NetFluss

Earlier

• 2.5Jul 31, 2026NetFluss 2.5 adds Network Slice, a dedicated live-traffic window. Open it from the menu bar icon's right-click menu.

  NetFluss 2.5 adds Network Slice, a dedicated live-traffic window. Open it from the menu bar icon's right-click menu.

  A rolling Traffic Rate chart sits at the top; below it, three linked columns — Network Hosts, Services, and Apps — each ranked by volume with a relative usage bar. Remote hosts are reverse-resolved to hostnames and tagged with a country flag, so a row reads dns.google 🇺🇸 rather than a bare IP.

  Each column carries a ⚡ live / Σ accumulated toggle: ⚡ shows only the most recent sample interval — what is moving *this second* — while Σ shows the running total since you opened the window. Pause freezes everything so you can read a burst without it scrolling away.

  Click any row to drill in

  A host expands to every connection with it — which app, local and remote port, protocol, service, and per-connection download/upload.

  A service — https, imaps, or a bare port number — expands to every host and app using it. Useful for finally answering "what *is* all this HTTPS traffic?"

  An app expands to every host it is currently connected to, with the service and port for each.

  Built the light way

  Network Slice runs on the same lightweight netstat diffing NetFluss already uses elsewhere — no packet capture, no nettop daemon, no extra privileges, no admin prompt. Sampling stops the moment you close the window, so it costs nothing when you are not looking at it.

  A new Data Usage section shows how much you have actually moved — without opening a separate window. Upload, Download, and an emphasised Total row, each split across a Today and a This Month column, read from the history NetFluss already collects. It updates live while the popover is open, and a chart button in its header jumps straight to the full Bandwidth Statistics window.

  Enable it under Preferences → Statistics (it needs historical statistics collection turned on). Tunnel adapters can be excluded from the figures, and loopback and AirDrop always are — so the totals reflect real internet traffic. Thanks to @truekasun for the original contribution.

  A round of fixes for issues reported against the 2.4 VPN client.

  • Universal (Intel) VPN binaries are back. The bundled OpenVPN and WireGuard toolchain ships arm64 *and* x86_64 slices again, both targeting macOS 13, so the VPN client works on Intel Macs. The release build now hard-fails if either slice is missing, so this cannot regress silently.
  • WireGuard no longer corrupts your DNS. wg-quick's orphan-prone DNS monitor is stopped, private tunnel DNS is routed *through* the tunnel, and NetFluss tracks the real utun interface instead of guessing. Teardown, file permissions, and stale-config cleanup were hardened.
  • The real OpenVPN failure reason is surfaced instead of a generic error. A new VPN Diagnostics log (Preferences → VPN) records the bundled tools, their architecture, and the connection tool's full output — copyable in one click for bug reports.
  • Helper repair. "Install helper" now fixes a stale registration, and the helper re-registers itself when the app bundle moves.
  • Fixed a crash caused by a data race on the process-name cache behind Top Apps.
  • Network diagnostics are recorded only while a capture is actually running.
  • Failing router monitors back off exponentially instead of retrying in a tight loop.
  • Statistics pruning is throttled, and polling suspends on screen sleep/lock.
  • Main-thread stalls were taken out of the DNS, VPN, and Preferences paths; the statistics archive loads off the main thread; adapter drag-reordering no longer churns.
  • Router monitors use TOFU certificate pinning with session reuse and never silently downgrade to HTTP.
  • Keychain items are pinned to this device.
  • OpenVPN configs are sanitized before use, and the IKEv2 password is kept out of argv.
  • Helper logs are opened with O_NOFOLLOW.
  • UniFi: UDR and API-key support. UniFi Dream Router works, and you can authenticate with a Network API key instead of a local admin account — API keys work with 2FA enabled and never expire. Connection errors are more granular.
  • More accurate usage totals — loopback and AirDrop are excluded, since they never carry internet traffic.
  • Complete German, 简体中文 and 繁體中文 translations for everything above.

  Download NetFluss-2.5.zip below, unzip, and move NetFluss.app to /Applications. The app is signed with a Developer ID certificate and notarized by Apple, so Gatekeeper clears it on first launch.

  Or via Homebrew:

  brew install --cask rana-gmbh/netfluss/netfluss

  Requires macOS 13 or later. Universal — Apple Silicon and Intel.

• 2.4Jun 26, 2026NetFluss 2.4 is a special release. It's my birthday and I'm happy to deliver a complete new feature for NetFluss: VPN. NetFluss now comes with a lean VPN client. Many VPN providers provide profiles for routers and you are now able to import them to NetFluss, so you are not dependent on the VPN provider client software. NetFluss supports the OpenVPN protocol, WireGuard and IKEv2 / IPsec / L2TP.

  NetFluss 2.4 is a special release. It's my birthday and I'm happy to deliver a complete new feature for NetFluss: VPN. NetFluss now comes with a lean VPN client. Many VPN providers provide profiles for routers and you are now able to import them to NetFluss, so you are not dependent on the VPN provider client software. NetFluss supports the OpenVPN protocol, WireGuard and IKEv2 / IPsec / L2TP.

  • Import provider profiles — a single config file, a folder, or a .zip bundle (e.g. a provider's router profiles). Each config becomes a selectable server.
  • OpenVPN (.ovpn) and WireGuard (.conf)
  • IKEv2 / IPsec / L2TP via the native macOS VPN stack (username/password / EAP)
  • Popover controls — pick a profile and server, connect/disconnect, and see the live status, exit-node country & flag, and public IP.
  • Per-VPN DNS — apply one of your DNS presets while connected; your previous DNS is restored automatically on disconnect.
  • Auto-reconnect — automatically re-establish a tunnel that drops, with exponential backoff.
  • Connect on launch — bring a chosen profile up when NetFluss starts.
  • Profile management — import, rename, reorder, and delete profiles in Preferences → VPN. Credentials are stored in the macOS Keychain.
  • Much lower energy use — NetFluss's background sampling was reworked, so its energy impact in Activity Monitor drops back to normal menu-bar-app levels.
  • Accurate download bandwidth in every scenario — including on macOS 26.5, where the primary adapter's inbound byte counter can be frozen. NetFluss now measures the download rate correctly without the extra CPU cost.
  • New "System default" menu bar colour that follows the menu bar appearance automatically, staying legible whether the wallpaper is light or dark. Thanks to @mvanhorn.

  🎂 Happy birthday from NetFluss — and thanks for using it!

• 2.3May 22, 2026Wi-Fi manager in the popover — switch Wi-Fi networks straight from the menu bar without diving into System Settings. Especially handy on travel and in environments with many SSIDs.

  Highlights

  • Wi-Fi manager in the popover — switch Wi-Fi networks straight from the menu bar without diving into System Settings. Especially handy on travel and in environments with many SSIDs.
  • Pin SSIDs to the top of the list. Pinned networks always show up first, in the order you pinned them.
  • Temporarily-offline networks stay visible. A pinned SSID that's out of range remains in the list (labelled "Not available") until you unpin it; tapping it re-triggers a targeted scan so you can try to reconnect the moment it comes back.
  • Passwords are saved into the macOS Keychain via the privileged helper. Joining a new secured network through NetFluss writes it into macOS's Known Networks list the same way joining from the system Wi-Fi menu does — so the standard macOS Wi-Fi menu (and other apps) will reuse the password later, even when NetFluss isn't running.
  • Per-row (i) details showing band, channel, RSSI, security, BSSID.
  • Optional "only show the strongest N" cap so the list stays short in crowded environments; pinned and currently-connected networks always show regardless of the cap.
  • Reorderable, toggleable popover sections. Preferences → Appearance → "Popover sections" lets you drag the seven segments (Download/Upload, Network adapters, Network flow, DNS, Router, Wi-Fi Networks, Top Apps) into any order, and tick/untick each section right from the same list. The per-row toggles stay in sync with the existing per-section toggles in the DNS, Wi-Fi, Router, and Top Apps panes.
  • New Wi-Fi preferences pane + system-access shortcuts. Toggle the Wi-Fi switcher, configure the "strongest N" cap, and find the explanation of how Location access is used. Preferences → General now also has one-click buttons to Grant Location Access and Install Privileged Helper so you never have to hunt for the right pane in System Settings.

  Fix for Macs whose Download number stayed at 0.00 (managed-profile Macs, macOS 26.5)

  On some Macs — most often Macs running a managed profile or specific NetworkExtension-based security software — macOS 26.5's kernel ifi_ibytes counter is frozen on the active physical Wi-Fi / Ethernet adapter, so NetFluss showed 0.00 download even during heavy downloads. NetFluss now detects that and substitutes a per-process inbound rate from nettop so the menu-bar number, the adapter card, and the Bandwidth Statistics history all record correctly. The fallback subprocess auto-pauses when no real traffic is happening, so unaffected Macs see no extra CPU usage and affected Macs only pay the cost while actually downloading.

  Smaller improvements

  • Drag-to-reorder rows in Wi-Fi switcher honour the "currently associated BSSID" so the (i) popover always reflects the radio you're actually on, not the strongest BSSID for the same SSID.
  • Hidden "Copy Network Diagnostics…" action behind Option + right-click of the menu-bar icon for future investigations.
  • 15 s defensive timeout on every privileged-helper XPC call so the DNS switcher (and Wi-Fi credential save) can no longer hang the popover when launchd cached a stale registration; self-heals by re-registering on the retry.
  • Localised every new UI string (and a handful of pre-existing ones that had been missed) into German, Simplified Chinese, and Traditional Chinese.

  Install

  • Download NetFluss-2.3.zip below, unzip, and move NetFluss.app into /Applications. The app is signed with Developer ID and notarized.
  • Or via Homebrew: brew install --cask rana-gmbh/netfluss/netfluss.

  Requirements

  • macOS 13 Ventura or later.