OSX: Is there a log of connections?

Question

I am the original owner of this question OSX log of connections? but unfortunately something went wrong and i had to create a new account, so here i am. The question is: I was wondering if Mac OS X is having some sort of a log storing the connections that have interacted with the given computer? I cannot really seem to find it, therefore I am asking ;-) Thanks! To avoid further confusing, I am talking about info like ip addresses and not just connection has been established etc.

Solution

Yes. There is tcpdump. You can use it to log the complete traffic that runs over a given network interface. And then use Wireshark to investigate it further. You can also use Wireshark for both, logging and investigation in one step.

1. Open the  › System Information and identify the BSD device name of the network interface (AirPort, Ethernet etc.) you want to monitor
2. Open the Terminal.app
3. Run sudo tcpdump -i en1 -s 0 -B 524288 -w ~/Desktop/DumpFile01.pcap replace en1 with the name of step 1 and DumpFile01.pcap with the desired file name and path.
4. Press return and enter your password
5. Press Control + C if you've captured what you need

To view the file you can either print it by using tcpdump -s 0 -n -e -x -vvv -r ~/Desktop/DumpFile01.pcap or investigate it further using Wireshark.

The dump contains everything that happened while the command was running. Including IPs, each package sent/received and so on.

More information on running tcpdump on macOS can be found here.

If you don't actually need logging you can also use nettop to view just the currently active connections.

Ongoing logs

There is no "access.log" that only contains network requests that I am aware of, but some network events may be found in cat /var/log/system.log | grep en0 (replace en0 with your interface name) and WiFi related events in /var/log/wifi.log.

If you want a simple solution with UI that tracks your traffic on macOS the firewall Little Snitch is a good companion. I use it myself.

Comments

[step]

Thanks! But what about for ip addresses that has interacted with the pc before starting to capture using that method

[woerndl]

@step I've updated my answer regarding ongoing logging.