Posts
Knowing which wireless networks a Mac has been connected to in the past be can be helpful for a variety of reasons, including network troubleshooting, determining where a Mac has been, if a specific wifi password is recoverable, and a myriad of other technical reasons. Searching for past networks is completely different from finding currently available networks, and you won't recover historical data from the menu bar item or otherwise excellent OS X wi-fi scanner tool. We'll cover two simple ways to find this information, the first is the easy route through System Preferences, and the second approach uses a lengthy command line string to read the wireless networks from a plist file.
Keep in mind these lists aren't completely infallible and shouldn't be considered forensic by any stretch, someone can manually add and remove entries from the preferred and remembered networks lists if they wanted to. Nonetheless, for the average use case troubleshooting scenario they should be adequate.
Seeing Which Wi-Fi Networks a Mac has Connected To Before
If you've tweaked your preferred networks before, you'll be familiar with this list:
- Open System Preferences from the Apple menu and choose "Network"
- Click the "Advanced" button and choose the "Wi-Fi" tab
- Look under the "Preferred Networks" list to find the list of previously connected wireless networks, it is scrollable
The UI approach is easy, but the same information can be retrieved from the command line as well.
List Previously Used Wi-Fi Networks from the Command Line
A wireless network history list can be retrieved by command line through the use of this lengthy string, be sure it is entered onto a single line:
defaults read /Library/Preferences/SystemConfiguration/com.apple.airport.preferences RememberedNetworks | egrep -o '(SSID_STR|_timeStamp).+' | sed 's/^.*= \(.*\);$/\1/' | sed 's/^"\(.*\)"$/\1/' | sed 's/\([0-9]\{4\}-..-..\).*/\1/'
You will see something like so as the output, with only the SSID of routers listed:
This-Router
linksys
CoffeeHouse
RouterFromDubiousLocationThatMacShouldntHaveBeenAt
Starbucks Cupertino
Ancient_Router_from_2007
The long command comes from CoderWall and though it may look strange, it's required to get clean output. Entering the string without grep and sed will provide you with far more information than you are looking for in this case, as it it dumps out everything pertaining to past wi-fi connections that have become part of the "RememberedNetworks" list.
