part of the ApplePushService framework.

Apps do not hold their own connection for notifications. Apple's developer documentation says that apps register with APNs and get a device token.

### Why it uses the network

- **A connection that stays open.** Apple says that devices use TCP port 5223 for APNs. Port 443 is the fallback when 5223 is blocked.
- **Notifications.** Messages, mail, calendar changes and app notifications arrive through it.

### Is it normal?

Yes. A steady, small connection is how push notifications work. Its traffic is usually small.

Repeated reconnections can mean that a firewall or proxy blocks port 5223.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `apsd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p apsd -P
   ```
4. Show its connection and port.

   ```
   lsof -nP -i -a -c apsd
   ```

### Reduce or pause it safely

1. Turn off notifications for apps that you do not need. Choose Apple menu > System Settings > Notifications.
2. If you manage a network, allow TCP port 5223 to Apple. Apple lists the hosts and ports in its enterprise network article.
3. Do not quit `apsd` in Activity Monitor. It is part of macOS, and other features depend on it. Notifications come through it.

### With Kilobat

1. Open the Kilobat app list and search for `apsd`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth apsd day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `apsd`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Why do I not get notifications on a company network?**

Apple says that devices need TCP port 5223 to Apple's network. Some company firewalls block it.

**Does a proxy break push notifications?**

Apple says that port 443 traffic can go through a proxy that does not decrypt it.

### Sources

- apsd(8), man page installed with macOS 27.2
- [Apple Support: If your Apple devices aren't getting Apple push notifications](https://support.apple.com/en-us/102266)
- [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555)
- [Apple Developer: Registering your app with APNs](https://developer.apple.com/documentation/usernotifications/registering-your-app-with-apns)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is identityservicesd on Mac?](https://kilobat.app/guides/what-is-identityservicesd.html): identityservicesd is part of the Apple Identity Service.
- [Proxy settings stop apps from connecting on a Mac](https://kilobat.app/guides/proxy-settings-breaking-apps.html): A proxy setting sends traffic through another server.
- [A content filter blocks websites on a Mac](https://kilobat.app/guides/content-filter-blocking.html): A content filter examines web traffic and blocks some sites.
- [The macOS firewall blocks incoming connections](https://kilobat.app/guides/macos-firewall-incoming.html): The macOS firewall controls connections that other computers start to your Mac.

---

Source: https://kilobat.app/guides/what-is-assetcache.html

macOS processes

## What is AssetCache on Mac?

`AssetCache` is the Content Caching service. It keeps Apple downloads on this Mac and gives them to other Apple devices on the same network.

Process: `AssetCache` · Applies to: macOS 13 Ventura and later for the System Settings path. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `AssetCache` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `AssetCache` can connect.
- The Mac uploads a lot on the local network while other devices update.

### What it is

The man page says that AssetCache speeds up Apple downloads by caching them on the local network. macOS starts it automatically.

Apple's settings let it cache software updates and apps, iCloud content, or both.

### Why it uses the network

- **Downloads from Apple.** It downloads content from Apple the first time a device on the network asks for it.
- **Uploads to other devices.** Other Apple devices on the network then download the content from this Mac. This is local traffic.
- **Registration with Apple.** Apple's list of hosts shows that a caching Mac contacts Apple servers to register.

### Is it normal?

Yes, if you turned on Content Caching. Large uploads on the local network are its purpose.

If you did not turn it on, a management profile from your organization can turn it on. Ask your administrator.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `AssetCache` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p AssetCache -P
   ```
4. Show the status of the cache and the amount of data it served.

   ```
   AssetCacheManagerUtil status
   ```

### Reduce or pause it safely

1. Choose Apple menu > System Settings > General > Sharing.
2. Click the Info button next to Content Caching. Change the cache options, or turn Content Caching off.
3. On a hotspot, devices do not need this Mac's cache. Turn it off while you travel.

### With Kilobat

1. Open the Kilobat app list and search for `AssetCache`. Its row shows the live rate and the bytes it moved.
2. Kilobat puts this service in the System downloads group, with one line about what it does. Expand the group to see each service.
3. With the network filter on, click the service. The panel names the apps that the downloads were for, for example “For Music”.
4. Without the filter, macOS shows only the service. Then Kilobat cannot say which app a download was for.
5. Kilobat shows local network traffic apart from Internet traffic. Local uploads do not count toward a data budget.
6. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
7. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth AssetCache day
   ```
8. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `AssetCache`.
9. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Does Content Caching use my internet data?**

It downloads each item from Apple once. The uploads to other devices stay on the local network.

### Sources

- AssetCache(8) and AssetCacheManagerUtil(8), man page installed with macOS 27.2
- [Apple Support: Change Content Caching settings on Mac](https://support.apple.com/guide/mac-help/about-content-caching-on-mac-mchleaf1e61d/mac)
- [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is softwareupdated on Mac?](https://kilobat.app/guides/what-is-softwareupdated.html): softwareupdated is the macOS Software Update daemon.
- [What are appstoreagent and appstored on Mac?](https://kilobat.app/guides/what-is-appstoreagent.html): appstoreagent and appstored support the App Store.
- [Find the devices on your local network from a Mac](https://kilobat.app/guides/find-devices-on-network.html): macOS has two built-in ways to see other devices: the ARP table and Bonjour.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.

---

Source: https://kilobat.app/guides/what-is-assistantd.html

macOS processes

## What is assistantd on Mac?

`assistantd` is the Siri daemon. When you use Siri, its traffic can show under assistantd. The Siri settings control it.

Process: `assistantd` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `assistantd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `assistantd` can connect.
- Traffic appears after you ask Siri something.

### What it is

The man page calls it the “Siri Daemon” and says that it enables Siri features. It is in the AssistantServices framework of macOS.

Apple does not document which Siri requests go to its servers and which stay on the Mac.

### Why it uses the network

- **Siri requests.** Some answers need information from the internet, for example weather or web results.

### Is it normal?

Yes, when you use Siri. Apple does not publish how much data Siri uses.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `assistantd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p assistantd -P
   ```

### Reduce or pause it safely

1. Choose Apple menu > System Settings > Siri.
2. Change how Siri listens, or click Turn Off Siri if you do not use it.
3. Do not quit `assistantd` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `assistantd`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth assistantd day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `assistantd`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Does assistantd listen all the time?**

The Siri settings decide how Siri listens. You can turn off voice activation there.

### Sources

- assistantd(8), man page installed with macOS 27.2
- [Apple Support: Siri settings on Mac](https://support.apple.com/guide/mac-help/siri-settings-on-mac-mchl3fd7fc15/mac)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is parsecd on Mac?](https://kilobat.app/guides/what-is-parsecd.html): parsecd supports search suggestions in Spotlight, Safari, Siri and Look Up.
- [What is privatecloudcomputed on Mac?](https://kilobat.app/guides/what-is-privatecloudcomputed.html): privatecloudcomputed encrypts and sends some Apple Intelligence requests to Apple's Private Cloud Compute servers.
- [What is mobileassetd on Mac?](https://kilobat.app/guides/what-is-mobileassetd.html): mobileassetd downloads system assets for macOS.

---

Source: https://kilobat.app/guides/what-is-bird.html

macOS processes

## What is bird on Mac?

`bird` is one of the macOS daemons behind iCloud Drive. Its traffic is your iCloud Drive files going up and down.

Process: `bird` · Applies to: macOS 15 Sequoia and later for the Saved to iCloud path. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `bird` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `bird` can connect.
- The Mac uploads for a long time after you copy files into iCloud Drive.

### What it is

The man page calls bird one of the daemons “backing the Documents in the Cloud feature”. That feature is iCloud Drive.

The program is in the iCloudDriveCore framework of macOS. The man page points to `brctl`, which manages the CloudDocs daemon and shows sync status.

### Why it uses the network

- **Uploads.** Files that you add or change in iCloud Drive go to iCloud.
- **Downloads.** Files that change on other devices come to this Mac.
- **Desktop and Documents.** With Desktop & Documents Folders on, those folders sync too.

### Is it normal?

Yes. Traffic after you add or change files is usual. Large folders take a long time.

Look closer if a sync never ends. A file that cannot sync can stay in the queue.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `bird` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p bird -P
   ```
4. Show the iCloud Drive status in Terminal.

   ```
   brctl status
   ```

### Reduce or pause it safely

1. Do large copies into iCloud Drive on your usual network, not on a hotspot.
2. Choose Apple menu > System Settings. Click your name, then click iCloud. Click Drive.
3. To stop the sync of the Desktop and Documents folders, turn off Desktop & Documents Folders. Apple's article explains what stays where.
4. To stop iCloud Drive on this Mac, turn off “Sync this Mac”. Read Apple's article first.
5. On a hotspot or a capped network, turn on Low Data Mode. Choose Apple menu > System Settings > Wi-Fi. Click Details next to the network, then turn on Low data mode.
6. Do not quit `bird` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `bird`. Its row shows the live rate and the bytes it moved.
2. Kilobat puts this service in the System downloads group, with one line about what it does. Expand the group to see each service.
3. With the network filter on, click the service. The panel names the apps that the downloads were for, for example “For Music”.
4. Without the filter, macOS shows only the service. Then Kilobat cannot say which app a download was for.
5. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
6. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth bird day
   ```
7. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `bird`.
8. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Is bird a virus?**

No. It is part of macOS, in the iCloudDriveCore framework, and it has a man page.

**How do I see what iCloud Drive syncs?**

Run `brctl status` in Terminal. It lists the iCloud containers and their sync state.

### Sources

- bird(8) and brctl(1), man page installed with macOS 27.2
- [Apple Support: Change iCloud settings on Mac](https://support.apple.com/guide/mac-help/change-icloud-settings-on-mac-mh36817/mac)
- [Apple Support: Add your Desktop and Documents files to iCloud Drive](https://support.apple.com/en-us/109344)
- nettop(1), man page installed with macOS 27.2
- [Kilobat docs: System downloads](https://kilobat.app/docs.html#system-downloads)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is cloudd on Mac?](https://kilobat.app/guides/what-is-cloudd.html): cloudd syncs app data with iCloud for apps that use CloudKit.
- [What is fileproviderd on Mac?](https://kilobat.app/guides/what-is-fileproviderd.html): fileproviderd connects cloud storage apps to the files in the Finder.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.

---

Source: https://kilobat.app/guides/what-is-cloudd.html

macOS processes

## What is cloudd on Mac?

`cloudd` syncs app data with iCloud for apps that use CloudKit. Its traffic belongs to those apps. The iCloud settings control it.

Process: `cloudd` · Applies to: macOS 15 Sequoia and later for the Saved to iCloud path. In macOS 13 and 14, the list is under Apps Using iCloud. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `cloudd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `cloudd` can connect.
- Upload activity is high after you add many notes, files or photos to an app that syncs.

### What it is

The man page calls cloudd “the system daemon backing the CloudKit feature”. It is in the CloudKitDaemon framework of macOS.

CloudKit lets apps store data in iCloud containers. Apple apps and other apps can use it. The traffic goes through cloudd, not through each app.

### Why it uses the network

- **Sync of app data.** When you change data in an app that uses iCloud, cloudd uploads the change and downloads changes from other devices.
- **A first sync.** After you sign in to iCloud or turn on an app, all of its data can sync at once.

### Is it normal?

Yes. Short bursts after changes are usual. A first sync can be large.

Long, steady uploads mean that an app syncs a lot of data. Find the app in the iCloud settings.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `cloudd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p cloudd -P
   ```

### Reduce or pause it safely

1. Choose Apple menu > System Settings. Click your name, then click iCloud.
2. Under Saved to iCloud, click See All. Turn off the apps that you do not need to sync.
3. Turn sync on again later. Apple's article explains what happens to the data in each app.
4. On a hotspot or a capped network, turn on Low Data Mode. Choose Apple menu > System Settings > Wi-Fi. Click Details next to the network, then turn on Low data mode.
5. Do not quit `cloudd` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `cloudd`. Its row shows the live rate and the bytes it moved.
2. Kilobat puts this service in the System downloads group, with one line about what it does. Expand the group to see each service.
3. With the network filter on, click the service. The panel names the apps that the downloads were for, for example “For Music”.
4. Without the filter, macOS shows only the service. Then Kilobat cannot say which app a download was for.
5. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
6. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth cloudd day
   ```
7. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `cloudd`.
8. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Is cloudd the same as iCloud Drive?**

No. iCloud Drive files use bird. cloudd syncs data of apps that use CloudKit. See [What is bird on Mac?](https://kilobat.app/guides/what-is-bird.html).

**Can I see which app cloudd syncs for?**

macOS tools show only cloudd. With its network filter on, Kilobat names the app that a connection was for.

### Sources

- cloudd(8), man page installed with macOS 27.2
- [Apple Developer: CloudKit](https://developer.apple.com/documentation/cloudkit)
- [Apple Support: Change iCloud settings on Mac](https://support.apple.com/guide/mac-help/change-icloud-settings-on-mac-mh36817/mac)
- [Apple Support: Change which apps sync and store data with iCloud](https://support.apple.com/en-us/118225)
- nettop(1), man page installed with macOS 27.2
- [Kilobat docs: System downloads](https://kilobat.app/docs.html#system-downloads)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is bird on Mac?](https://kilobat.app/guides/what-is-bird.html): bird is one of the macOS daemons behind iCloud Drive.
- [What is cloudphotod on Mac?](https://kilobat.app/guides/what-is-cloudphotod.html): cloudphotod is the iCloud Photos agent.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.

---

Source: https://kilobat.app/guides/what-is-cloudphotod.html

macOS processes

## What is cloudphotod on Mac?

`cloudphotod` is the iCloud Photos agent. Uploads and downloads of your photo library show under it. Photos has a Pause button for uploads.

Process: `cloudphotod` · Process: `photolibraryd` · Process: `photoanalysisd` · Applies to: macOS 13 Ventura and later. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `cloudphotod` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `cloudphotod` can connect.
- Upload is high for hours after you import photos or videos.

### What it is

The man pages describe three agents. `cloudphotod` is “responsible for all iCloud Photos activity”.

`photolibraryd` “handles all photo library requests”. `photoanalysisd` handles background processing for Memories, People and search.

Of these three, cloudphotod is the one with the iCloud Photos sync. The man pages do not say that the other two use the network.

### Why it uses the network

- **Uploads of new photos and videos.** With iCloud Photos on, new items upload to iCloud.
- **Downloads from other devices.** Items from your iPhone or other devices download to this Mac.
- **Originals on demand.** With Optimize Storage, the Mac downloads the full original when you open an item.

### Is it normal?

Yes. A large upload after an import is usual. A first sync of a library can take days.

Apple says that iCloud Photos pauses itself in Low Data Mode, Low Power Mode and in some other conditions.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `cloudphotod` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p cloudphotod -P
   ```
4. In Photos, click Library, then All Photos. Scroll to the bottom to see the sync status.

### Reduce or pause it safely

1. To pause uploads for one day, open Photos. Click Library, then All Photos.
2. Scroll to the bottom and click Pause.
3. On a hotspot or a capped network, turn on Low Data Mode. Choose Apple menu > System Settings > Wi-Fi. Click Details next to the network, then turn on Low data mode.
4. Do not turn off iCloud Photos to fix a slow sync. Apple says that this starts the sync again.
5. Do not quit `cloudphotod` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `cloudphotod`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth cloudphotod day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `cloudphotod`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Why is photoanalysisd busy when I am offline?**

Its work is analysis of the library on the Mac. The man page describes it as background processing, not as sync.

**How long does Pause last?**

Apple says that Pause stops uploads for one day.

### Sources

- cloudphotod(8), photolibraryd(8) and photoanalysisd(8), man page installed with macOS 27.2
- [Apple Support: Set up and use iCloud Photos](https://support.apple.com/en-us/108782)
- [Apple Support: If your iCloud Photos aren't syncing or syncing with iCloud is paused](https://support.apple.com/en-us/101559)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is cloudd on Mac?](https://kilobat.app/guides/what-is-cloudd.html): cloudd syncs app data with iCloud for apps that use CloudKit.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.
- [Use Low Data Mode on a Mac](https://kilobat.app/guides/low-data-mode-mac.html): Low Data Mode tells macOS and apps to use less data on one Wi-Fi network.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.

---

Source: https://kilobat.app/guides/what-is-configd.html

macOS processes

## What is configd on Mac?

`configd` keeps the network configuration of the Mac. It gets IP addresses with DHCP, so it sends small amounts of traffic to the router.

Process: `configd` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `configd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `configd` can connect.
- Small traffic appears when the Mac joins a network or wakes from sleep.

### What it is

The man page says that configd “is responsible for many configuration aspects of the local system”. Most of its agents set up the network.

The man page says that its IPConfiguration agent sets up IPv4 and IPv6 addresses. They are manual, or they come from DHCP, DHCPv6 or router advertisements.

### Why it uses the network

- **DHCP.** It asks the router for an address, and it renews the lease.
- **Network changes.** When a link goes up or down, its agents update the configuration.

### Is it normal?

Yes. DHCP traffic is small. A large amount of data under configd is not usual. Then examine what else runs.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `configd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p configd -P
   ```
4. Show the DHCP answer that the Mac accepted. Use the device name of the service, for example en0.

   ```
   ipconfig getpacket en0
   ```

### Reduce or pause it safely

1. There is nothing to reduce. Its traffic is the minimum that a network connection needs.
2. If the Mac renews its address too often, examine the network. See [Renew the DHCP lease on a Mac](https://kilobat.app/guides/renew-dhcp-lease-mac.html).
3. Do not quit `configd` in Activity Monitor. It is part of macOS, and other features depend on it. It keeps the network configuration.

### With Kilobat

1. Open the Kilobat app list and search for `configd`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth configd day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `configd`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Is configd part of macOS?**

Yes. It is `/usr/libexec/configd`, with a man page.

### Sources

- configd(8) and ipconfig(8), man page installed with macOS 27.2
- [Apple Support: Renew your IP address from the DHCP server on Mac](https://support.apple.com/guide/mac-help/mchlp1545/mac)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Renew the DHCP lease on a Mac](https://kilobat.app/guides/renew-dhcp-lease-mac.html): A DHCP lease gives the Mac its IP address, router and DNS servers.
- [Mac has a self-assigned IP address](https://kilobat.app/guides/self-assigned-ip-address.html): If the Mac gets no answer from a DHCP server, it gives itself a link-local address from 169.254.0.0/16.
- [See Mac network settings in Terminal](https://kilobat.app/guides/network-settings-terminal.html): macOS includes command-line tools that show the same network settings as System Settings, and more.

---

Source: https://kilobat.app/guides/what-is-fileproviderd.html

macOS processes

## What is fileproviderd on Mac?

`fileproviderd` connects cloud storage apps to the files in the Finder. To reduce the sync traffic, pause the cloud storage app.

Process: `fileproviderd` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `fileproviderd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `fileproviderd` can connect.
- A cloud storage app syncs, and fileproviderd is busy at the same time.

### What it is

The man page says that fileproviderd controls “the interaction between extensions and filecoordinationd”. It also coordinates the listing of files and their properties.

Apple's File Provider framework lets an app show files that it syncs with remote storage. iCloud Drive and many other cloud storage apps use it.

### Why it uses the network

- **Files that a cloud app syncs.** When the Finder or an app opens a file that is only in the cloud, the provider downloads it.
- **Changes to files.** When you change a file, the provider uploads the change.

### Is it normal?

Yes, when a cloud storage app syncs. Each provider app also moves data in its own processes. Look at both.

Apple does not document how much traffic goes through fileproviderd and how much through the provider app.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `fileproviderd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p fileproviderd -P
   ```
4. In the same list, look at the cloud storage app, for example Dropbox or Google Drive. Compare their bytes.

### Reduce or pause it safely

1. Pause sync in the cloud storage app. Use the app's menu bar item or its settings.
2. Choose which folders the app keeps on this Mac. Most cloud storage apps can keep files online only.
3. For iCloud Drive, use the iCloud settings. See [What is bird on Mac?](https://kilobat.app/guides/what-is-bird.html).
4. Do not quit `fileproviderd` in Activity Monitor. It is part of macOS, and other features depend on it. The Finder needs it to show cloud files.

### With Kilobat

1. Open the Kilobat app list and search for `fileproviderd`. Its row shows the live rate and the bytes it moved.
2. Kilobat puts this service in the System downloads group, with one line about what it does. Expand the group to see each service.
3. With the network filter on, click the service. The panel names the apps that the downloads were for, for example “For Music”.
4. Without the filter, macOS shows only the service. Then Kilobat cannot say which app a download was for.
5. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
6. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth fileproviderd day
   ```
7. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `fileproviderd`.
8. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Which apps use fileproviderd?**

Apps built on Apple's File Provider framework. iCloud Drive uses it too. Apple does not publish a list.

### Sources

- fileproviderd(8), man page installed with macOS 27.2
- [Apple Developer: File Provider](https://developer.apple.com/documentation/fileprovider)
- [Apple Support: View network activity in Activity Monitor on Mac](https://support.apple.com/guide/activity-monitor/view-network-activity-actmntr1006/mac)
- nettop(1), man page installed with macOS 27.2
- [Kilobat docs: System downloads](https://kilobat.app/docs.html#system-downloads)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is bird on Mac?](https://kilobat.app/guides/what-is-bird.html): bird is one of the macOS daemons behind iCloud Drive.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.
- [See which app uses data on a hotspot](https://kilobat.app/guides/recipes/hotspot-data-by-app.html): Kilobat shows the upload and download of each app on your Mac.

---

Source: https://kilobat.app/guides/what-is-findmydeviced.html

macOS processes

## What are findmydeviced and searchpartyd on Mac?

`findmydeviced` is the Find My Mac daemon. `searchpartyd` is another Find My daemon that Apple does not describe.

Process: `findmydeviced` · Process: `searchpartyd` · Applies to: macOS 15 Sequoia and later for the Saved to iCloud path. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `findmydeviced` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `findmydeviced` can connect.
- `searchpartyd` shows small traffic too.

### What it is

The man page says: “findmydeviced is the daemon for Find My Mac.” It has no options.

The searchpartyd man page says only that it is a daemon. Apple documents nothing more.

### Why it uses the network

- **Find My Mac.** To show the Mac in Find My, the daemon reports to Apple.
- **searchpartyd.** Apple does not document its network use. Measure it with the steps below.

### Is it normal?

Yes, if Find My Mac is on. The traffic is small.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `findmydeviced` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p findmydeviced -P
   ```
4. Do the same for `searchpartyd`.

### Reduce or pause it safely

1. Keep Find My Mac on. It helps you find a lost or stolen Mac.
2. To turn it off, choose Apple menu > System Settings. Click your name, then iCloud.
3. Click See All, click Find My Mac, then click Turn Off. Apple says that this also removes Activation Lock.
4. Do not quit `findmydeviced` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `findmydeviced`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth findmydeviced day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `findmydeviced`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Does Find My need Location Services?**

Yes. Apple's guide says that Find My Mac needs Location Services.

### Sources

- findmydeviced(8) and searchpartyd(8), man page installed with macOS 27.2
- [Apple Support: Turn off Find My on your devices and items](https://support.apple.com/guide/icloud/remove-devices-and-items-from-find-my-mmdc23b125f6/icloud)
- [Apple Support: Control access to the location of your Mac](https://support.apple.com/guide/mac-help/allow-apps-to-see-the-location-of-your-mac-mh35873/mac)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is locationd on Mac?](https://kilobat.app/guides/what-is-locationd.html): locationd runs Location Services.
- [What is apsd on Mac?](https://kilobat.app/guides/what-is-apsd.html): apsd keeps one connection open to the Apple Push Notification service.

---

Source: https://kilobat.app/guides/what-is-googleupdater.html

macOS processes

## What is GoogleUpdater on Mac?

`GoogleUpdater` updates Chrome and other Google apps in the background. Older installs use the Keystone agent, `GoogleSoftwareUpdateAgent`.

Process: `GoogleUpdater` · Process: `GoogleSoftwareUpdateAgent` · Applies to: Google Chrome and other Google apps on all current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `GoogleUpdater` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `GoogleUpdater` can connect.
- Files named `com.google.GoogleUpdater` or `com.google.keystone` are in `/Library/LaunchAgents` or `/Library/LaunchDaemons`.

### What it is

Google's help says that Chrome installs updates in the background. The Chromium updater manual describes the updater app and its install folders.

A per-user install is in `~/Library/Application Support/Google/GoogleUpdater`. A system install is in `/Library/Application Support/Google/GoogleUpdater`.

### Why it uses the network

- **Update checks.** It asks Google's servers for new versions of the apps that it manages.
- **Update downloads.** It downloads new versions of Chrome and other Google apps.

### Is it normal?

Yes, if you have Google apps. Chrome updates are large downloads.

The Chromium manual says that the updater removes itself when no app needs it any more.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `GoogleUpdater` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p GoogleUpdater -P
   ```
4. Do the same for `GoogleSoftwareUpdateAgent`. In `nettop`, its name is cut to 15 characters.

### Reduce or pause it safely

1. Keep Chrome up to date. Updates fix security problems.
2. To update now, on your usual network, open Chrome. Choose Chrome > About Google Chrome, then click Relaunch.
3. If you remove all Google apps, the updater removes itself after some hours. The Chromium manual describes this.

### With Kilobat

1. Open the Kilobat app list and search for `GoogleUpdater`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth GoogleUpdater day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `GoogleUpdater`.
5. With Pro and the network filter, Kilobat pauses this updater on metered networks. The app keeps working. See [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html).

   ```
   kilobat updaters
   ```
6. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Can I stop GoogleUpdater on a hotspot only?**

macOS has no setting for this. Kilobat Pro with the network filter pauses it on metered networks. Chrome keeps working.

### Sources

- [Google Chrome Help: Update Google Chrome](https://support.google.com/chrome/answer/95414)
- [Chromium Docs: Chromium Updater user manual](https://chromium.googlesource.com/chromium/src/+/main/docs/updater/user_manual.md)
- nettop(1), man page installed with macOS 27.2
- [Kilobat docs: Pausing updaters on metered networks](https://kilobat.app/docs.html#updaters)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html): On a metered network, Kilobat can pause the helpers that download updates.
- [What is Microsoft AutoUpdate on Mac?](https://kilobat.app/guides/what-is-microsoft-autoupdate.html): Microsoft AutoUpdate (MAU) keeps Office, Teams and other Microsoft apps up to date.
- [What is Autoupdate (Sparkle) on Mac?](https://kilobat.app/guides/what-is-sparkle-autoupdate.html): Autoupdate is part of Sparkle, an open source update framework that many Mac apps use.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.

---

Source: https://kilobat.app/guides/what-is-identityservicesd.html

macOS processes

## What is identityservicesd on Mac?

`identityservicesd` is part of the Apple Identity Service. iMessage and FaceTime use this service to find the keys and devices of the people you contact.

Process: `identityservicesd` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `identityservicesd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `identityservicesd` can connect.
- `nettop` and Kilobat show it as `identityservice`, cut to 15 characters.

### What it is

Apple publishes no man page for identityservicesd. The program is in the IDS framework of macOS: `IDS.framework/identityservicesd.app`.

Apple Platform Security describes the Apple Identity Service (IDS). It is a directory of public keys and device addresses for iMessage.

### Why it uses the network

- **Messages and calls.** Apple says that a device asks IDS for the keys and push addresses of each device of the person that you message.
- **Your own devices.** Each device registers its public keys with IDS.
- **Local links.** On this Mac, `lsof` also showed a connection to another Apple device on the local network.

### Is it normal?

Yes, when you use Messages or FaceTime. The lookups are small. The messages and calls themselves can show under other processes.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `identityservicesd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p identityservice -P
   ```
4. `nettop` shows only the first 15 characters of a name. So use `identityservice`, as above.

### Reduce or pause it safely

1. If you do not use iMessage on this Mac, open Messages. Choose Messages > Settings > iMessage and sign out.
2. If you do not use FaceTime on this Mac, open FaceTime. Choose FaceTime > Settings and sign out.
3. Do not quit `identityservicesd` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `identityservicesd`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth identityservice day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `identityservice`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Why does nettop show identityservice?**

`nettop` shows at most 15 characters of a process name. Kilobat uses the same names.

### Sources

- [Apple Platform Security: How iMessage sends and receives messages securely](https://support.apple.com/guide/security/how-imessage-sends-and-receives-messages-sec70e68c949/web)
- lsof(8), man page installed with macOS 27.2
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is apsd on Mac?](https://kilobat.app/guides/what-is-apsd.html): apsd keeps one connection open to the Apple Push Notification service.
- [What is rapportd on Mac?](https://kilobat.app/guides/what-is-rapportd.html): rapportd lets your Mac talk to your other Apple devices.
- [Video calls stutter or freeze on a Mac](https://kilobat.app/guides/video-call-stutter-mac.html): Calls need steady latency and steady upload more than high speed.

---

Source: https://kilobat.app/guides/what-is-locationd.html

macOS processes

## What is locationd on Mac?

`locationd` runs Location Services. It finds where the Mac is for apps that you allowed.

Process: `locationd` · Applies to: macOS 13 Ventura and later for the System Settings path. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `locationd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `locationd` can connect.
- Traffic appears when an app such as Maps or Weather asks for your location.

### What it is

The man page says that locationd “obtains geographic location and manages the authorization” for apps, daemons and widgets.

Apple's guide says that turning off Location Services stops apps and websites from using your location through it.

### Why it uses the network

- **Location requests.** A Mac has no GPS. Apple does not document how locationd finds the location, so this page does not describe it.

### Is it normal?

Yes, when apps with permission ask for your location. The amount is small.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `locationd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p locationd -P
   ```

### Reduce or pause it safely

1. Choose Apple menu > System Settings > Privacy & Security > Location Services.
2. Turn off the apps that do not need your location. Or turn Location Services off.
3. Find My Mac needs Location Services. Keep it on if you use Find My.
4. Do not quit `locationd` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `locationd`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth locationd day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `locationd`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Does Apple get my location?**

Apple's guide says that the Mac does not send its precise location to Apple when Location Services is off.

### Sources

- locationd(8), man page installed with macOS 27.2
- [Apple Support: Control access to the location of your Mac](https://support.apple.com/guide/mac-help/allow-apps-to-see-the-location-of-your-mac-mh35873/mac)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What are findmydeviced and searchpartyd on Mac?](https://kilobat.app/guides/what-is-findmydeviced.html): findmydeviced is the Find My Mac daemon.
- [What is parsecd on Mac?](https://kilobat.app/guides/what-is-parsecd.html): parsecd supports search suggestions in Spotlight, Safari, Siri and Look Up.
- [An app cannot find devices on the local network](https://kilobat.app/guides/local-network-permission.html): macOS 15 Sequoia and later ask before an app connects to devices on your local network.

---

Source: https://kilobat.app/guides/what-is-mdnsresponder.html

macOS processes

## What is mDNSResponder on Mac?

`mDNSResponder` answers DNS lookups for every app on the Mac, and it runs Bonjour on the local network. Its traffic is the lookups of other apps.

Process: `mDNSResponder` · Process: `mDNSResponderHelper` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `mDNSResponder` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `mDNSResponder` can connect.
- Its packet counts are high, but its bytes are low.

### What it is

The man page calls it the “Multicast and Unicast DNS daemon”. It implements Multicast DNS and DNS Service Discovery, which Apple calls Bonjour.

Since Mac OS X 10.6, it is also the system-wide DNS resolver. It sends DNS queries for other processes and keeps a cache of the answers.

The program is `/usr/sbin/mDNSResponder`. `mDNSResponderHelper` is a helper with its own man page.

### Why it uses the network

- **DNS lookups for apps.** Each time an app connects to a name, mDNSResponder can send a DNS query for it. Many apps make many lookups.
- **Bonjour on the local network.** It listens on UDP port 5353 for Multicast DNS. It finds printers, speakers and other Macs.
- **Encrypted DNS.** With an encrypted DNS profile, lookups go to that DNS server over HTTPS or TLS. See [Use encrypted DNS on a Mac](https://kilobat.app/guides/encrypted-dns-mac.html).

### Is it normal?

Yes. DNS answers are small, so mDNSResponder usually moves less data than the apps that it works for.

Look closer if its traffic is high for a long time. A program that makes very many lookups, or a busy local network, can cause this.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `mDNSResponder` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p mDNSResponder -P
   ```
4. To see the DNS servers that it uses, show the resolver configuration.

   ```
   scutil --dns
   ```

### Reduce or pause it safely

1. Find the app that makes the lookups. Its own traffic often rises at the same time in Activity Monitor.
2. Quit or pause that app. The lookups stop with it.
3. If lookups fail and repeat, fix DNS first. See [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html).
4. If old answers cause errors, flush the DNS cache. See [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html).
5. Do not quit `mDNSResponder` in Activity Monitor. It is part of macOS, and other features depend on it. Without it, no app on the Mac can look up names.

### With Kilobat

1. Open the Kilobat app list and search for `mDNSResponder`. Its row shows the live rate and the bytes it moved.
2. Compare the speed of DNS servers from this Mac.

   ```
   kilobat dns-benchmark
   ```
3. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
4. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth mDNSResponder day
   ```
5. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `mDNSResponder`.
6. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Is mDNSResponder spyware?**

No. It is Apple's DNS and Bonjour daemon in `/usr/sbin`, with a man page. The man page says that users should not run it manually.

**Why does a firewall ask about mDNSResponder?**

All DNS lookups on the Mac go through it. A firewall that watches DNS sees mDNSResponder, not the app that asked.

### Sources

- mDNSResponder(8) and mDNSResponderHelper(8), man page installed with macOS 27.2
- [Apple Support: Change DNS settings on Mac](https://support.apple.com/guide/mac-help/change-dns-settings-on-mac-mh14127/mac)
- [Apple Support: View network activity in Activity Monitor on Mac](https://support.apple.com/guide/activity-monitor/view-network-activity-actmntr1006/mac)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [Flush the DNS cache on a Mac](https://kilobat.app/guides/flush-dns-cache-mac.html): macOS keeps DNS answers for some time.
- [Slow DNS on a Mac](https://kilobat.app/guides/slow-dns-mac.html): Every new site needs a DNS lookup before it can load.
- [Find the devices on your local network from a Mac](https://kilobat.app/guides/find-devices-on-network.html): macOS has two built-in ways to see other devices: the ARP table and Bonjour.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.

---

Source: https://kilobat.app/guides/what-is-microsoft-autoupdate.html

macOS processes

## What is Microsoft AutoUpdate on Mac?

Microsoft AutoUpdate (MAU) keeps Office, Teams and other Microsoft apps up to date. Its own window has the settings.

Process: `Microsoft AutoUpdate` · Process: `Microsoft Update Assistant` · Process: `msupdate` · Applies to: Microsoft apps installed from Microsoft, not from the Mac App Store, on all current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `Microsoft AutoUpdate` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `Microsoft AutoUpdate` can connect.
- `Microsoft Update Assistant` downloads while Office apps are closed.

### What it is

Microsoft's documentation says that MAU is responsible for keeping Microsoft 365 apps up to date. Its preference domain is `com.microsoft.autoupdate2`.

Apps from the Mac App Store update through the App Store instead. Microsoft says so in its update article.

### Why it uses the network

- **Update checks.** Microsoft documents a default check interval of 780 minutes, which is 13 hours.
- **Update downloads.** In the default AutomaticDownload mode, MAU downloads and installs updates automatically.

### Is it normal?

Yes, if you use Microsoft apps. Office updates can be large.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `Microsoft AutoUpdate` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p "Microsoft AutoU" -P
   ```
4. `nettop` shows only the first 15 characters of a name. So use `Microsoft AutoU`, as above.
5. Do the same for `Microsoft Update Assistant`.

### Reduce or pause it safely

1. Open a Microsoft app, such as Word. Choose Help > Check for Updates. The MAU window opens.
2. Clear “Automatically keep Microsoft apps up to date” to install updates when you choose.
3. Microsoft warns that apps then do not get updates on their own. Check for updates on your usual network.

### With Kilobat

1. Open the Kilobat app list and search for `Microsoft AutoUpdate`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth "Microsoft AutoU" day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `Microsoft AutoU`.
5. With Pro and the network filter, Kilobat pauses this updater on metered networks. The app keeps working. See [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html).

   ```
   kilobat updaters
   ```
6. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Can my company control MAU?**

Yes. Microsoft documents managed preferences for MAU, such as the check interval and the update channel.

### Sources

- [Microsoft Support: Update Office for Mac automatically](https://support.microsoft.com/en-us/office/update-office-for-mac-automatically-bfd1e497-c24d-4754-92ab-910a4074d7c1)
- [Microsoft Learn: Configuring preferences for Microsoft AutoUpdate (MAU)](https://learn.microsoft.com/en-us/microsoft-365-apps/mac/mau-preferences)
- nettop(1), man page installed with macOS 27.2
- [Kilobat docs: Pausing updaters on metered networks](https://kilobat.app/docs.html#updaters)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html): On a metered network, Kilobat can pause the helpers that download updates.
- [What is GoogleUpdater on Mac?](https://kilobat.app/guides/what-is-googleupdater.html): GoogleUpdater updates Chrome and other Google apps in the background.
- [What is Autoupdate (Sparkle) on Mac?](https://kilobat.app/guides/what-is-sparkle-autoupdate.html): Autoupdate is part of Sparkle, an open source update framework that many Mac apps use.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.

---

Source: https://kilobat.app/guides/what-is-mobileassetd.html

macOS processes

## What is mobileassetd on Mac?

`mobileassetd` downloads system assets for macOS. Apple does not document it. Kilobat sees it download models, voices, fonts and dictionaries.

Process: `mobileassetd` · Process: `com.apple.MobileAsset.DownloadService.Builtin` · Applies to: All current macOS versions. Apple Intelligence downloads need macOS 15.1 or later on a supported Mac. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `mobileassetd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `mobileassetd` can connect.
- A large download starts after a macOS update, with no app open.

### What it is

Apple publishes no man page or documentation for mobileassetd. The program is `/usr/libexec/mobileassetd`, signed by Apple.

A helper named `com.apple.MobileAsset.DownloadService.Builtin` does downloads for it. In `nettop`, its name is cut to 15 characters.

Kilobat's list of system downloads says that it gets Apple Intelligence and Siri models, voices, fonts and dictionaries. This is what Kilobat observes, not what Apple documents.

### Why it uses the network

- **Apple Intelligence models.** Apple says that on-device models download after a software update, and that the download time varies.
- **Voices, fonts and dictionaries.** Kilobat's list of system downloads names these assets too. Apple does not document when they download.
- **New models after an update.** Apple says that Apple Intelligence storage can grow for a time after a software update, while new models download.

### Is it normal?

Yes. Downloads after a macOS update or after you turn on a feature are usual. Apple Intelligence models can be several gigabytes.

Apple recommends Wi-Fi and power for the Apple Intelligence download.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `mobileassetd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p mobileassetd -P
   ```
4. Also look for the helper. In `nettop`, use its short name.

   ```
   nettop -p com.apple.Mobil -P
   ```

### Reduce or pause it safely

1. Do macOS updates on your usual network. The asset downloads follow them.
2. If you do not use Apple Intelligence, turn it off in System Settings > Apple Intelligence & Siri. Apple says that the on-device models are then removed.
3. Add voices and languages only when you are on your usual network.
4. Do not quit `mobileassetd` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `mobileassetd`. Its row shows the live rate and the bytes it moved.
2. Kilobat puts this service in the System downloads group, with one line about what it does. Expand the group to see each service.
3. With the network filter on, click the service. The panel names the apps that the downloads were for, for example “For Music”.
4. Without the filter, macOS shows only the service. Then Kilobat cannot say which app a download was for.
5. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
6. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth mobileassetd day
   ```
7. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `mobileassetd`.
8. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Why does Apple not document mobileassetd?**

Apple publishes man pages for some daemons only. This page describes what Kilobat and the macOS tools show.

**Can I stop Apple Intelligence downloads?**

Turn Apple Intelligence off. Apple says that the on-device models are then removed from the Mac.

### Sources

- [Apple Support: Get started with the next generation of Apple Intelligence](https://support.apple.com/en-us/121115)
- [Apple Support: Apple Intelligence and privacy on Mac](https://support.apple.com/guide/mac-help/apple-intelligence-and-privacy-mchlfc0d4779/mac)
- [Apple Support: View network activity in Activity Monitor on Mac](https://support.apple.com/guide/activity-monitor/view-network-activity-actmntr1006/mac)
- nettop(1), man page installed with macOS 27.2
- [Kilobat docs: System downloads](https://kilobat.app/docs.html#system-downloads)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is nsurlsessiond on Mac?](https://kilobat.app/guides/what-is-nsurlsessiond.html): nsurlsessiond is part of macOS.
- [What is softwareupdated on Mac?](https://kilobat.app/guides/what-is-softwareupdated.html): softwareupdated is the macOS Software Update daemon.
- [What is privatecloudcomputed on Mac?](https://kilobat.app/guides/what-is-privatecloudcomputed.html): privatecloudcomputed encrypts and sends some Apple Intelligence requests to Apple's Private Cloud Compute servers.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.

---

Source: https://kilobat.app/guides/what-is-netbiosd.html

macOS processes

## What is netbiosd on Mac?

`netbiosd` handles NetBIOS names for Windows-style networks. Its traffic stays on the local network.

Process: `netbiosd` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `netbiosd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `netbiosd` can connect.
- Small, regular traffic on the local network.

### What it is

The man page says that netbiosd registers and defends NetBIOS names. It also browses names on the network and gives them to the system through mDNSResponder.

Its configuration comes from the SMB file sharing settings of the Mac.

### Why it uses the network

- **Name registration.** It registers the Mac's NetBIOS name on the local network.
- **Browsing.** It looks for other computers and workgroups on the network.

### Is it normal?

Yes. Small local traffic is usual. It does not use your internet connection.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `netbiosd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p netbiosd -P
   ```

### Reduce or pause it safely

1. If you do not share files with Windows computers, check File Sharing. Choose Apple menu > System Settings > General > Sharing.
2. Turn off File Sharing if you do not use it. The netbiosd man page says that its configuration comes from the SMB settings.
3. Do not quit `netbiosd` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `netbiosd`. Its row shows the live rate and the bytes it moved.
2. Kilobat shows local network traffic apart and does not count it as Internet data.
3. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
4. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth netbiosd day
   ```
5. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `netbiosd`.
6. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Does netbiosd send data to the internet?**

The man page describes only NetBIOS on the local network.

### Sources

- netbiosd(8) and mDNSResponder(8), man page installed with macOS 27.2
- [RFC 1001: NetBIOS service on TCP/UDP, concepts and methods](https://www.rfc-editor.org/rfc/rfc1001)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is mDNSResponder on Mac?](https://kilobat.app/guides/what-is-mdnsresponder.html): mDNSResponder answers DNS lookups for every app on the Mac, and it runs Bonjour on the local network.
- [Find the devices on your local network from a Mac](https://kilobat.app/guides/find-devices-on-network.html): macOS has two built-in ways to see other devices: the ARP table and Bonjour.
- [The macOS firewall blocks incoming connections](https://kilobat.app/guides/macos-firewall-incoming.html): The macOS firewall controls connections that other computers start to your Mac.

---

Source: https://kilobat.app/guides/what-is-nsurlsessiond.html

macOS processes

## What is nsurlsessiond on Mac?

`nsurlsessiond` is part of macOS. It does background downloads and uploads for apps. Its traffic belongs to the app that asked for the transfer.

Process: `nsurlsessiond` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `nsurlsessiond` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `nsurlsessiond` can connect.
- A hotspot or data plan runs out, and `nsurlsessiond` has the most bytes.

### What it is

The nsurlsessiond man page calls it “the background NSURLSession daemon”. It is a per-user daemon. It does the tasks of apps that use background URL sessions.

Apps use background sessions for long transfers. Apple's documentation says that these tasks continue when the app is suspended. Because macOS does the transfer, Activity Monitor shows the traffic under `nsurlsessiond`, not under the app.

The program is `/usr/libexec/nsurlsessiond`, signed by Apple. The man page says that it has no options and that users should not run it manually.

### Why it uses the network

- **Downloads for apps.** Any app can give a download to it. Kilobat's documentation names Music and Podcasts as common examples.
- **Uploads for apps.** Apple's documentation says that background sessions can do HTTP and HTTPS uploads too.
- **Transfers that waited for a better time.** Apple says that the system can delay a large discretionary transfer, for example until the Mac has power and Wi-Fi.

### Is it normal?

Yes. `nsurlsessiond` traffic is a usual part of macOS. The amount depends on what the apps asked for.

Look closer when it moves gigabytes on a hotspot, or when it never stops. Then find the app that asked for the transfer.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `nsurlsessiond` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p nsurlsessiond -P
   ```
4. Activity Monitor and `nettop` do not show which app asked for the transfer. Think about what you started just before, for example a podcast download.

### Reduce or pause it safely

1. Find the app that asked for the download. Pause or cancel the download in that app.
2. Turn off automatic downloads in the settings of that app.
3. On a hotspot or a capped network, turn on Low Data Mode. Choose Apple menu > System Settings > Wi-Fi. Click Details next to the network, then turn on Low data mode.
4. Apple's documentation lets each app decide whether it uses a Low Data Mode network. Some apps continue. See [Use Low Data Mode on a Mac](https://kilobat.app/guides/low-data-mode-mac.html).
5. Do not quit `nsurlsessiond` in Activity Monitor. It is part of macOS, and other features depend on it. It works for many apps at the same time.

### With Kilobat

1. Open the Kilobat app list and search for `nsurlsessiond`. Its row shows the live rate and the bytes it moved.
2. Kilobat puts this service in the System downloads group, with one line about what it does. Expand the group to see each service.
3. With the network filter on, click the service. The panel names the apps that the downloads were for, for example “For Music”.
4. Without the filter, macOS shows only the service. Then Kilobat cannot say which app a download was for.
5. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
6. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth nsurlsessiond day
   ```
7. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `nsurlsessiond`.
8. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Is nsurlsessiond a virus?**

No. It is part of macOS, in `/usr/libexec`, and it has a man page. Open it with `man nsurlsessiond`.

**Why does nsurlsessiond use data when no app is open?**

Background transfers continue when the app is suspended. Apple designed them for this. The app does not have to stay open.

**How do I find which app nsurlsessiond downloads for?**

macOS tools show only the service. Kilobat with its network filter on names the app, for example “For Music”.

### Sources

- nsurlsessiond(8), man page installed with macOS 27.2
- [Apple Developer: Downloading files in the background](https://developer.apple.com/documentation/foundation/downloading-files-in-the-background)
- [Apple Developer: URLSessionConfiguration background(withIdentifier:)](https://developer.apple.com/documentation/foundation/urlsessionconfiguration/background(withidentifier:))
- [Apple Developer: URLSessionConfiguration isDiscretionary](https://developer.apple.com/documentation/foundation/urlsessionconfiguration/isdiscretionary)
- [Apple Developer: URLSessionConfiguration allowsConstrainedNetworkAccess](https://developer.apple.com/documentation/foundation/urlsessionconfiguration/allowsconstrainednetworkaccess)
- [Apple Support: View network activity in Activity Monitor on Mac](https://support.apple.com/guide/activity-monitor/view-network-activity-actmntr1006/mac)
- nettop(1), man page installed with macOS 27.2
- [Kilobat docs: System downloads](https://kilobat.app/docs.html#system-downloads)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.
- [Use Low Data Mode on a Mac](https://kilobat.app/guides/low-data-mode-mac.html): Low Data Mode tells macOS and apps to use less data on one Wi-Fi network.
- [See which app uses data on a hotspot](https://kilobat.app/guides/recipes/hotspot-data-by-app.html): Kilobat shows the upload and download of each app on your Mac.
- [What is mobileassetd on Mac?](https://kilobat.app/guides/what-is-mobileassetd.html): mobileassetd downloads system assets for macOS.

---

Source: https://kilobat.app/guides/what-is-parsecd.html

macOS processes

## What is parsecd on Mac?

`parsecd` supports search suggestions in Spotlight, Safari, Siri and Look Up. It connects when you type in those places.

Process: `parsecd` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `parsecd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `parsecd` can connect.
- Traffic appears when you type in Spotlight or in the Safari address field.

### What it is

The man page says that parsecd “manages access and data for Siri Suggestions, Spotlight Suggestions, Safari Suggestions, Lookup, #images, and Apple News article search”.

### Why it uses the network

- **Suggestions while you type.** Suggestions from the web need a request to a server.
- **Look Up and images.** Look Up and #images get their content from the internet.

### Is it normal?

Yes. Small requests while you search are usual.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `parsecd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p parsecd -P
   ```

### Reduce or pause it safely

1. Choose Apple menu > System Settings > Spotlight. Turn off the search results and suggestions that you do not use.
2. In the same place, turn off Help Apple Improve Search if you do not want to share search queries.
3. In Safari, choose Safari > Settings > Search. Turn off the suggestions that you do not use.
4. Do not quit `parsecd` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `parsecd`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth parsecd day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `parsecd`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Does Spotlight send my local files to Apple?**

The parsecd man page covers suggestions and search. The Spotlight settings list what Help Apple Improve Search stores.

### Sources

- parsecd(8), man page installed with macOS 27.2
- [Apple Support: Spotlight settings on Mac](https://support.apple.com/guide/mac-help/spotlight-settings-on-mac-mchl54d95e8a/mac)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is assistantd on Mac?](https://kilobat.app/guides/what-is-assistantd.html): assistantd is the Siri daemon.
- [What is locationd on Mac?](https://kilobat.app/guides/what-is-locationd.html): locationd runs Location Services.
- [iCloud Private Relay breaks some websites](https://kilobat.app/guides/icloud-private-relay-sites.html): iCloud Private Relay sends Safari traffic through two relays.

---

Source: https://kilobat.app/guides/what-is-privatecloudcomputed.html

macOS processes

## What is privatecloudcomputed on Mac?

`privatecloudcomputed` encrypts and sends some Apple Intelligence requests to Apple's Private Cloud Compute servers.

Process: `privatecloudcomputed` · Applies to: macOS 15 and later, on Macs that support Apple Intelligence. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `privatecloudcomputed` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `privatecloudcomputed` can connect.
- Traffic appears after you use Apple Intelligence features.

### What it is

The man page says that it “handles encrypting and sending requests to validated cloud compute nodes”. It first appeared in macOS 15.

Apple says that Private Cloud Compute uses only the data needed for a request, and that Apple cannot access it.

### Why it uses the network

- **Larger Apple Intelligence requests.** Some requests need a larger model than the one on the Mac. These go to Private Cloud Compute.

### Is it normal?

Yes, when you use Apple Intelligence. macOS can list each request that it sent.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `privatecloudcomputed` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p privatecloudcom -P
   ```
4. `nettop` shows only the first 15 characters of a name. So use `privatecloudcom`, as above.
5. Choose Apple menu > System Settings > Privacy & Security. Click Apple Intelligence Report.
6. Choose 15 minutes or 7 days. Click Export Activity to save the report as a JSON file.

### Reduce or pause it safely

1. Use fewer Apple Intelligence features, or turn Apple Intelligence off in System Settings > Apple Intelligence & Siri.
2. Do not quit `privatecloudcomputed` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `privatecloudcomputed`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth privatecloudcom day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `privatecloudcom`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Can I see what was sent?**

Yes. The Apple Intelligence Report in Privacy & Security lists the requests that the Mac sent to Private Cloud Compute.

### Sources

- privatecloudcomputed(8), man page installed with macOS 27.2
- [Apple Support: Apple Intelligence and privacy on Mac](https://support.apple.com/guide/mac-help/apple-intelligence-and-privacy-mchlfc0d4779/mac)
- [Apple Security Research: Private Cloud Compute](https://security.apple.com/blog/private-cloud-compute/)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is mobileassetd on Mac?](https://kilobat.app/guides/what-is-mobileassetd.html): mobileassetd downloads system assets for macOS.
- [What is assistantd on Mac?](https://kilobat.app/guides/what-is-assistantd.html): assistantd is the Siri daemon.

---

Source: https://kilobat.app/guides/what-is-rapportd.html

macOS processes

## What is rapportd on Mac?

`rapportd` lets your Mac talk to your other Apple devices. Its traffic is mostly on the local network, to your iPhone, iPad or other Macs.

Process: `rapportd` · Applies to: macOS 13 Ventura and later for the System Settings path. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `rapportd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `rapportd` can connect.
- `rapportd` listens on a TCP port, and a firewall asks about incoming connections.

### What it is

The man page says that rapportd enables “Phone Call Handoff and other communication features between Apple devices”. The program is `/usr/libexec/rapportd`.

On this Mac, `lsof` showed that rapportd listens on a TCP port and connects to another Apple device on the same network.

### Why it uses the network

- **Your other Apple devices.** It connects to devices that use the same Apple Account, on the local network.
- **Continuity features.** Handoff, phone calls and other features between devices use it.

### Is it normal?

Yes. Small amounts of local traffic are usual when you have other Apple devices nearby.

Apple does not document how much data each feature uses.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `rapportd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p rapportd -P
   ```
4. Show its open connections. Local addresses are your devices.

   ```
   lsof -nP -i -a -c rapportd
   ```

### Reduce or pause it safely

1. Choose Apple menu > System Settings > General > AirDrop & Continuity. In older versions, the name is AirDrop & Handoff.
2. Turn off Allow Handoff if you do not use it.
3. Other Continuity features have their own settings. Turn off only the ones that you do not use.
4. Do not quit `rapportd` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `rapportd`. Its row shows the live rate and the bytes it moved.
2. See its connections and their addresses. Use the PID from Activity Monitor.

   ```
   kilobat destinations --pid 12345
   ```
3. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
4. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth rapportd day
   ```
5. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `rapportd`.
6. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Should I allow rapportd in my firewall?**

If you use Handoff or calls on the Mac, allow it. It is part of macOS.

**Does rapportd use internet data?**

On this Mac, its connections went to devices on the local network. Apple does not document all its connections.

### Sources

- rapportd(8), man page installed with macOS 27.2
- [Apple Support: Hand off tasks between Apple devices](https://support.apple.com/guide/mac-help/hand-off-tasks-between-devices-mchl732d3c0a/mac)
- lsof(8), man page installed with macOS 27.2
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is sharingd on Mac?](https://kilobat.app/guides/what-is-sharingd.html): sharingd runs AirDrop, Handoff, Instant Hotspot and the shared computers in the Finder.
- [AirDrop, AWDL and latency spikes in games and calls](https://kilobat.app/guides/awdl-airdrop-latency-spikes.html): AWDL is the Apple Wireless Direct Link.
- [The macOS firewall blocks incoming connections](https://kilobat.app/guides/macos-firewall-incoming.html): The macOS firewall controls connections that other computers start to your Mac.
- [An app cannot find devices on the local network](https://kilobat.app/guides/local-network-permission.html): macOS 15 Sequoia and later ask before an app connects to devices on your local network.

---

Source: https://kilobat.app/guides/what-is-remotepairingd.html

macOS processes

## What is remotepairingd on Mac?

`remotepairingd` connects the Mac to paired Apple devices. Apple does not document it. `CoreDeviceService` belongs to Xcode's device support.

Process: `remotepairingd` · Process: `CoreDeviceService` · Process: `usbmuxd` · Applies to: macOS with Xcode or its device support installed. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `remotepairingd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `remotepairingd` can connect.
- `CoreDeviceServi` appears in `nettop` or Kilobat with a lot of traffic.
- The traffic goes to an address on your local network.

### What it is

Apple publishes no man page for remotepairingd. Its path shows that it is part of the RemotePairing framework.

`CoreDeviceService` is in `/Library/Developer/PrivateFrameworks/CoreDevice.framework`. This folder holds the developer device support that Xcode uses.

Apple's Xcode documentation says that Xcode can pair an iPhone or iPad wirelessly when it is on the same Wi-Fi network as the Mac.

The `usbmuxd` man page says that it manages communication with iOS devices over USB and Wi-Fi.

### Why it uses the network

- **A paired device on the network.** On this Mac, `lsof` showed remotepairingd connected to an iPhone on the local network.
- **Xcode work with devices.** Installing and debugging apps on a paired device moves data to it.
- **What was observed.** On a developer's Mac with a paired iPhone, Kilobat recorded several gigabytes for each process in one week.

### Is it normal?

Yes, if you use Xcode with a device, or another feature that pairs devices. The traffic goes to the device on the local network.

Apple does not document what else uses remotepairingd. Treat larger traffic as the work of the device that you paired.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `remotepairingd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p remotepairingd -P
   ```
4. Show its connections. A local address is the paired device.

   ```
   lsof -nP -i -a -c remotepair
   ```
5. Do the same for CoreDeviceService. In `nettop`, use its short name.

   ```
   nettop -p CoreDeviceServi -P
   ```

### Reduce or pause it safely

1. Connect the device with a cable when you install or debug apps.
2. In Xcode, open Device Hub. Remove devices that you do not use any more.
3. Do not quit `remotepairingd` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `remotepairingd`. Its row shows the live rate and the bytes it moved.
2. Kilobat shows local network traffic apart. Traffic to a device on your network does not count as Internet data.
3. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
4. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth remotepairingd day
   ```
5. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `remotepairingd`.
6. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Does remotepairingd use my internet data?**

On this Mac, its connections went to a device on the local network. Apple does not document all its connections.

**Why is CoreDeviceService shown as CoreDeviceServi?**

`nettop` and Kilobat show at most 15 characters of a process name.

### Sources

- [Apple Developer: Managing your simulated and physical devices in Device Hub](https://developer.apple.com/documentation/xcode/managing-your-simulated-and-physical-devices-in-device-hub)
- usbmuxd(8), man page installed with macOS 27.2
- lsof(8), man page installed with macOS 27.2
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is rapportd on Mac?](https://kilobat.app/guides/what-is-rapportd.html): rapportd lets your Mac talk to your other Apple devices.
- [An app cannot find devices on the local network](https://kilobat.app/guides/local-network-permission.html): macOS 15 Sequoia and later ask before an app connects to devices on your local network.
- [Find the devices on your local network from a Mac](https://kilobat.app/guides/find-devices-on-network.html): macOS has two built-in ways to see other devices: the ARP table and Bonjour.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.

---

Source: https://kilobat.app/guides/what-is-reportcrash.html

macOS processes

## What are ReportCrash and SubmitDiagInfo on Mac?

`ReportCrash` saves crash reports on the Mac. `SubmitDiagInfo` sends diagnostic information to Apple, but only if you opted in.

Process: `SubmitDiagInfo` · Process: `ReportCrash` · Applies to: macOS 13 Ventura and later for the System Settings path. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `SubmitDiagInfo` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `SubmitDiagInfo` can connect.
- A short upload appears with no app open.

### What it is

The ReportCrash man page says that it analyzes crashing processes and saves a crash report to disk. launchd starts it when a crash occurs.

The SubmitDiagInfo man page says that it runs periodically. If you opted in, it sends recent diagnostic information to Apple.

### Why it uses the network

- **Diagnostic uploads.** With Share Mac Analytics on, SubmitDiagInfo sends crash, hang and usage information to Apple.
- **Reports that you send.** When you click Report after a crash, the report goes to Apple.

### Is it normal?

Yes, if you share analytics. The uploads are small and periodic.

ReportCrash itself writes to disk. Its man page does not describe network use.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `SubmitDiagInfo` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p SubmitDiagInfo -P
   ```

### Reduce or pause it safely

1. Choose Apple menu > System Settings > Privacy & Security. Click Analytics & Improvements.
2. Turn off Share Mac Analytics. Turn off Share with app developers too, if you want.
3. Keep crash reporting itself on. Developers use the reports on your Mac to fix problems.

### With Kilobat

1. Open the Kilobat app list and search for `SubmitDiagInfo`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth SubmitDiagInfo day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `SubmitDiagInfo`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Where are crash reports on my Mac?**

The ReportCrash man page says that reports for apps are in `~/Library/Logs/DiagnosticReports`.

**Does SubmitDiagInfo send data if I said no?**

The man page says that it sends nothing unless you opted in.

### Sources

- ReportCrash(8) and SubmitDiagInfo(8), man page installed with macOS 27.2
- [Apple Support: Share analytics information from your Mac with Apple](https://support.apple.com/guide/mac-help/share-analytics-information-mac-mh27990/mac)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is symptomsd on Mac?](https://kilobat.app/guides/what-is-symptomsd.html): symptomsd provides services for Apple's Symptom Framework.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.

---

Source: https://kilobat.app/guides/what-is-sharingd.html

macOS processes

## What is sharingd on Mac?

`sharingd` runs AirDrop, Handoff, Instant Hotspot and the shared computers in the Finder. AirDrop transfers can show under it.

Process: `sharingd` · Applies to: macOS 13 Ventura and later for the System Settings path. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `sharingd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `sharingd` can connect.
- Traffic appears when you use AirDrop.

### What it is

The man page says that the Finder uses sharingd for AirDrop, Handoff, Instant Hotspot discovery, shared computers and Remote Disc.

It first appeared in Mac OS X 10.9. The program is `/usr/libexec/sharingd`.

### Why it uses the network

- **AirDrop.** AirDrop sends files directly between devices, over a peer-to-peer Wi-Fi link.
- **Discovery.** It finds nearby devices for AirDrop, Handoff and Instant Hotspot.
- **Shared computers.** The Finder sidebar lists other computers on the network.

### Is it normal?

Yes. Traffic during an AirDrop transfer is usual. It does not use your internet connection.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `sharingd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p sharingd -P
   ```
4. To see only peer-to-peer Wi-Fi traffic, select the AWDL interface.

   ```
   nettop -t awdl -P
   ```

### Reduce or pause it safely

1. Open Control Center and click AirDrop. Choose Contacts Only, or turn AirDrop off.
2. For the other settings, choose Apple menu > System Settings > General > AirDrop & Continuity.
3. If AirDrop causes latency spikes in calls or games, read [AirDrop, AWDL and latency spikes in games and calls](https://kilobat.app/guides/awdl-airdrop-latency-spikes.html).
4. Do not quit `sharingd` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `sharingd`. Its row shows the live rate and the bytes it moved.
2. Show the AirDrop visibility, the AirDrop link and what uses it.

   ```
   kilobat airdrop
   ```
3. Kilobat shows AirDrop traffic apart and does not count it as Internet data.
4. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
5. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth sharingd day
   ```
6. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `sharingd`.
7. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Does AirDrop use my internet data?**

No. AirDrop sends files directly between the devices. Kilobat shows it apart from Internet traffic.

### Sources

- sharingd(8), man page installed with macOS 27.2
- [Apple Support: Change AirDrop & Continuity settings on Mac](https://support.apple.com/guide/mac-help/mchl6a407f99/mac)
- [Apple Support: Hand off tasks between Apple devices](https://support.apple.com/guide/mac-help/hand-off-tasks-between-devices-mchl732d3c0a/mac)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is rapportd on Mac?](https://kilobat.app/guides/what-is-rapportd.html): rapportd lets your Mac talk to your other Apple devices.
- [AirDrop, AWDL and latency spikes in games and calls](https://kilobat.app/guides/awdl-airdrop-latency-spikes.html): AWDL is the Apple Wireless Direct Link.
- [iPhone hotspot does not show on the Mac](https://kilobat.app/guides/instant-hotspot-not-showing.html): Instant Hotspot lets a Mac join your iPhone or iPad hotspot without a password.
- [The macOS firewall blocks incoming connections](https://kilobat.app/guides/macos-firewall-incoming.html): The macOS firewall controls connections that other computers start to your Mac.

---

Source: https://kilobat.app/guides/what-is-shipit.html

macOS processes

## What is ShipIt on Mac?

`ShipIt` comes from Squirrel.Mac. Electron apps use it to install updates. The app downloads the update first.

Process: `ShipIt` · Applies to: Electron apps that use Squirrel.Mac, on all current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `ShipIt` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `ShipIt` can connect.
- `ShipIt` runs after you quit an app such as a chat or code editor.

### What it is

Electron's documentation says that its macOS updater is built on Squirrel.Mac. ShipIt is the part of Squirrel.Mac that installs the update.

Electron says that a downloaded update is applied when the app starts again.

### Why it uses the network

- **Installation.** ShipIt installs an update that the app already downloaded. The download shows under the app.

### Is it normal?

Yes. ShipIt runs for a short time when an app updates.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `ShipIt` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p ShipIt -P
   ```
4. Look at the app itself in the same list. The update download is there.

### Reduce or pause it safely

1. Open the settings of the app. Turn off automatic updates, if the app has that option.
2. Update the app later, on your usual network.

### With Kilobat

1. Open the Kilobat app list and search for `ShipIt`. Its row shows the live rate and the bytes it moved.
2. `kilobat updaters` lists the apps that update from inside their own process. To stop their downloads, block the app for a while.
3. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
4. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth ShipIt day
   ```
5. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `ShipIt`.
6. With Pro and the network filter, Kilobat pauses this updater on metered networks. The app keeps working. See [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html).

   ```
   kilobat updaters
   ```
7. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Why can Kilobat not pause these updates?**

The app downloads the update inside its own process. Kilobat can only block the whole app.

### Sources

- [Electron documentation: autoUpdater](https://www.electronjs.org/docs/latest/api/auto-updater)
- [Squirrel.Mac on GitHub](https://github.com/Squirrel/Squirrel.Mac)
- nettop(1), man page installed with macOS 27.2
- [Kilobat docs: Pausing updaters on metered networks](https://kilobat.app/docs.html#updaters)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is Autoupdate (Sparkle) on Mac?](https://kilobat.app/guides/what-is-sparkle-autoupdate.html): Autoupdate is part of Sparkle, an open source update framework that many Mac apps use.
- [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html): On a metered network, Kilobat can pause the helpers that download updates.
- [Block an app on metered networks](https://kilobat.app/guides/recipes/block-app-on-metered.html): The Travel profile allows only the apps that you choose.

---

Source: https://kilobat.app/guides/what-is-softwareupdated.html

macOS processes

## What is softwareupdated on Mac?

`softwareupdated` is the macOS Software Update daemon. It checks for and downloads macOS updates. The Software Update settings control what it does.

Process: `softwareupdated` · Applies to: macOS 13 Ventura and later for the System Settings path. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `softwareupdated` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `softwareupdated` can connect.
- Hotspot data goes down fast, and `softwareupdated` has the most bytes.

### What it is

The man page calls it “the main daemon responsible for running software updates”. It is part of macOS, inside the Software Update app in CoreServices.

The `softwareupdate` command and System Settings > General > Software Update both use it.

### Why it uses the network

- **Checks for updates.** macOS checks for new updates in the background.
- **Downloads updates.** With “Download new updates when available” on, it downloads macOS updates without asking.
- **Security responses and system files.** Apple lists “Install Security Responses and system files” as a separate automatic option.

### Is it normal?

Yes. Large downloads after an update comes out are usual. A macOS update can be several gigabytes.

On a hotspot, the downloads can use a large part of a data plan. Then change the settings below.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `softwareupdated` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p softwareupdated -P
   ```
4. See which updates macOS can install. This does not need an administrator password.

   ```
   softwareupdate --list
   ```

### Reduce or pause it safely

1. Choose Apple menu > System Settings > General > Software Update. Click the Info button next to Automatic Updates.
2. Turn off “Download new updates when available”. Click Done.
3. Install the updates later, on your usual network. Software Update still shows them.
4. Keep security updates current. Turn the option on again when you are back on an unmetered network.
5. Do not quit `softwareupdated` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `softwareupdated`. Its row shows the live rate and the bytes it moved.
2. Kilobat puts this service in the System downloads group, with one line about what it does. Expand the group to see each service.
3. With the network filter on, click the service. The panel names the apps that the downloads were for, for example “For Music”.
4. Without the filter, macOS shows only the service. Then Kilobat cannot say which app a download was for.
5. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
6. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth softwareupdated day
   ```
7. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `softwareupdated`.
8. With Pro and the network filter, Kilobat pauses this updater on metered networks. The app keeps working. See [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html).

   ```
   kilobat updaters
   ```
9. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Does Low Data Mode stop Software Update?**

Apple describes Low Data Mode only as a way to reduce data use. To be sure, turn off “Download new updates when available”.

**Is it safe to turn off automatic downloads?**

Yes, for a short time. You lose no updates. Install them when you are back on your usual network.

### Sources

- softwareupdated(8) and softwareupdate(8), man page installed with macOS 27.2
- [Apple Support: Software Update settings on Mac](https://support.apple.com/guide/mac-help/software-update-settings-on-mac-mchla7037245/mac)
- [Apple Support: Keep your Mac up to date](https://support.apple.com/guide/mac-help/keep-your-mac-up-to-date-mchlpx1065/mac)
- [Apple Support: Use Apple products on enterprise networks](https://support.apple.com/en-us/101555)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Stop Software Update downloading on a hotspot](https://kilobat.app/guides/software-update-on-hotspot.html): macOS can download updates on its own.
- [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html): On a metered network, Kilobat can pause the helpers that download updates.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.
- [What are appstoreagent and appstored on Mac?](https://kilobat.app/guides/what-is-appstoreagent.html): appstoreagent and appstored support the App Store.

---

Source: https://kilobat.app/guides/what-is-sparkle-autoupdate.html

macOS processes

## What is Autoupdate (Sparkle) on Mac?

`Autoupdate` is part of Sparkle, an open source update framework that many Mac apps use. In most apps, the app itself downloads the update.

Process: `Autoupdate` · Process: `Updater` · Process: `Downloader` · Applies to: Apps that use Sparkle, on all current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `Autoupdate` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `Autoupdate` can connect.
- Its signing identifier starts with `Autoupdate` or `org.sparkle-project`.

### What it is

Sparkle's documentation says that it checks for updates in the background once every 24 hours by default. The app reads a feed of versions, called an appcast.

Sparkle's installer tools, such as Autoupdate, install the update after the download. Sandboxed apps can use a separate Downloader service.

### Why it uses the network

- **Update checks and downloads.** The app checks its appcast and downloads new versions. This traffic usually shows under the app itself.
- **A Downloader service.** Sparkle says that sandboxed apps without network access use a Downloader XPC service.

### Is it normal?

Yes. Each app that uses Sparkle checks for its own updates.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `Autoupdate` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p Autoupdate -P
   ```
4. Look at the app itself in the same list. Most of the update traffic is there.

### Reduce or pause it safely

1. Open the app's settings. Many apps that use Sparkle have options to check for and download updates automatically.
2. Turn off automatic downloads while you are on a hotspot. Update later on your usual network.

### With Kilobat

1. Open the Kilobat app list and search for `Autoupdate`. Its row shows the live rate and the bytes it moved.
2. `kilobat updaters` lists the apps that update from inside their own process. Kilobat cannot pause those separately.
3. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
4. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth Autoupdate day
   ```
5. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `Autoupdate`.
6. With Pro and the network filter, Kilobat pauses this updater on metered networks. The app keeps working. See [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html).

   ```
   kilobat updaters
   ```
7. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Is Autoupdate from Apple?**

No. It comes from Sparkle, an open source framework. Each app that uses Sparkle includes its own copy.

### Sources

- [Sparkle documentation: Basic setup](https://sparkle-project.org/documentation/)
- [Sparkle documentation: Sandboxing](https://sparkle-project.org/documentation/sandboxing/)
- nettop(1), man page installed with macOS 27.2
- [Kilobat docs: Pausing updaters on metered networks](https://kilobat.app/docs.html#updaters)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is ShipIt on Mac?](https://kilobat.app/guides/what-is-shipit.html): ShipIt comes from Squirrel.Mac.
- [Stop updates from using hotspot data](https://kilobat.app/guides/recipes/stop-updates-on-hotspot.html): On a metered network, Kilobat can pause the helpers that download updates.
- [What is GoogleUpdater on Mac?](https://kilobat.app/guides/what-is-googleupdater.html): GoogleUpdater updates Chrome and other Google apps in the background.
- [What is Microsoft AutoUpdate on Mac?](https://kilobat.app/guides/what-is-microsoft-autoupdate.html): Microsoft AutoUpdate (MAU) keeps Office, Teams and other Microsoft apps up to date.

---

Source: https://kilobat.app/guides/what-is-symptomsd.html

macOS processes

## What is symptomsd on Mac?

`symptomsd` provides services for Apple's Symptom Framework. Apple documents almost nothing else about it.

Process: `symptomsd` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `symptomsd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `symptomsd` can connect.

### What it is

The man page says only that symptomsd “provides services for the Symptom Framework”. It has no options, and users should not run it manually.

Apple publishes no documentation of the Symptom Framework. The program is `/usr/libexec/symptomsd`.

### Why it uses the network

- **Not documented.** Apple does not say why symptomsd uses the network. On this Mac, `nettop` showed no traffic for it.

### Is it normal?

It is part of macOS. If it moves a lot of data on your Mac, this is unusual. Measure it with the steps below.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `symptomsd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p symptomsd -P
   ```

### Reduce or pause it safely

1. There is no user setting for symptomsd.
2. Do not quit `symptomsd` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `symptomsd`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth symptomsd day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `symptomsd`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Is symptomsd malware?**

No. It is part of macOS, in `/usr/libexec`, with a man page.

### Sources

- symptomsd(8), man page installed with macOS 27.2
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What are ReportCrash and SubmitDiagInfo on Mac?](https://kilobat.app/guides/what-is-reportcrash.html): ReportCrash saves crash reports on the Mac.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.

---

Source: https://kilobat.app/guides/what-is-syspolicyd.html

macOS processes

## What is syspolicyd on Mac?

`syspolicyd` is the system policy daemon. Gatekeeper is part of this policy. Gatekeeper does online checks when you open new apps.

Process: `syspolicyd` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `syspolicyd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `syspolicyd` can connect.
- `syspolicyd` connects when you open an app that you downloaded.

### What it is

The man page says that syspolicyd “embodies the system policy controlling what may be installed, loaded, executed”. Other parts of macOS ask it for the policy's verdict.

The `spctl` command manages the same security assessment policy.

### Why it uses the network

- **Gatekeeper online checks.** Apple says that Gatekeeper does online checks for known malware and for revoked developer certificates.
- **Notarization.** Apple says that macOS Catalina and later need software to be notarized by default.

### Is it normal?

Yes. Short connections when you open new or updated apps are usual.

Apple says that it does not combine data from these checks with information about users.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `syspolicyd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p syspolicyd -P
   ```

### Reduce or pause it safely

1. There is no setting to reduce these checks safely. They are small.
2. Do not turn off Gatekeeper to save data. It protects the Mac against malware.
3. Do not quit `syspolicyd` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `syspolicyd`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth syspolicyd day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `syspolicyd`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Does Apple see every app I open?**

Apple says that it does not log IP addresses for Developer ID certificate checks, and does not combine the data with user information.

### Sources

- syspolicyd(8) and spctl(8), man page installed with macOS 27.2
- [Apple Support: Safely open apps on your Mac](https://support.apple.com/en-us/102445)
- [Apple Platform Security: Gatekeeper and runtime protection in macOS](https://support.apple.com/guide/security/gatekeeper-and-runtime-protection-sec5599b66df/web)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [What is trustd on Mac?](https://kilobat.app/guides/what-is-trustd.html): trustd checks certificates for all processes on the Mac.
- [Little Snitch, LuLu and other network extensions conflict on a Mac](https://kilobat.app/guides/network-extension-conflicts.html): Firewalls, VPNs and content filters on macOS use network extensions.
- [Find which app uses your bandwidth on a Mac](https://kilobat.app/guides/which-app-uses-bandwidth.html): Activity Monitor and nettop show which processes send and receive data.

---

Source: https://kilobat.app/guides/what-is-timed.html

macOS processes

## What is timed on Mac?

`timed` keeps the Mac's clock correct. It uses NTP, so it sends small requests to a time server.

Process: `timed` · Applies to: macOS 13 Ventura and later for the System Settings path. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `timed` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `timed` can connect.
- A small UDP request to a time server.

### What it is

The man page says that timed “maintains system clock accuracy by synchronizing the clock with reference clocks via technologies like NTP”.

It reads the NTP server from `/etc/ntp.conf`. It first appeared in macOS 10.13.

### Why it uses the network

- **Clock synchronization.** It asks a time server for the correct time.

### Is it normal?

Yes. The requests are very small.

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `timed` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p timed -P
   ```

### Reduce or pause it safely

1. Keep it on. A wrong clock makes valid certificates look expired. See [“This Connection Is Not Private” and certificate warnings on a Mac](https://kilobat.app/guides/connection-not-private-mac.html).
2. To change the time server, choose Apple menu > System Settings > General > Date & Time.

### With Kilobat

1. Open the Kilobat app list and search for `timed`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth timed day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `timed`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**What happens if the clock is wrong?**

Secure websites can show certificate errors, such as ERR_CERT_DATE_INVALID in Chrome. See [NET::ERR_CERT_DATE_INVALID in Chrome on Mac](https://kilobat.app/guides/err-cert-date-invalid.html).

### Sources

- timed(8), man page installed with macOS 27.2
- [Apple Support: Set the date and time automatically on your Mac](https://support.apple.com/guide/mac-help/set-the-date-and-time-automatically-mchlp2996/mac)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [NET::ERR_CERT_DATE_INVALID in Chrome on Mac](https://kilobat.app/guides/err-cert-date-invalid.html): The server's certificate looks expired or not yet valid by the Mac's clock.
- [“This Connection Is Not Private” and certificate warnings on a Mac](https://kilobat.app/guides/connection-not-private-mac.html): Safari shows a certificate warning when it cannot confirm the identity of a website.
- [What is trustd on Mac?](https://kilobat.app/guides/what-is-trustd.html): trustd checks certificates for all processes on the Mac.

---

Source: https://kilobat.app/guides/what-is-trustd.html

macOS processes

## What is trustd on Mac?

`trustd` checks certificates for all processes on the Mac. It can connect to the internet to find out if a certificate is still valid.

Process: `trustd` · Process: `ocspd` · Applies to: All current macOS versions. Seen on macOS 27.2. · Checked: 29 October 2026

### Where you see it

- `trustd` is in the list in Activity Monitor › Network, in `nettop` or in Kilobat.
- A firewall or network monitor asks if `trustd` can connect.
- `trustd` connects when you open secure websites or start apps.

### What it is

The man page says that trustd “provides services for evaluating trust in certificates for all processes on the system”. It is not for direct use.

The `ocspd` man page describes the network part. It fetches certificate revocation lists and OCSP responses, and it keeps a cache of them.

### Why it uses the network

- **Revocation checks.** To know if a certificate was revoked, macOS can ask the certificate authority.
- **A cache.** ocspd keeps answers in a cache, so most checks do not use the network again.

### Is it normal?

Yes. Small connections are usual, mostly when you visit many secure sites.

If certificate checks fail, Safari and other apps show certificate warnings. See [“This Connection Is Not Private” and certificate warnings on a Mac](https://kilobat.app/guides/connection-not-private-mac.html).

### See how much it uses

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Type `trustd` in the search field. The Sent Bytes and Rcvd Bytes columns show what it moved.
3. In Terminal, watch only this process. Press d to show the change per second, and q to quit.

   ```
   nettop -p trustd -P
   ```
4. Do the same for `ocspd`.

### Reduce or pause it safely

1. There is no user setting for these checks. They protect every secure connection.
2. If a company proxy blocks them, ask the administrator to allow the certificate authorities' hosts.
3. Do not quit `trustd` in Activity Monitor. It is part of macOS, and other features depend on it.

### With Kilobat

1. Open the Kilobat app list and search for `trustd`. Its row shows the live rate and the bytes it moved.
2. In Terminal, see the same live list. Press / and type the name to search.

   ```
   kilobat status --watch
   ```
3. Show its traffic over one day. Names match `kilobat report --summary`.

   ```
   kilobat bandwidth trustd day
   ```
4. Through MCP, an AI agent gets the same history with `get_app_bandwidth` and the name `trustd`.
5. The live view is free. History in the app needs Pro. Kilobat records history only while the app runs.

### Questions

**Should I block trustd in a firewall?**

No. Then macOS cannot check if a certificate was revoked.

### Sources

- trustd(8) and ocspd(1), man page installed with macOS 27.2
- [Apple Support: Avoid fraud by using encrypted websites in Safari on Mac](https://support.apple.com/guide/safari/sfri40697/mac)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [“This Connection Is Not Private” and certificate warnings on a Mac](https://kilobat.app/guides/connection-not-private-mac.html): Safari shows a certificate warning when it cannot confirm the identity of a website.
- [Corporate proxy certificates break Terminal tools on a Mac](https://kilobat.app/guides/corporate-proxy-certificates.html): Some company networks inspect HTTPS traffic.
- [What is syspolicyd on Mac?](https://kilobat.app/guides/what-is-syspolicyd.html): syspolicyd is the system policy daemon.
- [NET::ERR_CERT_DATE_INVALID in Chrome on Mac](https://kilobat.app/guides/err-cert-date-invalid.html): The server's certificate looks expired or not yet valid by the Mac's clock.

---

Source: https://kilobat.app/guides/which-app-uses-bandwidth.html

Websites and speed

## Find which app uses your bandwidth on a Mac

Activity Monitor and `nettop` show which processes send and receive data. Use them to find a backup, sync or update that fills the connection.

Applies to: All current macOS versions. · Checked: 29 October 2026

### Symptoms

- The connection is slow, and you do not know why.
- Upload activity is high when you do not upload anything.
- A hotspot or data plan runs out fast.

### Likely causes

- **Cloud sync and backups.** Photo libraries, cloud drives and backups move large amounts of data in the background.
- **Software updates.** macOS and apps download updates on their own.
- **Helper processes.** Apps often move data through helper processes with different names.
- **System download services.** macOS services download on behalf of apps, so the app name does not always show.

### How to check

1. Open Activity Monitor from Applications > Utilities. Click Network.
2. Click a column heading to sort the processes by data sent or received.
3. Look at the bottom of the window. It shows the total data received and sent, and the rate per second.
4. To show network activity in the Dock icon, choose View > Dock Icon > Show Network Usage.
5. In Terminal, show a live list of processes with their network traffic. Press q to quit.

   ```
   nettop -P
   ```
6. To show only the changes since the last update, add `-d`.

   ```
   nettop -P -d
   ```
7. For one sample as comma-separated values, use `-L 1`.

   ```
   nettop -P -L 1 -J bytes_in,bytes_out
   ```

### How to fix it

1. Pause the app's sync or backup from its own menu or settings.
2. Quit the app if you do not need it now.
3. On a hotspot, turn on Low Data Mode for that network. See [Use Low Data Mode on a Mac](https://kilobat.app/guides/low-data-mode-mac.html).
4. Schedule large updates for a time when you do not need the connection.

### With Kilobat

1. Kilobat shows live upload and download for every app in the menu bar. Helpers are grouped under their app. This is free.
2. The CLI shows the same live view. Press s to sort and / to search.

   ```
   kilobat status --watch
   ```
3. To see one app's traffic over a day, use `bandwidth`. Kilobat records history while the app runs.

   ```
   kilobat bandwidth "Google Chrome" day
   ```
4. To see the sockets of one process, use `destinations`.

   ```
   kilobat destinations --pid 1234
   ```
5. History in the app needs Pro. See [See which app uses data on a hotspot](https://kilobat.app/guides/recipes/hotspot-data-by-app.html).

### Questions

**Why does Activity Monitor show a process I do not know?**

Many apps use helper processes, and macOS services download for apps. Search for the process name, or look at its path.

**Does nettop need an administrator password?**

No. Any user can run `nettop`.

### Sources

- [Apple Support: View network activity in Activity Monitor on Mac](https://support.apple.com/guide/activity-monitor/view-network-activity-actmntr1006/mac)
- nettop(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [See which app uses data on a hotspot](https://kilobat.app/guides/recipes/hotspot-data-by-app.html): Kilobat shows the upload and download of each app on your Mac.
- [Mac uses Personal Hotspot data in the background](https://kilobat.app/guides/hotspot-background-data.html): A Mac on a phone hotspot can use a lot of data with no action from you.
- [Slow internet on a Mac: find which part is slow](https://kilobat.app/guides/slow-internet-mac-cause.html): A slow connection has many possible causes.
- [See where your apps connect](https://kilobat.app/guides/recipes/see-where-apps-connect.html): Kilobat shows the open connections of each app and the country where each address is registered.
- [Use Low Data Mode on a Mac](https://kilobat.app/guides/low-data-mode-mac.html): Low Data Mode tells macOS and apps to use less data on one Wi-Fi network.
- [What is nsurlsessiond on Mac?](https://kilobat.app/guides/what-is-nsurlsessiond.html): nsurlsessiond is part of macOS.

---

Source: https://kilobat.app/guides/wifi-bands-2-4-5-6-ghz.html

Wi-Fi

## 2.4 GHz, 5 GHz and 6 GHz Wi-Fi on a Mac

Wi-Fi uses three bands. Each band gives a different balance of range and speed. The Mac selects the band, but router settings control which bands it can use.

Applies to: macOS 13 Ventura and later. The Wi-Fi 6E mode setting needs a Mac that supports Wi-Fi 6E. · Checked: 29 October 2026

### Symptoms

- The Mac connects on 2.4 GHz and is slow, even near the router.
- The network shows a message about limited compatibility.
- You see two or three networks with almost the same name, one for each band.

### Likely causes

- **2.4 GHz reaches farther but is busy.** Apple says that 5 GHz signals do not go through walls as well as 2.4 GHz signals. Bluetooth also uses 2.4 GHz.
- **5 GHz and 6 GHz are faster but shorter range.** The cells are smaller, so the signal drops faster through walls.
- **Different names for each band.** Apple says that different names can make devices connect unreliably. Wi-Fi 6E networks with different names show limited compatibility.
- **The Mac or the router does not support a band.** 6 GHz needs a Mac and a router that support Wi-Fi 6E or Wi-Fi 7. 6 GHz is not available in all regions.

### How to check

1. Hold the Option key and click the Wi-Fi icon. Read the channel and band of the network.
2. Show the band and channel width from Terminal.

   ```
   system_profiler SPAirPortDataType | grep -m1 'Channel'
   ```

   Output For example `Channel: 36 (5GHz, 80MHz)`.
3. Show the Wi-Fi modes and channels that this Mac supports.

   ```
   system_profiler SPAirPortDataType | grep -E 'Supported PHY Modes'
   ```
4. Look at the list of Macs in Apple's Wi-Fi 6E article. Make sure that your Mac supports 6 GHz.

### How to fix it

1. In the router settings, turn on all bands that the router supports.
2. Give all bands one network name. Apple recommends a single, unique name for all bands.
3. Set the channel to Auto. On 2.4 GHz, use a channel width of 20 MHz.
4. For 6 GHz, set the security to WPA3. Apple says that WPA3 is required for 6 GHz.
5. To stop the Mac from using 6 GHz on one network, choose System Settings > Wi-Fi. Click Details next to the network.
6. Then set Wi-Fi 6E mode to Off. This setting shows only on a supported Mac connected to a Wi-Fi 6E or Wi-Fi 7 network.

### With Kilobat

1. Show the current band, channel and signal.

   ```
   kilobat wifi status
   ```
2. List nearby networks with their band, channel and channel width.

   ```
   kilobat scan
   ```
3. When Bluetooth devices share 2.4 GHz with the Wi-Fi, the Kilobat Wi-Fi menu marks them. It also offers a known 5 GHz network.

### Questions

**Which band is best?**

Near the router, 5 GHz or 6 GHz is usually faster. Far from the router or through many walls, 2.4 GHz can keep a connection where the others cannot.

**Can I force the Mac to use 5 GHz?**

macOS has no general band setting. Give all bands one name and let the Mac select. The Wi-Fi 6E mode setting only turns off 6 GHz.

### Sources

- [Apple Support: Use Wi-Fi 6E or Wi-Fi 7 networks with Apple devices](https://support.apple.com/en-us/102285)
- [Apple Support: Recommended settings for Wi-Fi routers and access points](https://support.apple.com/en-us/102766)
- [Apple Platform Deployment: Optimize your Wi-Fi networks for Apple devices](https://support.apple.com/guide/deployment/optimize-your-wi-fi-networks-dep2af1caf35/web)
- [Apple Support: Use the Wi-Fi status menu on Mac](https://support.apple.com/guide/mac-help/use-the-wi-fi-status-menu-on-mac-mchlfad426fa/mac)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Bluetooth headphones and Wi-Fi interference on a Mac](https://kilobat.app/guides/bluetooth-wifi-interference.html): Bluetooth and 2.4 GHz Wi-Fi use the same radio band.
- [Crowded Wi-Fi channels near your Mac](https://kilobat.app/guides/wifi-channel-congestion.html): Networks on the same channel share the air time.
- [Wi-Fi is slow on the Mac but fast on the phone](https://kilobat.app/guides/slow-wifi-mac-fast-phone.html): When the phone is fast on the same network, the internet connection is not the problem.
- [Weak Wi-Fi signal on a Mac](https://kilobat.app/guides/weak-wifi-signal-mac.html): Signal strength and noise decide how fast and how stable the Wi-Fi link is.

---

Source: https://kilobat.app/guides/wifi-channel-congestion.html

Wi-Fi

## Crowded Wi-Fi channels near your Mac

Networks on the same channel share the air time. In apartments and offices, many networks can share one channel and slow each other down.

Applies to: All current macOS versions. You change the channel in the router, not on the Mac. · Checked: 29 October 2026

### Symptoms

- The signal is strong, but Wi-Fi is slow at busy times, such as evenings.
- Many networks show in the Wi-Fi menu.
- Speed changes much from minute to minute.

### Likely causes

- **Many networks on one channel.** Each network on the channel must wait for the others to stop sending.
- **Overlapping 2.4 GHz channels.** Apple says that only channels 1, 6 and 11 do not overlap on 2.4 GHz.
- **Wide channels.** Wide channels are faster, but they overlap with more neighbors. Apple says that smaller widths allow more channel reuse.

### How to check

1. Show the current channel, and the channel of each nearby network.

   ```
   system_profiler SPAirPortDataType | grep -E 'Channel|Signal / Noise'
   ```

   Output One `Channel` line for your network, then one for each network in `Other Local Wi-Fi Networks`.
2. Count the strong networks on the same channel as yours.
3. Hold the Option key and click the Wi-Fi icon. Make sure of your channel and band.

### How to fix it

1. Open the settings page or app of the router.
2. Set the channel to Auto. Apple recommends this.
3. If the router cannot select a channel itself, select a channel that nearby routers do not use.
4. On 2.4 GHz, use channel 1, 6 or 11, with a width of 20 MHz.
5. On 5 GHz and 6 GHz, set the width to Auto.
6. Use 5 GHz or 6 GHz when you can. These bands have more channels.

### With Kilobat

1. Show the congestion of each channel in the current band, and the least crowded channel.

   ```
   kilobat channels
   ```

   Output The current channel, the `recommended` channel and a congestion score for each channel.
2. List nearby networks with their channel, band and width.

   ```
   kilobat scan
   ```
3. Channel crowding in the app is part of Kilobat Pro. The CLI is free.

### Questions

**Can the Mac change the channel?**

No. The router selects the channel. The Mac follows the router.

**Will the best channel stay the best?**

No. Neighbors change their channels. Hidden interference can also change the best choice.

### Sources

- [Apple Support: Recommended settings for Wi-Fi routers and access points](https://support.apple.com/en-us/102766)
- [Apple Platform Deployment: Optimize your Wi-Fi networks for Apple devices](https://support.apple.com/guide/deployment/optimize-your-wi-fi-networks-dep2af1caf35/web)
- system_profiler(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Weak Wi-Fi signal on a Mac](https://kilobat.app/guides/weak-wifi-signal-mac.html): Signal strength and noise decide how fast and how stable the Wi-Fi link is.
- [2.4 GHz, 5 GHz and 6 GHz Wi-Fi on a Mac](https://kilobat.app/guides/wifi-bands-2-4-5-6-ghz.html): Wi-Fi uses three bands.
- [Find a better Wi-Fi spot](https://kilobat.app/guides/recipes/find-better-wifi-spot.html): The signal radar scores your Wi-Fi several times a second.
- [Wi-Fi is slow on the Mac but fast on the phone](https://kilobat.app/guides/slow-wifi-mac-fast-phone.html): When the phone is fast on the same network, the internet connection is not the problem.

---

Source: https://kilobat.app/guides/wifi-connected-no-internet.html

Wi-Fi

## Mac connected to Wi-Fi but no internet

A Wi-Fi connection is only the link to the router. The internet can still fail at the router, at the provider or at DNS.

Applies to: macOS 13 Ventura and later for the System Settings steps. The Terminal commands work on all current versions. · Checked: 29 October 2026

### Symptoms

- The Wi-Fi icon shows full bars, but pages do not load.
- Safari shows that the server cannot be found.
- Other devices on the same network also have no internet, or they work and only the Mac fails.

### Likely causes

- **A login page.** Hotel, café and airport networks hold traffic until you sign in. See [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html).
- **A problem at the router or the provider.** When other devices also fail, the problem is not the Mac.
- **No valid address.** An address that starts with 169.254 means that the Mac did not get an address from the router. See [Mac has a self-assigned IP address](https://kilobat.app/guides/self-assigned-ip-address.html).
- **DNS fails.** The connection works, but names do not resolve. See [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html).
- **VPN or security software.** Apple says that software that monitors network connections can affect internet access.

### How to check

1. Hold the Option key and click the Wi-Fi icon. Look for Wi-Fi Recommendations in the menu.
2. Show the IP address, router and subnet of the Wi-Fi service.

   ```
   networksetup -getinfo Wi-Fi
   ```
3. Ping the router. Use the router address from the previous step.

   ```
   ping -c 5 192.168.1.1
   ```
4. Ping an internet address. This test does not use DNS.

   ```
   ping -c 5 1.1.1.1
   ```
5. Look up a name. If the ping works but this fails, DNS is the problem.

   ```
   dscacheutil -q host -a name apple.com
   ```
6. Test the same network on another device.

### How to fix it

1. If the router does not reply, restart the router.
2. Restart the Mac. The Mac then renews its network address.
3. To renew the address without a restart, choose System Settings > Wi-Fi. Click Details, then TCP/IP, then Renew DHCP Lease.
4. Make sure that the date and time on the Mac are correct.
5. Turn off the VPN or other network software for a test, if you can.
6. If other devices also fail, contact your internet provider or network administrator.

### With Kilobat

1. Check Wi-Fi, the router, the internet, DNS and login pages in one step.

   ```
   kilobat diagnose
   ```
2. If one site or service fails, find the layer that stops it.

   ```
   kilobat why example.com
   ```
3. The CLI is free. In the app, the advice from these checks is part of Kilobat Pro. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**The router replies, but 1.1.1.1 does not. What does this mean?**

The Mac reaches the router, but the router does not reach the internet. Restart the router, or contact the provider.

**Can a network block ping?**

Yes. Some networks do not reply to ping. Test with a web page or another device before you decide.

### Sources

- [Apple Support: If your Mac isn't connecting to the internet over Wi-Fi](https://support.apple.com/en-us/101588)
- [Apple Support: Wi-Fi settings on Mac](https://support.apple.com/guide/mac-help/mh11935/mac)
- [Apple Support: Use Wireless Diagnostics on your Mac](https://support.apple.com/guide/mac-help/mchlf4de377f/mac)
- networksetup(8), ping(8) and dscacheutil(1), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html): Public networks often hold all traffic until you sign in on a login page.
- [Mac has a self-assigned IP address](https://kilobat.app/guides/self-assigned-ip-address.html): If the Mac gets no answer from a DHCP server, it gives itself a link-local address from 169.254.0.0/16.
- [DNS not resolving on a Mac](https://kilobat.app/guides/dns-server-not-found.html): When DNS fails, the Mac cannot change a name such as apple.com into an IP address.
- [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html): When the internet works but one address fails, Kilobat checks each layer in turn.
- [Use Wireless Diagnostics and wdutil on a Mac](https://kilobat.app/guides/wireless-diagnostics-mac.html): Wireless Diagnostics is a Wi-Fi tool that comes with macOS.
- [Wi-Fi says “No Internet Connection” on Mac](https://kilobat.app/guides/wifi-no-internet-connection.html): macOS shows “No Internet Connection” under a Wi-Fi network when the Mac joined the network but cannot reach the internet through it.

---

Source: https://kilobat.app/guides/wifi-disconnects-after-sleep.html

Wi-Fi

## Mac Wi-Fi disconnects after sleep

After sleep, the Mac must join the Wi-Fi network again. When that fails or takes long, apps lose the connection. This guide finds when the drops happen and removes the usual causes.

Applies to: macOS 13 Ventura and later for the System Settings steps. The Terminal commands work on all current versions. · Checked: 29 October 2026

### Symptoms

- After you open the lid or wake the Mac, the Wi-Fi icon shows no connection for some time.
- Wi-Fi shows as connected after wake, but pages do not load.
- A VPN, a call or a download stops each time the Mac sleeps.
- The Mac joins a different network after wake than before sleep.

### Likely causes

- **The Mac must join again after sleep.** Apps that held a connection before sleep must connect again. Some apps do not do this well.
- **Router settings.** Apple says that different network names for each band can make devices connect unreliably. Old firmware and weak security modes also cause problems.
- **VPN or security software.** Software that monitors or filters network traffic can block access until it starts again after wake.
- **Two known networks in range.** After wake, the Mac can join a different known network, such as a phone hotspot. See [Mac joins the wrong Wi-Fi network](https://kilobat.app/guides/mac-joins-wrong-wifi.html).
- **Weak signal at the place where the Mac sleeps.** A weak signal can make the first join after wake fail. See [Weak Wi-Fi signal on a Mac](https://kilobat.app/guides/weak-wifi-signal-mac.html).

### How to check

1. Open Terminal. Show the most recent sleep and wake events, with their times.

   ```
   pmset -g log | grep -E ' (Sleep|Wake|DarkWake) ' | tail -20
   ```
2. Compare the wake times with the times when the connection failed.
3. After the next wake, look at the network state. Each interface shows if it is reachable.

   ```
   scutil --nwi
   ```
4. Find the address of your router.

   ```
   route -n get default
   ```

   Output The `gateway` line shows the router address.
5. Ping the router. Replies show that the Wi-Fi link works.

   ```
   ping -c 10 192.168.1.1
   ```
6. Hold the Option key and click the Wi-Fi icon in the menu bar. Make sure that the network name is the one you expect.

### How to fix it

1. Install all macOS updates. Choose Apple menu > System Settings > General > Software Update.
2. If you manage the router, install its latest firmware and restart it.
3. Give the router one network name for all bands. Use WPA3 Personal or WPA2/WPA3 Transitional security.
4. Make sure that VPN and security apps are up to date. Turn them off for a test, if your administrator lets you.
5. Forget the network and join it again. In System Settings > Wi-Fi, click Details next to the network, then click Forget This Network.
6. To restart Wi-Fi from Terminal, turn the Wi-Fi power off and on. Use the device name that `networksetup -listallhardwareports` shows.

   ```
   networksetup -setairportpower en0 off && networksetup -setairportpower en0 on
   ```
7. If the problem continues, use Wireless Diagnostics. See [Use Wireless Diagnostics and wdutil on a Mac](https://kilobat.app/guides/wireless-diagnostics-mac.html).

### With Kilobat

1. The Kilobat app records each drop while it runs. Show the drops from Terminal. Each event has a start, an end and a kind.

   ```
   kilobat outages
   ```

   Output Events such as `Unreachable`, `Wi-Fi roam` and `Network changed`.
2. Show the router, internet and DNS checks over the last day, to see when quality dropped.

   ```
   kilobat health-history --hours 24
   ```
3. A gap in the history means that the app did not run. It does not prove that the connection worked.
4. The CLI is free. Outage history in the app is part of Kilobat Pro.

### Questions

**Does “Wake for network access” keep Wi-Fi connected during sleep?**

No. That setting lets the Mac wake for network requests, such as file sharing. See [Use Wake for network access on a Mac](https://kilobat.app/guides/wake-for-network-access.html).

**Should I reset the network settings?**

Try the steps on this page first. Forgetting one network and joining it again changes less than other resets.

### Sources

- [Apple Support: If your Mac isn't connecting to the internet over Wi-Fi](https://support.apple.com/en-us/101588)
- [Apple Support: Recommended settings for Wi-Fi routers and access points](https://support.apple.com/en-us/102766)
- [Apple Support: Wi-Fi settings on Mac](https://support.apple.com/guide/mac-help/mh11935/mac)
- pmset(1), scutil(8) and networksetup(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Mac connected to Wi-Fi but no internet](https://kilobat.app/guides/wifi-connected-no-internet.html): A Wi-Fi connection is only the link to the router.
- [Use Wireless Diagnostics and wdutil on a Mac](https://kilobat.app/guides/wireless-diagnostics-mac.html): Wireless Diagnostics is a Wi-Fi tool that comes with macOS.
- [Mac joins the wrong Wi-Fi network](https://kilobat.app/guides/mac-joins-wrong-wifi.html): The Mac joins known networks on its own.
- [Use Wake for network access on a Mac](https://kilobat.app/guides/wake-for-network-access.html): Wake for network access lets a sleeping Mac wake when another computer uses its shared resources.
- [Mac sleep stops downloads](https://kilobat.app/guides/mac-sleep-stops-downloads.html): A Mac that goes to sleep stops most app activity, so a long download can stop or fail.

---

Source: https://kilobat.app/guides/wifi-no-hardware-installed.html

Error messages

## “Wi-Fi: No hardware installed” on Mac

macOS shows this when it cannot find the Wi-Fi hardware. A restart can bring it back. If it does not, the hardware can need service.

Applies to: All current macOS versions. The text was checked in AirPort.menu and WiFiAgent on macOS 27.2. · Checked: 29 October 2026

### Symptoms

- The Wi-Fi menu says “Wi-Fi: No hardware installed”.
- Wi-Fi is missing from Network settings.

### Likely causes

- **A software state after an update, sleep or crash.** macOS did not load the Wi-Fi hardware. A restart can fix this.
- **A hardware fault.** If the hardware is missing in System Information after a restart, the Wi-Fi hardware can be faulty.

### How to check

1. Hold the Option key and choose Apple menu > System Information. Click Wi-Fi under Network.
2. Look for the card type and firmware. If no Wi-Fi hardware shows, macOS cannot see it.
3. List the hardware ports from Terminal. Look for a port named Wi-Fi.

   ```
   networksetup -listallhardwareports
   ```
4. Show the Wi-Fi report from Terminal.

   ```
   system_profiler SPAirPortDataType
   ```

### How to fix it

1. Restart the Mac. Choose Apple menu > Restart.
2. If it is still missing, shut down the Mac. Wait 30 seconds, then turn it on.
3. Install macOS updates. Use Ethernet or iPhone USB tethering if Wi-Fi is missing. See [Connect a Mac to an iPhone hotspot with a USB cable](https://kilobat.app/guides/usb-tethering-iphone-mac.html).
4. Run Apple Diagnostics. Write down any reference code that it shows.
5. If the hardware still does not show, contact Apple or an Apple Authorized Service Provider. Give them the reference code.

### Questions

**Will resetting network settings fix this?**

Not if macOS cannot see the hardware. Network settings need the hardware to show first.

**Can I use the internet without Wi-Fi?**

Yes. Use an Ethernet adapter or USB tethering with an iPhone. See [Connect a Mac to an iPhone hotspot with a USB cable](https://kilobat.app/guides/usb-tethering-iphone-mac.html).

### Sources

- Error text in AirPort.menu and WiFiAgent, macOS 27.2 (Localizable.loctable)
- [Apple Support: Use Apple Diagnostics to test your Mac](https://support.apple.com/en-us/102550)
- networksetup(8) and system_profiler(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Use Wireless Diagnostics and wdutil on a Mac](https://kilobat.app/guides/wireless-diagnostics-mac.html): Wireless Diagnostics is a Wi-Fi tool that comes with macOS.
- [Connect a Mac to an iPhone hotspot with a USB cable](https://kilobat.app/guides/usb-tethering-iphone-mac.html): A USB cable gives a Mac the iPhone's internet connection and charges the iPhone.
- [Mac does not detect a USB or Thunderbolt Ethernet adapter](https://kilobat.app/guides/ethernet-adapter-not-detected.html): A USB or Thunderbolt Ethernet adapter must appear as a hardware port and as a network service.
- [Mac connected to Wi-Fi but no internet](https://kilobat.app/guides/wifi-connected-no-internet.html): A Wi-Fi connection is only the link to the router.

---

Source: https://kilobat.app/guides/wifi-no-internet-connection.html

Error messages

## Wi-Fi says “No Internet Connection” on Mac

macOS shows “No Internet Connection” under a Wi-Fi network when the Mac joined the network but cannot reach the internet through it.

Applies to: macOS 13 Ventura and later. The text was checked in WiFiSettingsKit on macOS 27.2. · Checked: 29 October 2026

### Symptoms

- The Wi-Fi menu shows “No Internet Connection” under the network name.
- Wi-Fi settings show the same text.
- VoiceOver reads the signal strength, then “No Internet Connection”.

### Likely causes

- **A Wi-Fi login page.** Hotel, café and airport networks hold traffic until you sign in. See [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html).
- **The router has no internet.** The router's link to the provider is down.
- **No valid address.** The Mac did not get an address from the router. See [Mac has a self-assigned IP address](https://kilobat.app/guides/self-assigned-ip-address.html).
- **A DNS or filter problem.** Apple does not document the test that macOS uses for this label. DNS and filters can affect it.

### How to check

1. Open any website. A login page shows that the network needs you to sign in.
2. Show the address and router of the Wi-Fi service.

   ```
   networksetup -getinfo Wi-Fi
   ```
3. Find the router address in the `gateway` line. Then ping it.

   ```
   route -n get default
   ping -c 5 192.168.1.1
   ```
4. Ping an address on the internet. This test does not use DNS.

   ```
   ping -c 5 1.1.1.1
   ```
5. Look up a name. If ping works but this fails, DNS is the problem.

   ```
   dscacheutil -q host -a name apple.com
   ```

### How to fix it

1. Sign in to the login page, if there is one.
2. Restart the router if other devices on the network also have no internet.
3. Renew the DHCP lease. See [Renew the DHCP lease on a Mac](https://kilobat.app/guides/renew-dhcp-lease-mac.html).
4. Follow the full steps in [Mac connected to Wi-Fi but no internet](https://kilobat.app/guides/wifi-connected-no-internet.html).

### With Kilobat

1. Check Wi-Fi, the router, the internet, DNS and a login page in one command.

   ```
   kilobat diagnose
   ```
2. These Kilobat checks are free. AI agents run them through MCP with `diagnose_connection` and `diagnose_network`. See [Find why one site or API won't connect](https://kilobat.app/guides/recipes/why-cant-it-connect.html).

### Questions

**Does the label mean that my Wi-Fi is broken?**

No. The Wi-Fi link works. The internet behind the router, a login page or the address is the problem.

### Sources

- Error text in WiFiSettingsKit.framework, macOS 27.2 (Localizable.loctable)
- [Apple Support: Use the Wi-Fi status menu on Mac](https://support.apple.com/guide/mac-help/use-the-wi-fi-status-menu-on-mac-mchlfad426fa/mac)
- [Apple Support: If your Mac isn't connecting to the internet over Wi-Fi](https://support.apple.com/en-us/101588)
- [Apple Developer News: How to modernize your captive network (22 June 2020)](https://developer.apple.com/news/?id=q78sq5rv)

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Mac connected to Wi-Fi but no internet](https://kilobat.app/guides/wifi-connected-no-internet.html): A Wi-Fi connection is only the link to the router.
- [Wi-Fi login page does not appear on a Mac](https://kilobat.app/guides/captive-portal-not-appearing.html): Public networks often hold all traffic until you sign in on a login page.
- [Mac has a self-assigned IP address](https://kilobat.app/guides/self-assigned-ip-address.html): If the Mac gets no answer from a DHCP server, it gives itself a link-local address from 169.254.0.0/16.
- [Safari: “You Are Not Connected to the Internet” on Mac](https://kilobat.app/guides/safari-not-connected-to-internet.html): Safari shows this page when macOS has no internet connection for it.

---

Source: https://kilobat.app/guides/wifi-weak-security-warning.html

Public Wi-Fi and privacy

## “Weak security” warning on Mac Wi-Fi

The Mac shows a security warning when a network uses an old security mode. The fix is in the router, not on the Mac.

Applies to: All current macOS versions. Router menus are different for each maker. · Checked: 29 October 2026

### Symptoms

- Wi-Fi settings show a warning under the network name.
- The warning says that the network uses weak security.
- The Mac connects, but you are not sure if the network is safe.

### Likely causes

- **WEP or TKIP.** Apple lists WEP and TKIP as weak settings to avoid.
- **WPA Personal or WPA/WPA2 mixed mode.** Apple lists these as weak settings too.
- **No security.** Apple strongly discourages None, Open or Unsecured networks.
- **An old extender.** An extender or a second access point can use an older mode than the main router.

### How to check

1. Show the security mode of the current network.

   ```
   system_profiler SPAirPortDataType | grep -m1 'Security'
   ```

   Output For example `Security: WPA2 Personal`.
2. Hold the Option key and click the Wi-Fi icon. Read the security standard of the network.
3. Open the router settings. Find the Wi-Fi security mode for each band.

### How to fix it

1. Set the security to WPA3 Personal.
2. If older devices must connect, use WPA2/WPA3 Transitional.
3. If you cannot use these modes, use WPA2 Personal (AES).
4. Use the same mode on extenders and other access points.
5. Install the latest router firmware. Updates can add newer security modes.
6. If you do not manage the network, do not send private data over it without a VPN.

### With Kilobat

1. The Kilobat Wi-Fi menu marks networks with legacy security. It suggests a WPA2 or WPA3 network.

### Questions

**Is WPA3 required for 6 GHz?**

Yes. Apple says that WPA3 security is required for 6 GHz use.

**Will old devices stop working with WPA3?**

Some can. WPA2/WPA3 Transitional lets older devices use WPA2 Personal (AES).

### Sources

- [Apple Support: Recommended settings for Wi-Fi routers and access points](https://support.apple.com/en-us/102766)
- [Apple Platform Deployment: Optimize your Wi-Fi networks for Apple devices](https://support.apple.com/guide/deployment/optimize-your-wi-fi-networks-dep2af1caf35/web)
- system_profiler(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Private Wi-Fi address on a Mac](https://kilobat.app/guides/private-wifi-address.html): A private Wi-Fi address replaces the hardware MAC address of the Mac on a network.
- [2.4 GHz, 5 GHz and 6 GHz Wi-Fi on a Mac](https://kilobat.app/guides/wifi-bands-2-4-5-6-ghz.html): Wi-Fi uses three bands.
- [Find a saved Wi-Fi password on a Mac](https://kilobat.app/guides/find-saved-wifi-password.html): The Mac stores the password of each Wi-Fi network that it joins.

---

Source: https://kilobat.app/guides/wireless-diagnostics-mac.html

Wi-Fi

## Use Wireless Diagnostics and wdutil on a Mac

Wireless Diagnostics is a Wi-Fi tool that comes with macOS. It analyzes the connection and lists problems with possible solutions. It does not change your network settings.

Applies to: All current macOS versions. The steps are from Apple's Mac User Guide for current macOS. · Checked: 29 October 2026

### Symptoms

- The Mac reaches the router, but pages, email or streams fail.
- Wi-Fi drops now and then, and you cannot find the cause.
- IT support asks for a Wi-Fi diagnostics file.

### Likely causes

- **Many possible causes.** Signal, interference, router settings, DNS and software can all cause Wi-Fi problems. The tool checks many of them in one pass.

### How to check

1. Quit all open apps.
2. Join the Wi-Fi network that has the problem.
3. Hold the Option key and click the Wi-Fi icon in the menu bar. Choose Open Wireless Diagnostics.
4. Follow the instructions on the screen.
5. In the Summary pane, click the Info buttons to learn more about each item.
6. To run the same tests from Terminal, use `wdutil`. The report goes to /var/tmp.

   ```
   sudo wdutil diagnose
   ```

   Needs an administrator password.
7. To show the Wi-Fi information without a full test, run `wdutil info`.

   ```
   wdutil info
   ```

### How to fix it

1. Apply the solutions that the Summary pane lists.
2. To find the report file, choose Go > Go to Folder in Finder. Enter /var/tmp and press Return.
3. The file name starts with WirelessDiagnostics and ends with .tar.gz.
4. Send the file to your network administrator or IT support, if they ask for it.
5. Also look for Wi-Fi Recommendations in the Wi-Fi menu. Apple says that it is not available for personal hotspots.

### With Kilobat

1. For a fast check of Wi-Fi, the router, the internet and DNS, run Kilobat's diagnosis.

   ```
   kilobat diagnose
   ```
2. For JSON that a script or an agent can read, add `--json`.

   ```
   kilobat diagnose --json
   ```

### Questions

**Does Wireless Diagnostics change my settings?**

No. Apple says that it does not change your network settings.

**Does the report contain private data?**

It contains details about your network and Mac. Send it only to people you trust.

### Sources

- [Apple Support: Use Wireless Diagnostics on your Mac](https://support.apple.com/guide/mac-help/mchlf4de377f/mac)
- [Apple Support: If your Mac isn't connecting to the internet over Wi-Fi](https://support.apple.com/en-us/101588)
- wdutil(8), man page installed with macOS 27.2

Sources checked on 29 October 2026. Man pages are the ones installed with macOS; open one with `man <name>` in Terminal.

### Related guides

- [Mac connected to Wi-Fi but no internet](https://kilobat.app/guides/wifi-connected-no-internet.html): A Wi-Fi connection is only the link to the router.
- [Mac Wi-Fi disconnects after sleep](https://kilobat.app/guides/wifi-disconnects-after-sleep.html): After sleep, the Mac must join the Wi-Fi network again.
- [Weak Wi-Fi signal on a Mac](https://kilobat.app/guides/weak-wifi-signal-mac.html): Signal strength and noise decide how fast and how stable the Wi-Fi link is.
- [Slow internet on a Mac: find which part is slow](https://kilobat.app/guides/slow-internet-mac-cause.html): A slow connection has many possible causes.