Pro plugin

WiFi Known Networks

Collects WiFi known networks, legacy airport preferences, association history, interface configuration, and DHCP leases from macOS

network.wifiPromacOS 10.15+v1.0.0networksystemconnectivity

Run this plugin

Trigger collection for WiFi Known Networks on its own with the --plugin flag, or include it in a wider sweep by category.

# Just this plugin
macfor-pro collect --plugin network.wifi --output ./evidence.zip

# Dry run — list what would be collected
macfor-pro collect --plugin network.wifi --dry-run

Compatibility

macOS 10.15+

Licensing: ships in the macfor-pro binary. See Community vs Pro.

Artifacts (8 collected)

Each row corresponds to an entry in the plugin's artifacts.yaml manifest. Optionalartifacts are often absent, and their absence isn't recorded as an error. Plannedartifacts are documented locations the plugin doesn't collect yet. Where a path shows a version range, macfor only tries it when the source's macOS or application version is in that range.

config

Artifact	Format	Path	Notes
WiFi Known Networks wifi_known_networkshigh value	binary_plist	`/Library/Preferences/com.apple.wifi.known-networks.plist`macOS 11.0+	Available on macOS 11 (Big Sur) and later. Contains SSID, security type, timestamps, auto-join, captive state.
WiFi Legacy Airport Preferences wifi_legacy_networkshigh value	binary_plist	`/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist`	Present on all macOS versions. Contains remembered networks, last connected, security type.
WiFi Global Settings wifi_global_settingsmedium value	binary_plist	`/Library/Preferences/SystemConfiguration/com.apple.wifi.message-tracer.plist`	WiFi diagnostics and global settings. May contain association counts and interface info.
WiFi Network Interfaces wifi_interfacesmedium value	binary_plist	`/Library/Preferences/SystemConfiguration/NetworkInterfaces.plist`	Hardware interface configuration including MAC addresses and interface types.
WiFi DHCP Leases wifi_dhcp_leaseshigh value	binary_plist	`/var/db/dhcpclient/leases/*`	DHCP lease files containing IP addresses, router, DNS, and lease timestamps.

history

Artifact	Format	Path	Notes
WiFi Association Events wifi_associationshigh value	binary_plist	`/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist` +1 more `/Library/Preferences/com.apple.wifi.known-networks.plist`	Extracted from airport preferences and known networks. Tracks when the device joined each network.
WiFi Association Counts wifi_association_countsmedium value	binary_plist	`/Library/Preferences/SystemConfiguration/com.apple.wifi.message-tracer.plist`	Extracted from message tracer. Total join counts per SSID.

cache

Artifact	Format	Path	Notes
WiFi Raw Files wifi_raw_filesOptionalOpt-in	binary_plist	`/Library/Preferences/com.apple.wifi.known-networks.plist` +4 more `/Library/Preferences/SystemConfiguration/com.apple.airport.preferences.plist` `/Library/Preferences/SystemConfiguration/com.apple.wifi.message-tracer.plist` `/Library/Preferences/SystemConfiguration/NetworkInterfaces.plist` `/var/db/dhcpclient/leases/*`	Raw copies of all WiFi-related files for offline or custom analysis.