Network Tools on a Mac: Terminal, ping, traceroute and Lookups

Hold Command and press Space to open Spotlight search. Type Terminal and press Return. A window opens with a line ending in % or $. That is where you type.

You can also use Finder → Applications → Utilities → Terminal, or open Launchpad and search for it.

For a one-click icon: while Terminal is open, right-click its icon in the Dock, choose Options → Keep in Dock.

The click way: Apple menu → System Settings → Wi-Fi → Details next to your network. The IP addressIn plain words: A device’s street address on a network: four numbers separated by dots, like 192.168.1.37.Technical: A 32-bit number (IPv4), written as four octets. It combines which network the device is on and which device it is on that network.Click for the full glossary entry is listed there.

The Terminal way:

> ipconfig getifaddr en0

This prints your address on Wi-Fi (on most Mac laptops Wi-Fi is en0). If it prints nothing, try en1, or use the click way. ifconfig prints everything but is long.

Why this matters. Your address is the start of the subnetting and DHCP lessons. To renew a DHCPIn plain words: The front desk of your network. When a phone or laptop joins, DHCP hands it an address, like a hotel handing you a room key, so nobody types it in by hand.Technical: Dynamic Host Configuration Protocol. A service, normally on your router, that leases each device an IP address, subnet mask, gateway and DNS server automatically.Click for the full glossary entry leaseIn plain words: An address that is lent to you for a while, like a library book you have to renew.Technical: The time a DHCP server lets a device keep an address before it must renew. Home routers often use hours to a day.Click for the full glossary entry on a Mac, use System Settings → Wi-Fi → Details → TCP/IP → Renew DHCP Lease.

Mac and Linux keep sending test packetsIn plain words: A small parcel of data with an address on it. Everything you do online is sent as lots of tiny parcels.Technical: A unit of data with a header (addresses, TTL, protocol) and a payload. Large data is split into packets and reassembled at the destination.Click for the full glossary entry until you stop them. Ask for four, like Windows does:

> ping -c 4 1.1.1.1

You should see four replies with a time in ms, then a summary showing how many packets were lost. If you forget the -c 4, press Control + C to stop it.

Why this matters. Replies from 1.1.1.1 (a public service) prove you can reach the internet by number, even if names are not working. That splits “no internet” from “DNSIn plain words: The internet’s phone book. You type an easy name like stashgrid.ai, and DNS looks up the number address that computers really use, the way a street address tells the mail carrier where to go.Technical: Domain Name System. A worldwide set of servers that turns names into IP addresses. Your device asks a DNS server (usually your router or your provider) every time you visit a site.Click for the full glossary entry is broken.”

The Mac command is traceroute (not tracertIn plain words: Shows the road your data takes to a website, one stop at a time.Technical: The Windows traceroute command. Sends ICMP echo requests with rising TTL values so each router on the path reports back. Macs and Linux use traceroute.Click for the full glossary entry):

> traceroute -n -m 15 example.com

It works like the Windows one, hopIn plain words: One stop along the road between you and a website, like one town on a road trip.Technical: One router-to-router jump. A path of 12 hops passes through 12 routers or gateways.Click for the full glossary entry by hop, with three times per hop. The difference: by default a Mac sends UDP packetsIn plain words: A small parcel of data with an address on it. Everything you do online is sent as lots of tiny parcels.Technical: A unit of data with a header (addresses, TTL, protocol) and a payload. Large data is split into packets and reassembled at the destination.Click for the full glossary entry rather than ICMPIn plain words: The internet’s way of sending tiny “are you there?” and “that did not arrive” notes between devices.Technical: Internet Control Message Protocol. Carries status and error messages. ping and tracert both use it. Some routers and firewalls ignore it on purpose, so silence is not always a fault.Click for the full glossary entry, so some routers answer differently. Switches you will use:

• -n — no name lookups. Faster, cleaner.
• -m number — maximum hops.
• -w seconds — how long to wait for each reply. On a Mac this is in seconds, unlike Windows.
• -q number — how many test packets per hop (the default is 3).
• -I — use ICMP like Windows does. On some versions this needs an administrator password.

Read the output as in the Windows traceroute lesson: hop number, three times, then who answered. Lines of * * * are not automatically a problem.

A Mac includes whois:

> whois example.com

For the modern RDAPIn plain words: A modern lookup for “who registered this website name, and when?” The most useful part is the date, because brand-new names are a warning sign.Technical: A standard, web-based (HTTPS and JSON) replacement for whois. Gives registration dates, registrar, name servers and status in a consistent format.Click for the full glossary entry version, use curlIn plain words: A small tool that fetches a web address for you from the command prompt and prints what comes back, like a browser with no window.Technical: A command-line program for transferring data over HTTP and other protocols. Built into current Windows (as curl.exe), macOS and Linux.Click for the full glossary entry and save the answer, then open it and search for registration:

> curl -sL https://rdap.org/domain/example.com -o rdap.txt
> open -e rdap.txt

See Who owns this website for how to read the answer and use it on suspicious emails.

Wi-Fi signal: hold the Option key and click the Wi-Fi icon in the menu bar at the top. It shows your connection details, including the signal strength (RSSI, in dBmIn plain words: How strong the Wi-Fi signal is. The number is negative, and closer to zero is stronger.Technical: Decibels relative to a milliwatt. Around −50 is excellent, −67 is good for video, −80 is weak, −90 is unusable.Click for the full glossary entry: closer to zero is stronger, and about −67 is good for video), the channelIn plain words: Wi-Fi uses lanes of radio. If your neighbour is in the same lane, you slow each other down.Technical: 2.4 GHz and 5 GHz are bands, split into channels. On 2.4 GHz only 1, 6 and 11 do not overlap.Click for the full glossary entry and the speed. Option-click also offers Open Wireless Diagnostics for deeper tests.

One-click network check. The Mac version of a Windows .bat fileIn plain words: A saved to-do list for the computer. Double-click it and it does the steps in order.Technical: A plain-text script of command prompt commands, run in sequence. It can run anything, so only run ones you wrote or have read.Click for the full glossary entry is a .command file. In Terminal, run:

> nano ~/Desktop/netcheck.command

Paste this in:

#!/bin/bash
echo "===== Your address ====="
ipconfig getifaddr en0
echo
echo "===== Can I reach the internet? ====="
ping -c 4 1.1.1.1
echo
echo "===== Path to a website ====="
traceroute -n -m 15 -w 1 example.com
echo
read -n 1 -s -r -p "Press any key to close"

Press Control + O, then Return, then Control + X to save and leave. Then make it runnable:

> chmod +x ~/Desktop/netcheck.command

Double-click netcheck.command on the desktop. If macOS says it cannot verify the file, right-click it and choose Open the first time.

Stay safe. Like a Windows .bat file, a .command file can run anything. Only run ones you wrote or read yourself, and never one that arrived by email or download.