How to tell if a public Wi-Fi network is watching you

Most advice stops at “use a VPN”. Here is how to actually inspect the network you just joined, with commands already on your Mac.

Most advice about public Wi-Fi stops at "use a VPN". That is good advice and it is not the whole story, because the interesting question is not whether a network could be hostile. It is whether the one you are on is behaving strangely right now, and macOS will tell you if you ask it the right questions.

Every command below is built into macOS, runs as a normal user, and needs no extra software.

1. Is this network encrypted at all?

An open network has no link-layer encryption, so anything not protected by HTTPS is readable by anyone in range. Most traffic is HTTPS now, which helps enormously, but not everything is, and metadata such as which sites you visit still leaks through DNS.

Check what you are connected to:

system_profiler SPAirPortDataType | grep -A6 "Current Network"

Look for the security type. None means open. WEP or WPA on their own are effectively broken and should be treated like open. WPA2 and WPA3 are what you want.

2. Who is the router, and did it change?

This is the check almost nobody does, and it is the one that catches an attacker on the same network redirecting your traffic through their machine, which is called ARP spoofing.

route -n get default | grep gateway
arp -n 192.168.1.1

The second command prints the hardware address of your router. Write it down for networks you use often. If the gateway keeps the same IP address but the hardware address changes while you are sitting still, something is answering for the router that is not the router. It can also mean the café swapped their hardware, so it is a reason to look rather than to panic, but on a network you know well it is a serious signal.

3. Is anything intercepting HTTPS?

If someone is reading your encrypted traffic, they have to present their own certificate. You can see whose certificate you are actually getting:

echo | openssl s_client -connect www.apple.com:443 -servername www.apple.com 2>/dev/null | openssl x509 -noout -issuer

The issuer should be Apple's own certificate authority. If it says something else, and you are not on a corporate network that told you it inspects traffic, stop using that network.

A related check: has anything added a certificate authority your Mac now trusts?

security dump-trust-settings -d

On a normal machine this says no trust settings were found. Anything listed there can issue a certificate for any site and your Mac will believe it.

4. Where are your DNS lookups going?

scutil --dns | head -20

Networks hand you a resolver over DHCP, which is normal. What matters is whether it changed to something you do not recognise, and whether it changed at a moment that makes no sense, such as while you were sitting still on the same network.

5. What is your Mac offering to the network?

This is the one that bites developers. If you started a server bound to all interfaces, everyone on the café network can reach it.

lsof -nP -iTCP -sTCP:LISTEN | grep -E '\*:|0\.0\.0\.0'

Anything listed with * or 0.0.0.0 is reachable from the network, not just from your machine. A development server on port 3000 or 8000 is the usual culprit. Bind to 127.0.0.1 instead and it becomes invisible to everyone else.

Also check the sharing services:

sudo systemsetup -getremotelogin

or simply look in System Settings, General, Sharing. Screen Sharing and Remote Login on an untrusted network are an open invitation.

6. Turn on stealth mode before you travel

macOS has a firewall setting that makes your Mac ignore probes rather than answer them, which stops it appearing in a casual scan of the network.

/usr/libexec/ApplicationFirewall/socketfilterfw --getstealthmode

Turn it on in System Settings, Network, Firewall, Options. Also worth knowing: your Mac announces its name on every network it joins. Check what that name is with scutil --get ComputerName. If it is your full legal name, consider changing it.

7. Know when your VPN drops

A VPN only protects you while it is up. Several popular clients, including WireGuard and Tailscale configurations, will quietly fall back to the plain network if the tunnel dies, and nothing on screen tells you. You can see the current state with:

ifconfig | grep -A3 utun

A tunnel interface carrying a real address means you are tunnelled. If yours does not have a kill switch, this is worth checking after every sleep or network change.

The realistic summary

Open Wi-Fi in 2026 is not the catastrophe it was in 2012, because almost everything is HTTPS. The genuine risks that remain are: your own machine exposing services it should not, someone intercepting TLS with a certificate you never inspect, and a VPN you believe is up when it is not.

All three are checkable in about a minute with the commands above. The problem is that nobody runs them at the moment they matter, which is the moment you join a new network.