WiFi Known Networks
WiFi connection history including known networks, BSSID geolocation data, DHCP leases, and network interface configuration.
- Status
- available
- CLI plugin
- network.wifi
- Categories
- network, system
Overview
WiFi artifacts provide critical geolocation and network connection evidence. The collector captures known network history with connection timestamps, BSSID-level GPS coordinates, DHCP lease records, and network interface details. On macOS 11+, the primary source is known-networks.plist; on earlier versions, airport.preferences.plist contains the full network history.
Analysis Tips
- Geolocation: BSSID entries in
known-networks.plistinclude GPS latitude, longitude, and accuracy — enabling physical location tracking - Connection timeline:
AddedAt,JoinedByUserAt,JoinedBySystemAt, andLastDiscoveredAttimestamps reconstruct network connection history - Private MAC: macOS 14+ records
PrivateMACAddressModeUserSettingper network - DHCP leases: Lease files reveal IP assignments, DNS servers, and routers used
- Version detection: Presence of
known-networks.plistindicates macOS 11+; absence indicates legacy mode - System-level paths: All WiFi artifacts are in
/Library/(not per-user), requiring root access on live systems
Related Artifacts
- Pattern of Life - KnowledgeC records network change events
- Unified Logs - WiFi subsystem logs connection events
References
Data sources
/Library/Preferences/
Per-SSID entries with timestamps, BSSIDs, and GPS coordinates (macOS 11+)
/Library/Preferences/SystemConfiguration/
Legacy network history and global WiFi settings
/Library/Preferences/SystemConfiguration/
Per-association telemetry: channel, RSSI, noise, AP OUI
/Library/Preferences/SystemConfiguration/
WiFi hardware identification and MAC addresses
/var/db/dhcpclient/leases/
DHCP lease records with IP assignments and DNS servers