Hey folks, I'm looking for recommendations on the best app for monitoring network connections on a Mac. I know about Wireshark, which does a great job of capturing packet data, but I'm used to ProcMon (Windows world) and it has ability to document connection information (e.g., like inbound TCP connection requests) instead of just raw packet data. Unfortunately ProcMon hasn't been ported over to Mac, so I am looking for the next best thing in this class of utility. All suggestions welcome of course!
Got a tip for us?
Let us know
Become a MacRumors Supporter for $50/year with no ads, ability to filter front page stories, and private forums.
Best Free App for Monitoring Network Connections on Macs
- Thread starter flugenblar
- Start date
- Sort by reaction score
Software network monitor and firewall Little Snitch
www.obdev.at
There other alternatives as well.
Update: Just noticed you were looking for “free” network monitor app. Sorry. Best of luck.
Little Snitch
Protects your privacy and prevents your private data from being sent out to the Internet without your knowledge.
There other alternatives as well.
Update: Just noticed you were looking for “free” network monitor app. Sorry. Best of luck.
Last edited:
I installed Wireshark (FREE app) and started playing with filters. I've come up with a filter that fairly well suits my needs regarding this post:
(ip.dst == 192.168.68.141) && (tcp.flags==0x002)
Its a display filter (not a capture filter). I have to manually provide the local IP address to this filter (I use it on multiple machines), but that's easy. This filter shows TCP inbound connection request based on the TCP 3-way handshake that occurs when TCP connections are established (SYN / SYN-ACK / ACK). I don't think it will catch broadcasts or multicasts, but that might not be very important for tracking TCP connections; but if so then it will take more entries for 'ip.dst', or maybe even a 'net' entry. But this is where I'm at right now.
(ip.dst == 192.168.68.141) && (tcp.flags==0x002)
Its a display filter (not a capture filter). I have to manually provide the local IP address to this filter (I use it on multiple machines), but that's easy. This filter shows TCP inbound connection request based on the TCP 3-way handshake that occurs when TCP connections are established (SYN / SYN-ACK / ACK). I don't think it will catch broadcasts or multicasts, but that might not be very important for tracking TCP connections; but if so then it will take more entries for 'ip.dst', or maybe even a 'net' entry. But this is where I'm at right now.
Mostly I use PortsMonitor unless I really need to capture packets. Free trial, then USD8,