NetFluss changelog
Back to NetFluss20 releases since February 2026 · GitHub releases, checked Oct 26, 2026
2.6Latest
NetFluss 2.6 shows whether a VPN is active right in the menu bar, next to your upload and download rates. It works with the VPN connections built into NetFluss *and* with external VPN clients — Tunnelblick, the WireGuard app, Mullvad, Tailscale, the macOS VPN settings and others. NetFluss detects any active tunnel, no matter which app started it.
- Dot or shield, in a colour of your choice — and you decide whether it stays visible (dimmed) while no VPN is connected.
- Country flag — optionally show the flag of the country your public IP is in, so you see your exit location without opening the popover. It updates within seconds when a VPN connects or disconnects.
- Lightweight — detection only runs while one of the options is on, and needs no extra permissions.
Enable it under Preferences → Appearance.
A new optional popover section that works like the stopwatch on your phone. Press start and NetFluss adds up everything you download and upload from that moment on — handy for checking how much a download, a backup or a video call really moves.
- Start, pause, resume, reset with round buttons, and the elapsed time front and centre.
- Download and upload totals with the average rate for each, plus a download/upload split bar.
- The starting time — and, while paused, when you paused — is shown under the total.
- It keeps counting while the popover is closed and survives a restart (it comes back paused).
Turn it on in Preferences → Appearance, in the popover sections list.
NetFluss now keeps itself up to date. Once a day it checks for a new version and shows you what's new. One click downloads, verifies and installs the update and relaunches NetFluss — or skip it, or get reminded later.
- Check for Updates… is also available any time from the menu bar icon's right-click menu and in About.
- The daily check can be switched off in Preferences → General.
- Every update is verified with an EdDSA signature *and* NetFluss's Apple Developer ID before it is installed.
> Coming from 2.5 or earlier? Download 2.6 once manually — from then on NetFluss updates itself. Homebrew users can keep using brew upgrade --cask netfluss.
- Clearer router connection errors — OPNsense, OpenWRT and UniFi now say exactly what went wrong instead of a generic "cannot reach": HTTPS refused (with the http:// address or port to enter instead), a TLS failure, or a changed router certificate. The OPNsense credential test gains a Trust Current Certificate button.
- Router address fixes — addresses like router.lan:8443 are accepted, and re-trusting a router certificate now works for URL-form addresses (https://host:port) too.
- Complete German, 简体中文 and 繁體中文 translations — every remaining dialog and message, including router, VPN and speed-test errors, is now translated.
2.5
NetFluss 2.5 adds Network Slice, a dedicated live-traffic window. Open it from the menu bar icon's right-click menu.
A rolling Traffic Rate chart sits at the top; below it, three linked columns — Network Hosts, Services, and Apps — each ranked by volume with a relative usage bar. Remote hosts are reverse-resolved to hostnames and tagged with a country flag, so a row reads dns.google 🇺🇸 rather than a bare IP.
Each column carries a ⚡ live / Σ accumulated toggle: ⚡ shows only the most recent sample interval — what is moving *this second* — while Σ shows the running total since you opened the window. Pause freezes everything so you can read a burst without it scrolling away.
Click any row to drill in
A host expands to every connection with it — which app, local and remote port, protocol, service, and per-connection download/upload.
A service — https, imaps, or a bare port number — expands to every host and app using it. Useful for finally answering "what *is* all this HTTPS traffic?"
An app expands to every host it is currently connected to, with the service and port for each.
Built the light way
Network Slice runs on the same lightweight netstat diffing NetFluss already uses elsewhere — no packet capture, no nettop daemon, no extra privileges, no admin prompt. Sampling stops the moment you close the window, so it costs nothing when you are not looking at it.
A new Data Usage section shows how much you have actually moved — without opening a separate window. Upload, Download, and an emphasised Total row, each split across a Today and a This Month column, read from the history NetFluss already collects. It updates live while the popover is open, and a chart button in its header jumps straight to the full Bandwidth Statistics window.
Enable it under Preferences → Statistics (it needs historical statistics collection turned on). Tunnel adapters can be excluded from the figures, and loopback and AirDrop always are — so the totals reflect real internet traffic. Thanks to @truekasun for the original contribution.
A round of fixes for issues reported against the 2.4 VPN client.
- Universal (Intel) VPN binaries are back. The bundled OpenVPN and WireGuard toolchain ships arm64 *and* x86_64 slices again, both targeting macOS 13, so the VPN client works on Intel Macs. The release build now hard-fails if either slice is missing, so this cannot regress silently.
- WireGuard no longer corrupts your DNS. wg-quick's orphan-prone DNS monitor is stopped, private tunnel DNS is routed *through* the tunnel, and NetFluss tracks the real utun interface instead of guessing. Teardown, file permissions, and stale-config cleanup were hardened.
- The real OpenVPN failure reason is surfaced instead of a generic error. A new VPN Diagnostics log (Preferences → VPN) records the bundled tools, their architecture, and the connection tool's full output — copyable in one click for bug reports.
- Helper repair. "Install helper" now fixes a stale registration, and the helper re-registers itself when the app bundle moves.
- Fixed a crash caused by a data race on the process-name cache behind Top Apps.
- Network diagnostics are recorded only while a capture is actually running.
- Failing router monitors back off exponentially instead of retrying in a tight loop.
- Statistics pruning is throttled, and polling suspends on screen sleep/lock.
- Main-thread stalls were taken out of the DNS, VPN, and Preferences paths; the statistics archive loads off the main thread; adapter drag-reordering no longer churns.
- Router monitors use TOFU certificate pinning with session reuse and never silently downgrade to HTTP.
- Keychain items are pinned to this device.
- OpenVPN configs are sanitized before use, and the IKEv2 password is kept out of argv.
- Helper logs are opened with O_NOFOLLOW.
- UniFi: UDR and API-key support. UniFi Dream Router works, and you can authenticate with a Network API key instead of a local admin account — API keys work with 2FA enabled and never expire. Connection errors are more granular.
- More accurate usage totals — loopback and AirDrop are excluded, since they never carry internet traffic.
- Complete German, 简体中文 and 繁體中文 translations for everything above.
Download NetFluss-2.5.zip below, unzip, and move NetFluss.app to /Applications. The app is signed with a Developer ID certificate and notarized by Apple, so Gatekeeper clears it on first launch.
Or via Homebrew:
brew install --cask rana-gmbh/netfluss/netfluss
Requires macOS 13 or later. Universal — Apple Silicon and Intel.
2.4
NetFluss 2.4 is a special release. It's my birthday and I'm happy to deliver a complete new feature for NetFluss: VPN. NetFluss now comes with a lean VPN client. Many VPN providers provide profiles for routers and you are now able to import them to NetFluss, so you are not dependent on the VPN provider client software. NetFluss supports the OpenVPN protocol, WireGuard and IKEv2 / IPsec / L2TP.
- Import provider profiles — a single config file, a folder, or a .zip bundle (e.g. a provider's router profiles). Each config becomes a selectable server.
- OpenVPN (.ovpn) and WireGuard (.conf)
- IKEv2 / IPsec / L2TP via the native macOS VPN stack (username/password / EAP)
- Popover controls — pick a profile and server, connect/disconnect, and see the live status, exit-node country & flag, and public IP.
- Per-VPN DNS — apply one of your DNS presets while connected; your previous DNS is restored automatically on disconnect.
- Auto-reconnect — automatically re-establish a tunnel that drops, with exponential backoff.
- Connect on launch — bring a chosen profile up when NetFluss starts.
- Profile management — import, rename, reorder, and delete profiles in Preferences → VPN. Credentials are stored in the macOS Keychain.
- Much lower energy use — NetFluss's background sampling was reworked, so its energy impact in Activity Monitor drops back to normal menu-bar-app levels.
- Accurate download bandwidth in every scenario — including on macOS 26.5, where the primary adapter's inbound byte counter can be frozen. NetFluss now measures the download rate correctly without the extra CPU cost.
- New "System default" menu bar colour that follows the menu bar appearance automatically, staying legible whether the wallpaper is light or dark. Thanks to @mvanhorn.
🎂 Happy birthday from NetFluss — and thanks for using it!
2.3
Highlights
- Wi-Fi manager in the popover — switch Wi-Fi networks straight from the menu bar without diving into System Settings. Especially handy on travel and in environments with many SSIDs.
- Pin SSIDs to the top of the list. Pinned networks always show up first, in the order you pinned them.
- Temporarily-offline networks stay visible. A pinned SSID that's out of range remains in the list (labelled "Not available") until you unpin it; tapping it re-triggers a targeted scan so you can try to reconnect the moment it comes back.
- Passwords are saved into the macOS Keychain via the privileged helper. Joining a new secured network through NetFluss writes it into macOS's Known Networks list the same way joining from the system Wi-Fi menu does — so the standard macOS Wi-Fi menu (and other apps) will reuse the password later, even when NetFluss isn't running.
- Per-row (i) details showing band, channel, RSSI, security, BSSID.
- Optional "only show the strongest N" cap so the list stays short in crowded environments; pinned and currently-connected networks always show regardless of the cap.
- Reorderable, toggleable popover sections. Preferences → Appearance → "Popover sections" lets you drag the seven segments (Download/Upload, Network adapters, Network flow, DNS, Router, Wi-Fi Networks, Top Apps) into any order, and tick/untick each section right from the same list. The per-row toggles stay in sync with the existing per-section toggles in the DNS, Wi-Fi, Router, and Top Apps panes.
- New Wi-Fi preferences pane + system-access shortcuts. Toggle the Wi-Fi switcher, configure the "strongest N" cap, and find the explanation of how Location access is used. Preferences → General now also has one-click buttons to Grant Location Access and Install Privileged Helper so you never have to hunt for the right pane in System Settings.
Fix for Macs whose Download number stayed at 0.00 (managed-profile Macs, macOS 26.5)
On some Macs — most often Macs running a managed profile or specific NetworkExtension-based security software — macOS 26.5's kernel ifi_ibytes counter is frozen on the active physical Wi-Fi / Ethernet adapter, so NetFluss showed 0.00 download even during heavy downloads. NetFluss now detects that and substitutes a per-process inbound rate from nettop so the menu-bar number, the adapter card, and the Bandwidth Statistics history all record correctly. The fallback subprocess auto-pauses when no real traffic is happening, so unaffected Macs see no extra CPU usage and affected Macs only pay the cost while actually downloading.
Smaller improvements
- Drag-to-reorder rows in Wi-Fi switcher honour the "currently associated BSSID" so the (i) popover always reflects the radio you're actually on, not the strongest BSSID for the same SSID.
- Hidden "Copy Network Diagnostics…" action behind Option + right-click of the menu-bar icon for future investigations.
- 15 s defensive timeout on every privileged-helper XPC call so the DNS switcher (and Wi-Fi credential save) can no longer hang the popover when launchd cached a stale registration; self-heals by re-registering on the retry.
- Localised every new UI string (and a handful of pre-existing ones that had been missed) into German, Simplified Chinese, and Traditional Chinese.
Install
- Download NetFluss-2.3.zip below, unzip, and move NetFluss.app into /Applications. The app is signed with Developer ID and notarized.
- Or via Homebrew: brew install --cask rana-gmbh/netfluss/netfluss.
Requirements
- macOS 13 Ventura or later.
2.2.2
Fixed
- Menu bar font size now actually changes the text size in the *Standard* style (issue #40). Increasing the font size used to only add empty padding to the right of the rates without growing the text — the auto-fit logic was clamping every size back down to the menu bar height. The fix renders at the user's chosen size with tighter line metrics and centers each line, so the slider visibly affects the text and the item width matches what's drawn.
- Reduced horizontal padding around the *Standard* style numbers to save space in the menu bar.
- Standard system selection background is now drawn behind the menu bar item while the popover is open (issue #39), matching the look of right-click and other system menu bar items like Time Machine.
- Bartender compatibility (issue #38): NetFluss could disappear from the menu bar when used with Bartender. The autosave name introduced in 2.2.1 was persisting Bartender's hidden state across launches. The item is now forced visible at startup; Bartender can still hide it during the session if configured to.
Added
- Dashboard (basic) menu bar style — same look as *Dashboard* but without the Σ total prefix and the progress ring, just ↓ download | ↑ upload in a compact pill.
2.2.1
This maintenance release focuses on fixing the DNS switcher regression reported after 2.2.
Fixed
- Fixed DNS preset switching on systems where the active network service could not be identified reliably. NetFluss now applies DNS presets to all enabled macOS network services instead of relying on a single inferred active service, which avoids failures such as "The active network service could not be identified."
- Improved DNS readback so it is less dependent on localized networksetup output.
- Fixed two-line menu bar rate display clipping on some external displays by fitting the stack renderer to the actual status item height.
- Added a stable AppKit autosave name for the menu bar status item so menu bar managers such as Thaw can preserve the item position more reliably.
Notes
- The app remains signed and notarized.
- Homebrew users can update after the tap has been refreshed with this release.
2.2
NetFluss 2.2 focuses on a clearer Preferences experience and the first built-in language options.
Preferences redesign
The Preferences window is now split into clear panes instead of one long scrolling list. Settings are grouped into General, Adapters, Statistics, Appearance, Top Apps, DNS, and Router, making DNS, router monitoring, adapter behavior, and visual options easier to find.
Language support
NetFluss now supports English, German, Simplified Chinese, and Traditional Chinese. By default it follows the macOS system language, and the language can also be changed manually in Preferences > General.
Other changes
- Added OPNsense router bandwidth support and grouped Fritz!Box, UniFi, OpenWRT, and OPNsense settings in the new Router pane.
- Added a None option for IP display when the popover should not show IP address information.
- Improved adapter statistics accounting to avoid inflated totals from invalid interface counter deltas.
- Cleaned up the custom date range controls in the bandwidth statistics window.
- Updated release packaging so localization files are included in the signed app bundle.
Thanks to @oezkanyilmaz for the statistics date range contribution and discussion in #32.
2.1.1
- Fixed inflated Top Downloads and Top Uploads values in the Bandwidth Statistics window.
- Corrected the per-app statistics sampler so historical Top 10 app traffic no longer overcounts background processes such as mDNSResponder or exceeds realistic adapter totals.
- Added an app-statistics schema reset so previously corrupted Top 10 app history is cleared and rebuilt from clean data after installing this version.
2.1
- DNS changes now use a bundled privileged helper instead of an unreliable direct command path.
- The helper uses a one-time macOS approval flow, after which DNS switching and Ethernet resets no longer need repeated password prompts.
- Active network service detection is now based on the real macOS service mapping, which fixes unreliable switching on setups where the service name differs from the hardware port.
- Custom DNS presets now support up to four DNS servers.
- A new pin button turns the menu bar popup into a movable floating window so NetFluss can stay open like a live widget.
- Top Apps in the popup now updates live while the popup or pinned window is open.
- OpenWRT support is now much more robust, including HTTPS-first probing, self-signed certificate handling, better ubus error reporting, and WAN discovery fallback when network.interface.wan is not the active uplink.
- Fritz!Box polling is more resilient to transient request failures and keeps the last good sample visible instead of dropping immediately into an error state.
- Speed test history can now be opened without starting a new test.
- Saved results now support notes, making it easier to remember where a measurement was taken.
- History timestamps are now more compact and locale-aware.
- Fixed app history overcounting in the Top 10 lists.
- Improved Safari and WebKit traffic attribution in app statistics.
- Fixed adapter accounting for high-throughput local transfers such as SMB downloads from a NAS.
- Popup Top Apps sampling is now faster and more responsive.
2.0Big update
NetFluss 2.0 is the biggest update to the app so far, centered on historical bandwidth analysis and built-in speed testing.
NetFluss now includes a dedicated statistics window with 1H, 24H, 7D, 30D, and 1Y ranges, download and upload timelines, top adapters, and top apps. Statistics collection stays optional and is off by default, with separate app-statistics control for users who want deeper analysis.
You can now run a speed test directly from the menu bar icon context menu. NetFluss 2.0 includes integrated M-Lab and Cloudflare providers, detailed results for download, upload, latency, server information, and a dedicated Speed Test window with a remembered provider selector.
Every completed speed test is saved locally, so you can compare results over time by date, provider, download, upload, and latency in the new history view.
- New app icon and matching menu bar icon option, with thanks to GitHub user JohnnyFireOne
- Screen-edge-aware popup positioning improvements
- Better totals handling for VPN and tunnel adapters
- Right-click menu entries for Bandwidth Statistics, Run Speed Test…, Try FileFluss, and project support
- Refined statistics layouts and minute-level detail for the 1H view
1.12.1
- Fixed the popover so it stays fully visible when the menu bar icon is near the left or right screen border.
- Added new total-bandwidth options for VPN and tunnel traffic so you can exclude tunnel adapters from totals without hiding them from the adapter list.
- Unified total-bandwidth filtering so the popover header and menu bar use the same filtered totals logic.
1.12
New customization options
- Added new menu bar icon styles: Standard, Unified pill, Dashboard, and Icon.
- Added separate color controls for upload arrow, download arrow, upload number, and download number.
- Added more icon choices for Icon mode and refined the menu bar layout and spacing options.
- Renamed the app branding to NetFluss in the app bundle, release assets, and README.
Huge improvement in CPU and energy usage
- Greatly reduced CPU usage and Energy Impact in several real-world scenarios, especially after opening and closing the popover.
- Reworked menu bar rendering, popup lifecycle handling, and background sampling so hidden UI and popup-only work are no longer kept alive unnecessarily.
- Stabilized Preferences/About window teardown to avoid UI-related crashes while keeping the lighter runtime behavior.
Update checker
- Added optional automatic GitHub update checks once per day.
- Kept the original manual update check in About.
- New update notifications include a direct link to the newest GitHub release page.
1.11
**UniFi Bandwidth Monitoring *(Experimental)***
- Monitor WAN download/upload rates from UniFi gateways (UDM, USG, UXG)
- Authenticates via the UniFi OS REST API — credentials stored securely in macOS Keychain
- Supports both UniFi OS (UDM) and legacy controller setups
**OpenWRT Bandwidth Monitoring *(Experimental)***
- Monitor WAN download/upload rates from OpenWRT routers
- Uses the ubus JSON-RPC API with automatic session management
- Credentials stored securely in macOS Keychain
Fritz!Box Improvements
- Fritz!Box router address is now auto-detected from the default gateway
Menu Bar Layout Options
- Pinned unit — lock the display to KB/s, MB/s, or GB/s (bits or bytes) instead of auto-scaling
- Decimal places — choose 0, 1, 2, or 3 fixed decimals, or auto
- Black added as a colour option for upload/download labels
- Fixed arrow alignment with proportional fonts (System / Rounded)
Scrollable Popover
- The popover is now scrollable and resizable, supporting smaller screens and many active adapters
Performance & Energy Optimizations
- Throttled expensive operations: interface info cached (~30s), Wi-Fi details (~5s), netstat (~3s), DNS checks (~10s), router polling (~5s)
- Reused system resources (SCDynamicStore) instead of recreating per tick
- Cached PID→name lookups across netstat samples
- Cached menu bar font and moved JSON decode out of SwiftUI render path
- Reduced CPU wake-ups and overall energy impact on battery
1.10
Fritz!Box Bandwidth Monitoring (Experimental)
- Shows the total WAN download/upload rates from your Fritz!Box router directly in the Netfluss popover
- Queries the Fritz!Box via the official TR-064 API (no authentication needed for bandwidth data)
- Progress bars show bandwidth utilization relative to your line speed (DSL/cable/fiber sync rates)
- Configurable router address (default: fritz.box, editable in Preferences)
- Enable in Preferences → Fritz!Box Bandwidth
This function is experimental and I need Fritzbox users to give feedback to me (I currently have no Fritzbox to test it with a real device). Please let me know if you can connect to your Fritzbox correctly and if the bandwidth is measured correctly. Thank you!
Editable Custom DNS Presets
- Custom DNS presets can now be edited after creation (name and server addresses)
- Click the pencil icon next to any custom DNS preset in Preferences → DNS Switcher
Improvements
- Reduced unnecessary UI refreshes from Fritz!Box polling
- Popover closes when opening Preferences for a cleaner workflow
1.9.2
- Touch ID authentication — DNS changes and Ethernet reconnects now use Touch ID when available, instead of the admin password dialog. Falls back to password prompt when Touch ID is unavailable. Configurable in Preferences → DNS Switcher.
- Resizable preferences window — the preferences window is now resizable for smaller screens. Note: the resize cursor may not be visible at the window edges due to a macOS/SwiftUI platform limitation, but dragging the edges works.
1.9.1
Bug Fixes
- External IP now shows IPv4 by default — v1.9 could show an IPv6 address on dual-stack networks. The external IP now reliably defaults to IPv4.
- Reduced API calls — country code lookup (for the VPN flag emoji) is now only performed when the connection flow view is active, cutting unnecessary network requests.
New
- IPv4 / IPv6 preference — choose whether to display your external IPv4 or IPv6 address (Preferences → Appearance → External IP).
1.9
Netfluss has some exciting new features:
1. DNS Switcher
Switch between DNS providers directly from the popover — no more digging through System Settings. Built-in presets for Cloudflare, Google, Quad9, and OpenDNS, plus you can add your own custom DNS presets. One click to switch (prompts for admin password). In Preferences, toggle individual presets on/off and drag to reorder, just like adapters.
2. App Filtering for Top Apps
Hide noisy background processes like mDNSResponder from the Top Apps list. Open Preferences → Top Apps → "Apps to Hide" to see all processes that used bandwidth in the last 60 seconds and hide them with one click. Hidden apps free up slots for the apps you actually care about.
Improvements
- Stable menu bar — the speed display now uses a fixed-width container, so other menu bar icons no longer jump around when rates cross unit boundaries (e.g. 999 KB/s → 1.2 MB/s). The popover also stays anchored in place.
Bug Fixes
- External IP now reliably shows — switched from ipapi.co (which started rate-limiting) to ipwho.is with api.ipify.org as fallback. The external IP and country flag should now appear consistently.
1.8
Connection Flow View
New optional IP address display mode showing your network path visually — from your Mac through the router (and VPN tunnel, if active) to the internet. VPN exit nodes show a country flag. Switch between classic list and flow view in Preferences.
Adapter Grace Period
Adapters can now stay visible for 3, 5, or 10 seconds after going idle, so brief inactivity doesn't cause cards to flicker in and out. Configure in Preferences.
Top Apps Grace Period
Similarly, apps in the Top Apps list can remain visible for 3, 5, or 10 seconds after their traffic stops, keeping the list stable instead of constantly reshuffling.
Wi-Fi Detail Popover
Click the (i) button on any Wi-Fi adapter card to see detailed connection info:
- Standard (Wi-Fi 4/5/6 with 802.11 designation)
- Security (WPA2/WPA3 Personal, Enterprise, OWE, etc.)
- Channel number and width (20/40/80/160 MHz)
- RSSI, Noise, and SNR
- ESSID and BSSID (with copy button)
- Tx Rate
Buy Me a Coffee
Added a support link in the About window — if you enjoy Netfluss, consider buying me a coffee at https://buymeacoffee.com/robertrudolph
1.7.1
Top Apps now works on macOS 15 Sequoia
The Top Apps section was stuck on "Gathering data…" indefinitely on macOS 15. The issue was a difference in how netstat reports process IDs between macOS 15 and later versions — macOS 15 uses a dedicated numeric column while newer versions use a name:pid token. Netfluss now handles both formats automatically.
1.7
Launch at login
A new Launch at login toggle in Preferences → Launch lets Netfluss start automatically when you log in to macOS.
Scrollable adapter list
The popover now caps the adapter area at 6 visible cards and adds a scroll bar when you have more than 6 interfaces active (e.g. multiple VPN tunnels). IP addresses and Top Apps remain always visible below the adapter list.
New app icon
Netfluss has a refreshed icon.
Performance improvements
Internal improvements to reduce CPU overhead during network polling.
*Requires macOS 13 Ventura or later. Universal binary (Apple Silicon + Intel).*