By Glenn Fleishman

September 8, 2025 8:45 AM PT

Report a mistake

Yes, your Mac talks to itself. It’s okay.

Like our vestigial appendix, which can sometimes burst and cause us trouble, the origins of “modern” networking date back so far that weird shapes and forms still guide us under the surface as we conduct our cyberspace 3D adventures. Reader Rick wrote in with a question about networking that relates to this:

I have disconnected my MacBook Pro from all external connections (Ethernet cable unplugged, Wi-Fi and Bluetooth off). But if I look in Activity Monitor > Network, there are lots of packets in and packets out. How is this possible?

Let us shrink ourselves down, Fantastic Voyage-like (or Innerspace, if that’s more your speed), to look at what’s happening at the network interface level and unpick this seemingly unwanted activity.

Tales from the loop

Operating systems derived in some fashion from Unix all have a “loopback” interface as part of their array of network interfaces. This term originated before the Internet, in the context of testing circuits. A loop test literally ensured that a signal would go to the far end of the circuit and return as expected. A failure meant something was wrong.

With the introduction of modems sending signals across phone lines, various loopback tests allowed checking local signals, the line over which data traversed, and the remote modem. As Internet pioneer Jack Haverty wrote in a 2017 post on an Internet Society technical mailing list:

By “looping a line” the NOC [network operations center] operator could determine what was likely to have failed – the modem at either end, the line itself (backhoe attack), or the interface card in the IMPs at either end of the line.¹

For networking, a loopback interface lets a device talk to itself. The Unix loopback lets any part of the system, from the lowest level to applications or scripts, communicate via standard Internet networking. Applications may talk to each other this way, for instance, as it’s easier than setting up other kinds of inter-process or inter-application communications.

As with many things, like the digital world starting on January 1, 1970, at 00:00:00 UTC, the loopback interface remains a vestige.²

Because your devices talk to themselves constantly, disabling network interfaces will still make it seem as if your hardware is chatting. But you can drill down to make sure that it’s only being solipsistic.

Decoding network traffic

Using DEVONtechnologies’s free Neo Network Utility³ or from the command line, you can see a list of all current connections:

• Launch Neo Network Utility, click the Netstat button, select “Display the state of all current socket connections,” check Hostname resolution, and click Netstat.
• From the command line, enter netstat -a -p tcp.

Both methods will take a moment because of the time required to look up all the IP addresses and find their corresponding hostnames (the first part of the name that’s local and the domain name).

You will see way too many results! But it’s good to have a sense of what normal looks like. Among the connections out to the rest of the world, you will see entries like this:

tcp4 0 0 localhost.49330 localhost.64862 ESTABLISHED

That localhost is what you’re looking for. The loopback interface has the IPv4 address of 127.0.0.1 and IPv6 address of 0:0:0:0:0:0:0:1, which shortens to just ::1.⁴ These are mapped to the local hostname of, literally, localhost. When you see that name, it’s a connection from your Mac back to itself, whether by IPv4 or IPv6.

Now, if you disconnect all your network interfaces, you should only see localhost entries. To turn off your connections, the best way is through these steps:

1. Go to System Settings > Network.
2. Control-click/right-click each interface marked Connected in turn.
3. Choose Make Service Inactive. There’s no prompt—it just happens.

At this point, your network traffic should be shut down. If you re-run netstat above, you would see only localhost or similar loopback address connections.

However, there’s a complicated command-line invocation you can use that’s a bit simpler when you parse the output:

ifconfig | awk '/^[a-z].*: / { iface = $1 } /inet / && iface { print iface, $2 } /^[a-z]/ { iface = $1 }'

Paste the above in and press return, and you get a list of your active network interfaces and the assigned IP addresses. With my setup, including an active VPN via Tailscale, I see:

lo0: 127.0.0.1
en0: 10.0.0.42
en1: 10.0.0.22
utun8: 100.68.251.103

To decipher those, lo0 is the IPv4 loopback address; en0 is “Ethernet 0,” which is actually Ethernet; en1 is the Wi-Fi connection (Wi-Fi pretends to be Ethernet, which is a long story); and utun8 is the tunneling TailScale connection.

After disabling interfaces as described above, you should see just this:

lo0: 127.0.0.1

Your computer is safely murmuring to itself. To enable network interfaces, return to the three steps above and choose Make Service Active.

For further reading

You might be interested in one or more Take Control Books that includes advice on networking, though none is quite as deep a dive as the above: Take Control of Securing Your Apple Devices or Take Control of Wi-Fi Networking and Security. (Securing will be updated soon for the new Apple operating systems, and if you purchase the book today, you will receive the new version at no cost.)

If you want to use command-line tools with great facility, consult Joe Kissell’s Take Control of the Mac Command Line with Terminal.

[Got a question for the column? You can email glenn@sixcolors.com or use /glenn in our subscriber-only Discord community.]

[Glenn Fleishman is a printing and comics historian, Jeopardy champion, and serial Kickstarterer. His latest books are Six Centuries of Type & Printing (Aperiodical LLC) and How Comics Are Made (Andrews McMeel Publishing).]

If you appreciate articles like this one, support us by becoming a Six Colors subscriber. Subscribers get access to an exclusive podcast, members-only stories, and a special community.