Find Detailed Wi-Fi Connection History from Command Line of Mac OS X
There are some situations where knowing exactly what wireless networks a Mac has connected to and when that connection was last established can be helpful.
We’ll demonstrate how to uncover a comprehensive listing of specifics about previously joined wi-fi networks on a Mac, which will include the last connection date and time (to the second!), if the network is hidden or not, the network SSID number, the networks SSID broadcast name, and the security type of each wifi network.
This will use the command line of Mac OS X, which is obviously a bit more advanced and perhaps not applicable to average Mac users. Nonetheless, the retrieved information can be helpful for a wide variety of purposes. You’ll find the data useful for something as simple as recovering a forgotten a wi-fi network password from a router which you can’t quite remember the name of, to network troubleshooting and diagnostics, or even for data analysis and forensic purposes.
How to See Wi-Fi Network Connection History on a Mac
Launch the Terminal application, located in /Applications/Utilities/ (or with Spotlight and Command+Spacebar) and enter the following command string into a single line:
For modern versions of Mac OS and Mac OS X, including MacOS High Sierra, Sierra, El capitan, OS X Yosemite, and newer, use the following:
defaults read /Library/Preferences/SystemConfiguration/com.apple.airport.preferences |grep LastConnected -A 7
For earlier versions of Mac OS X including Mavericks and prior releases, you can use the following command to clean up the output and match that which is available in modern releases:
defaults read /Library/Preferences/SystemConfiguration/com.apple.airport.preferences| sed 's|\./|`pwd`/|g' | sed 's|.plist||g'|grep 'LastConnected' -A 7
Hit return and you’ll instantly see the comprehensive listing of wireless network connection details.
Here’s an example of output supplied by this command string, showing three connected networks.
$ defaults read /Library/Preferences/SystemConfiguration/com.apple.airport.preferences |grep LastConnected -A 7
LastConnected = "2015-05-29 09:14:48 +0000";
Passpoint = 0;
PossiblyHiddenNetwork = 0;
RoamingProfileType = Single;
SPRoaming = 0;
SSID = <455c1211 75717d41 984c8712 474482>;
SSIDString = "HomeWirelessWAN-ng";
SecurityType = "WPA/WPA2 Personal";
--
LastConnected = "2015-05-31 01:52:43 +0000";
Passpoint = 0;
PossiblyHiddenNetwork = 1;
RoamingProfileType = Single;
SPRoaming = 0;
SSID = <75891725 8382b4b 409f8581 85264891 1212c6c5 74713871>;
SSIDString = "Secret Network 1";
SecurityType = "WPA2 Personal";
--
LastConnected = "2015-06-03 08:32:12 +0000";
Passpoint = 0;
PossiblyHiddenNetwork = 0;
RoamingProfileType = Single;
SPRoaming = 0;
SSID = <65428519 94198bc1 142848b1 847b564b 9852719c>;
SSIDString = "Public Network - Parks 1";
SecurityType = "None";
Keep in mind if you run this command on a Mac that has joined many wireless routers, you’ll find a very lengthy list returned, which may be better read if redirected into a text file by appending “> ~/Desktop/connectionlist.txt” to the end of the syntax like so:
defaults read /Library/Preferences/SystemConfiguration/com.apple.airport.preferences |grep LastConnected -A 7 > ~/Desktop/connectionlist.txt
If you use that command, a file named ‘connectionlist.txt’ will appear on the current users OS X desktop with the pertinent information.
Regular readers here may recall that we have shown a few ways to find which wi-fi networks a Mac has connected to before, but those methods in comparison provide notably less information, certainly compared to the extensive details offered here. You can use whichever is most relevant to your needs.
Do you know of another way to track wi-fi connection history on a Mac? Let us know in the comments!
I can’t be done at all this way on. Big
sur 11.4, I’m looking everywhere to figure this out. I need the wifi history logins of my Mac, I want even the networks that were “forgotten” . Is it possible this record really exists?
I managed to do this on High Sierra.
Show Specific Wifi network connection history in OSX
log show –predicate ‘(processImagePath contains “configd”) && (eventMessage contains “en0: SSID {enter your SSID name} “)’ –style syslog –last 1d
Enter your SSID, and change 1d (1 day) to more days
Hey guys, this command on my osx 10.8.5 gives me only like 3 entries which are over 1 year old. I definitely connected to more networks, and more recently. What´s wrong?
Thanks!
There are two different commands to reveal detailed wi-fi network connection history, one for modern Mac OS releases like 10.13.x, 10.12.x, and one for earlier builds like 10.8.x
Be sure you use the appropriate syntax for the Mac version
Yes, I tried the earlier one. And I think I understand now: It shows only the connections of the preferred networks list which I manually added, I didn´t check the option “remember networks this computer has joined”.
Is there another way to see logfiles of earlier connections, like a monitored history? Or a history of DHCP leases? I need it as proof in a filesharing case against me. A guest using my wifi account down/uploaded a movie. My router only logs the current day.
Thanks!
I’m not sure what you mean by filesharing case, but it sounds like you need the router logs instead if you want to have a record of computers that connected to a particular wi-fi network. The approach here only shows the wi-fi connection history of the Mac the command is being executed on. So if you have Computer 1, this will show you Computer 1 wi-fi history, but it would not show you the details of another separate computer connecting to the same wi-fi network.
For your own Mac (or any other Mac you have access to), you MIGHT be able to track down old connection data either through Time Machine backups or maybe some system logs if they have not rotated much.
Try looking around in:
– Console app, which has a search function (could try searching for mDNS, airport, etc, but typically these logs are short lived and
– /private/var/log/system.log
and this may show some DHCP lease history with a date, but it seems version dependent:
sudo ls -l /private/var/db/dhcpclient/leases/You’re basically seeking some digital forensic footprint of network connection history, but I’m not sure if what you’re looking for will be on your local Mac. Depending on your situation it may be worth talking to an expert on the topic. Sarah Edwards is a Mac digital forensic analyst who is quite savvy, you could try sending her an email or contacting her on Twitter to see if she has any advice for tracking down some of the data you need.
https://twitter.com/iamevltwin
https://www.mac4n6.com/
Something to think about anyway.
Is there an update for this command line for El Capitan? I get a directory not found reply.
Thanks,
John
The command works to show wi-fi history in Sierra and El Capitan:
defaults read /Library/Preferences/SystemConfiguration/com.apple.airport.preferences |grep LastConnected -A 7I’m looking for WiFI connection history. Looks like it working for you, but does not work for Catalina 10.15.3 Any help. Thanks, Tim
Wow, still have my wallpaper on. I am honored!
We need to take this a step further. How can we block certain wireless networks (read: infinitywifi, et. al.)?
When I ‘forget this network’, iCloud puts it right back in the list.
I asked during a genius bar appointment and they had me delete a directory that removed all network information. Then I had to re-connect to my home wifi. After a few minutes, viola! the stupid list was back.
Thanks iCloud, I hate you
Lol at “Thanks iCloud, I hate you” …let me echo that sentiment. I hope/demand that Apple finally gets iCloud right in these upcoming software versions, rather than the colossal pain/waste/disaster it currently is.