By Glenn Fleishman
September 8, 2025 8:45 AM PT
Yes, your Mac talks to itself. It’s okay.
Like our vestigial appendix, which can sometimes burst and cause us trouble, the origins of “modern” networking date back so far that weird shapes and forms still guide us under the surface as we conduct our cyberspace 3D adventures. Reader Rick wrote in with a question about networking that relates to this:
I have disconnected my MacBook Pro from all external connections (Ethernet cable unplugged, Wi-Fi and Bluetooth off). But if I look in Activity Monitor > Network, there are lots of packets in and packets out. How is this possible?
Let us shrink ourselves down, Fantastic Voyage-like (or Innerspace, if that’s more your speed), to look at what’s happening at the network interface level and unpick this seemingly unwanted activity.
Tales from the loop
Operating systems derived in some fashion from Unix all have a “loopback” interface as part of their array of network interfaces. This term originated before the Internet, in the context of testing circuits. A loop test literally ensured that a signal would go to the far end of the circuit and return as expected. A failure meant something was wrong.
With the introduction of modems sending signals across phone lines, various loopback tests allowed checking local signals, the line over which data traversed, and the remote modem. As Internet pioneer Jack Haverty wrote in a 2017 post on an Internet Society technical mailing list:
By “looping a line” the NOC [network operations center] operator could determine what was likely to have failed – the modem at either end, the line itself (backhoe attack), or the interface card in the IMPs at either end of the line.1
For networking, a loopback interface lets a device talk to itself. The Unix loopback lets any part of the system, from the lowest level to applications or scripts, communicate via standard Internet networking. Applications may talk to each other this way, for instance, as it’s easier than setting up other kinds of inter-process or inter-application communications.
As with many things, like the digital world starting on January 1, 1970, at 00:00:00 UTC, the loopback interface remains a vestige.2
Because your devices talk to themselves constantly, disabling network interfaces will still make it seem as if your hardware is chatting. But you can drill down to make sure that it’s only being solipsistic.
Decoding network traffic
Using DEVONtechnologies’s free Neo Network Utility3 or from the command line, you can see a list of all current connections:
- Launch Neo Network Utility, click the Netstat button, select “Display the state of all current socket connections,” check Hostname resolution, and click Netstat.
- From the command line, enter
netstat -a -p tcp.
Both methods will take a moment because of the time required to look up all the IP addresses and find their corresponding hostnames (the first part of the name that’s local and the domain name).
You will see way too many results! But it’s good to have a sense of what normal looks like. Among the connections out to the rest of the world, you will see entries like this:
tcp4 0 0 localhost.49330 localhost.64862 ESTABLISHED
That localhost is what you’re looking for. The loopback interface has the IPv4 address of 127.0.0.1 and IPv6 address of 0:0:0:0:0:0:0:1, which shortens to just ::1.4 These are mapped to the local hostname of, literally, localhost. When you see that name, it’s a connection from your Mac back to itself, whether by IPv4 or IPv6.
Now, if you disconnect all your network interfaces, you should only see localhost entries. To turn off your connections, the best way is through these steps:
- Go to System Settings > Network.
- Control-click/right-click each interface marked Connected in turn.
- Choose Make Service Inactive. There’s no prompt—it just happens.
At this point, your network traffic should be shut down. If you re-run netstat above, you would see only localhost or similar loopback address connections.
However, there’s a complicated command-line invocation you can use that’s a bit simpler when you parse the output:
ifconfig | awk '/^[a-z].*: / { iface = $1 } /inet / && iface { print iface, $2 } /^[a-z]/ { iface = $1 }'
Paste the above in and press return, and you get a list of your active network interfaces and the assigned IP addresses. With my setup, including an active VPN via Tailscale, I see:
lo0: 127.0.0.1
en0: 10.0.0.42
en1: 10.0.0.22
utun8: 100.68.251.103
To decipher those, lo0 is the IPv4 loopback address; en0 is “Ethernet 0,” which is actually Ethernet; en1 is the Wi-Fi connection (Wi-Fi pretends to be Ethernet, which is a long story); and utun8 is the tunneling TailScale connection.
After disabling interfaces as described above, you should see just this:
lo0: 127.0.0.1
Your computer is safely murmuring to itself. To enable network interfaces, return to the three steps above and choose Make Service Active.
For further reading
You might be interested in one or more Take Control Books that includes advice on networking, though none is quite as deep a dive as the above: Take Control of Securing Your Apple Devices or Take Control of Wi-Fi Networking and Security. (Securing will be updated soon for the new Apple operating systems, and if you purchase the book today, you will receive the new version at no cost.)
If you want to use command-line tools with great facility, consult Joe Kissell’s Take Control of the Mac Command Line with Terminal.
[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]
- A backhoe attack is when someone is digging and severs phone wiring—local or potentially carrying thousands of calls—back in the days of the primacy of wireline telephone networks. Backhoes remain the enemy of fiber-optic and other cables. ↩
- Unix officially started its clock at that time. That is known as the “epoch.” Typically in a 32-bit signed integer, the epoch will end on 03:14:07 UTC on 19 January 2038. This Y2K38 or “year 2038 problem” needs to be solved. ↩
- A drop-in replacement for Apple’s venerable Network Utility, which was removed from macOS a few years ago. ↩
-
How does this shortening work? In IPv6, which uses eight separated 8-bit numbers (each 0 to 255), any entry between colons that’s zero can be omitted. Multiple sets of leading zeros can be omitted (or “compressed“) as well, leading to just an unambiguous
::1. ↩
[Glenn Fleishman is a printing and comics historian, Jeopardy champion, and serial Kickstarterer. His latest book, which you can pre-order, is Flong Time, No See. Recent books are Six Centuries of Type & Printing and How Comics Are Made.]
