net-use Released: Monitor Which IPs a macOS App Actually Connects To

Sometimes when setting up a firewall whitelist for an app, the hardest part isn’t configuring rules — it’s not knowing which addresses the app actually connects to. And many modern apps aren’t just a single main process; they spawn helpers, renderers, crash reporters, and other child processes, so monitoring a single PID often isn’t enough. So I wrote a small tool called net-use that tracks the remote IPs accessed by a specified app and its entire process tree in real time, outputting deduplicated results.

Repository: https://github.com/jtianling/net-use

In One Sentence

net-use is a network connection monitoring tool for macOS. It uses the proc_pidfdinfo system call to enumerate socket information, capturing TCP/UDP remote addresses accessed by a specified app and all its child processes in real time. To better suit the firewall whitelist use case, IPv4 addresses are aggregated to /24 subnets by default, while IPv6 addresses are kept in full.

Why I Built This

My need was simple: I wanted to know what addresses an app is actually accessing and compile the results into a whitelist I can use directly.

For a quick glance at network connections, there are plenty of tools that can get the job done. But once you need to pin it down to a specific app — especially a desktop app that spawns many child processes — things get complicated: processes change, PIDs change, connections appear dynamically, and you have to deduplicate manually. So I just built a dedicated tool for this.

Usage

Installation:

cargo install net-use

The simplest way is to launch TUI mode directly:

sudo net-use

After launching, you can browse installed apps, filter by typing, and press Enter to start monitoring. During monitoring, you can export to a file, copy to clipboard, toggle sort order, and switch between subnet-aggregated and raw IP display.

If you prefer not to use the interface, you can go straight to CLI:

# Monitor by Bundle ID
sudo net-use --bundle com.google.Chrome --no-tui

# Monitor by process name
sudo net-use --name curl --no-tui

# Monitor by PID
sudo net-use --pid 1234 --no-tui

Output is a deduplicated address list, for example:

142.250.80.0/24
172.217.14.0/24
2607:f8b0:4004:800::200e

Ready to use directly as a whitelist.

A Few Other Useful Features

• Can monitor apps that haven’t launched yet — starts collecting automatically once they start
• Historical data persists after the app exits; data continues to accumulate when it reappears
• Supports pause/resume monitoring
• Supports persisting historical results to a file

Limitations

This tool currently only supports macOS and requires sudo, since reading process socket information requires elevated privileges.

It’s also polling-based, defaulting to once every 200ms, so extremely short-lived connections could theoretically be missed. Additionally, some XPC services launched via launchd may not fall entirely within the same process tree — that’s another current limitation.

In short, if you also have the need to know “which IPs an app is actually connecting to,” give it a try. For me at least, I finally don’t have to stare at Activity Monitor while manually compiling whitelists anymore.

Categories:  Programming
Tags:  macOS, Rust, Networking, Firewall, net-use