Traffic Monitoring for macOSActive observability projectMeasure what moves. Understand where it moves.
Traffic Monitoring gives Mac users local network history, usage by network, trends and observation coverage - then adds progressively stronger application activity evidence without making packet content the price of observability.
DECIDE
What network behavior can be observed locally without overstating the evidence?
The project starts from useful questions -usage by network, observation coverage and application activity -while treating unknown or unsupported conclusions as valid outcomes rather than gaps to hide.
"Make network behavior understandable before trying to make it verifiable."
A trustworthy local-first claim needs measured behavior, explicit coverage and honest limits. Traffic Monitoring starts with useful network analytics and strengthens evidence only when the source supports it.
Why it exists
"How much data am I actually using when my Mac connects through my phone hotspot?"
Counters without network context are hard to act on
Knowing total bytes downloaded is far less useful than knowing whether those bytes occurred on home Wi-Fi or a constrained mobile hotspot.
Selected periods without coverage metrics are misleading
Showing a 7-day usage chart without revealing that the Mac was asleep or the app was closed for 3 of those days creates a false sense of completeness.
Process names without locality cannot support privacy claims
Seeing a process name in a list does not prove whether its traffic was loopback, local network, or sent across the public Internet.
Richer evidence shouldn’t force system extension installation
Users and open-source contributors should get immediate, non-privileged process activity insights before deciding whether to deploy signed system extension components.
BUILD
Separate authoritative counters, previews and experimental flow evidence.
The architecture keeps platform sources, tracking, persistence, analytics and UI boundaries explicit so stronger evidence can be added without silently changing what earlier tiers are allowed to claim.
Architecture & Data Paths
Strict separation isolates platform sources, core tracking, preview aggregation, and SwiftUI presentation.
Key Architectural Features
- •Darwin 64-bit sysctl counters query hardware interface statistics directly via NET_RT_IFLIST2.
- •NWPathMonitor and CoreWLAN detect interface switches, hotspot flags, and Wi-Fi SSIDs.
- •SwiftData local repository persists 5-minute bucket aggregates and observation coverage checkpoint logs.
- •NettopProcessSampler parses non-blocking CSV process snapshots every ~15 seconds.
- •Advanced Provider prototype operates via NEFilterDataProvider system extension over Mach/XPC bridge.
TEST
Make coverage and uncertainty visible in the product itself.
The real workflow is not just a byte counter. Product surfaces expose usage, networks, trends, application previews and technical diagnostics while showing when observation is partial or degraded.
Product Surfaces in Action
Organized around the practical questions a user or developer needs to answer.
Overview Dashboard
"How much data did this Mac use, and how complete was observation?"
A high-level snapshot of total usage, download/upload breakdown, observation coverage, data quality, and top network contexts.
Trends Analytics
"When did traffic happen, and where were the peaks?"
Time-series bandwidth breakdown with peak traffic detection, hourly analysis, and network context isolation.
Networks Breakdown
"Which network contexts accounted for usage?"
Comparative analysis across Wi-Fi networks, mobile hotspots, and Ethernet interfaces with identity classification and evidence quality indicators.
Applications (Beta)
"Which applications show network activity right now?"
Non-privileged nettop process network activity summary aggregated by macOS application bundle, process name, or individual PID.
Technical Monitor
"What are the raw interface counters and last-sample diagnostics?"
Real-time interface counter readings, raw 64-bit Darwin kernel byte statistics, and 2-second delta measurement diagnostics.
Coverage and Uncertainty
Traffic Monitoring keeps usage totals and evidence quality explicitly separate.
Identified
Observed network context is identified with no known observation gaps for the interval.
Partially identified
Some time was unobserved or traffic relied on fallback transport metadata.
Unknown network
Traffic was measured but reliable Wi-Fi SSID / network identity was restricted or unavailable.
Tracking degraded
A counter reset, persistence delay, or tracking interruption affected part of the evidence period.
ℹ️ System sleep, app shutdowns, crashes, and unmonitored intervals are never silently filled in as 100% monitored time.
MEASURE
Tie every conclusion to the strength of its evidence source.
Traffic Monitoring explicitly distinguishes authoritative physical-interface evidence, best-effort application previews and an experimental signed provider path. Privacy boundaries and maturity status are part of the evidence, not footnotes.
Evidence Capability Tiers
Three deliberately distinct tiers isolate physical interface measurement, non-privileged process previews, and signed flow-level evidence.
App Activity Preview
Non-privileged process network activity summary
- •Samples local nettop process network summary (~15s intervals)
- •PID resolution to macOS application bundle identifiers
- •Helper process grouping under parent application owners
- •Zero paid developer program or system extension required
- •Separate from exported authoritative evidence
"These applications or processes appear in the current macOS process network summary with these cumulative totals."
Advanced Provider
NEFilterDataProvider system extension prototype
- •Source-application audit-token resolution
- •Local, External, and Unknown flow classification
- •Authenticated Mach/XPC aggregate IPC bridge
- •Byte accounting marked Not Validated
- •Requires Apple system-extension signing entitlements
"The architecture compiles and packages; controlled signed real-Mac evidence is still required before a locality or audit claim."
macOS Privacy & Trust Boundaries
What Stays Protected & Local
- All analytics and evidence remain 100% on-device unless explicitly exported.
- Core analytics do not persist packet payloads, DNS queries, or browsing content.
- App Activity Preview is un-persisted and kept strictly separate from evidence export.
- The Advanced Provider path is opt-in, signed, and independently disableable.
- Restricted permissions and unknown network states are handled as valid explicit conditions.
What Is NOT Claimed Today
- Exact Internet-only usage or carrier-billing parity (LAN/NAS traffic may be included).
- Destination URLs or remote server IP identity in core paths.
- Complete activity history during periods when Traffic Monitoring was closed or asleep.
- Per-app locality or local-only verdicts from App Activity Preview.
- Formal privacy audit or compliance verification today.
Maturity & Capability Status
| Capability | Display Status | Notes & Safeguards |
|---|---|---|
| Physical-interface usage | Implemented | 64-bit Darwin counter tracking across Wi-Fi, hotspot, Ethernet |
| Historical evidence & export | Implemented | 5-minute buckets, coverage tracking, JSON/CSV export |
| App Activity Preview | Beta · Best-effort | Non-privileged nettop process activity summary |
| Application grouping | Best-effort | PID resolution to application bundle & helper process grouping |
| Advanced Provider | Experimental | NEFilterDataProvider prototype passes CI; signed real-Mac validation required |
| Per-app locality & bytes | Not release-validated | No locality verdict until controlled real-Mac reconciliation passes |
| Privacy Audit | Future | Requires validated flow evidence, byte accounting, and assertions |
DECIDE AGAIN
Keep strong claims narrow until stronger evidence is release-validated.
The current decision is to treat physical-interface usage and historical export as authoritative, application activity as best-effort preview, and per-app locality as unresolved until controlled signed real-Mac evidence exists.
CURRENT DECISION
Authoritative where measured. Explicitly uncertain everywhere else.
Core network usage and coverage are implemented from physical-interface evidence. Application activity remains a non-privileged best-effort preview, while per-app locality and byte accounting are not release-validated. The product keeps those evidence tiers separate instead of collapsing them into one confidence level.
- Physical-interface usage and historical evidence are implemented
- Application activity remains Beta / best-effort
- Per-app locality waits for controlled signed real-Mac validation
Understand your network usage. Inspect the evidence behind it.
Explore the implementation, run the ad-hoc development build, or contribute to the signed real-Mac validation path.