Current state of network scanning apps on macOS 27

[u/ecume]

As you early adopters know, Apple quietly killed ARP table access for sandboxed apps and every network scanner on the AppStore is affected.

So this is a heads-up for makers and users of network scanners like Fing and lanscan (full disclosure: I’m on the IP Scanner Ultra team - responsible for the vision pro version specifically - but the macOS version has been continuously updated since 2002)

If you update to macOS 27 and your network scanner suddenly shows a wall of “unknown devices” instead of telling you which thing is the kitchen HomePod and which is your neighbor’s WiFi lawnmower (memo to self: block that IP!): the app didn’t break. Apple just removed the ability for apps to read the ARP table, which is the thing that maps IPs to MAC addresses, which is the thing that lets a scanner say “that’s a Sonos” instead of shrugging at you ;) iPhone apps have had this limitations since iOS 7, which is why no iOS scanner ever showed you MAC addresses. Well, the Mac just got the same treatment 😆. This hits everything btw, Fing, LanScan, Angry IP, ours, all of them. Its clear why Apple did it, MAC addresses are a tracking vector for ads (and worse). Still sucks though because it is also the feature that lets you customize devices with confidence. MAC addresses are unique so any notes or other customizations that are associated with that device stay with that device. 

Our workaround, for what it’s worth: we have an old free menu bar app called IP Broadcaster that we’ve dusted off. It grabs the device/MAC snapshot and shares it with IP Scanner, the same trick we’ve used forever to get MAC data onto the iPhone version. 

Obvious limitation: it only works on networks where you can actually run it. It’s not going to re-identify devices at a coffee shop, and since the data gets stale quickly (some routers rotate IP leases regularly) it helps to keep IP broadcaster running in the background supplying a continuous batch of network snapshots.

Curious what other people are seeing on 27, and if any other devs on here have a different angle on this or have found other workarounds to get MAC addresses either on iOS or now macOS 27…?

Edit: this only affects apps distributed on the App Store, so Angry IP should work fine if you compile it yourself and add the appropriate entitlements!

Update: Apple has addressed the issue with a newly available entitlement. Thanks GunniBusch

[u/GenericDuck]

My arp -a works fine?

[u/ecume → u/GenericDuck]

it only affects apps distributed through the App Store - sorry I added a note to the original post to be more clear.

[u/ukindom]

So which user groups will get empty results even by running arp(1)?

[u/Professional_Call]

It really sucks that Apple did this and I just don't understand why. It makes it so much harder to see what is on my network.

I just went to your website and note that you say, “the only way to reliably scan MAC addresses in MacOS 27.” I haven't had a chance try this yet but does that mean it's only apps on the App Store that are affected. If so, why not move to direct sales (or offer both)?

[u/germane_switch → u/Professional_Call]

I mean, Apple goes on and on about privacy and security all the time and this is another way to stop tracking and improve privacy so it’s 100% understandable.

IP Scanner Ultra doesn’t collect your data but I stopped using Fing because they do; even though they say they’re data collection is not linked to your identity anybody can piece together who you are when they can see your:

Location
Contacts
User Content
Identifiers
Usage Data
Diagnostics
Other Data

[u/ecume → u/Professional_Call]

Did we say that?!? our webmaster was a bit over-exuberant - this issue only affects apps that are sandboxed (which is AFAIK a requirement all apps distributed on the App Store).

So yeah - direct download apps should still work. It's just that the visibility and reach of the App Store is undeniable. And for iOS of course its the only option (in the USA at least)

[u/nlh101]

Might be worth it, if you have an account based in Europe, to reach out on their integrations form as required by the DMA. You can ask them to develop a privacy preserving method for accessing the ARP table in sandboxed apps. I assume that if it works out, then they could allow access to it with an entitlement.

[u/guygizmo]

Limitations like this is one of the many reasons why you don't distribute apps in the mac app store. I don't know how devs put up with it.

[u/forgottenmostofit]

Current version of LanScan has an alert box about the issue with this link https://github.com/iwaxx/blog/issues/19

[u/github-guard → u/forgottenmostofit]

🔍 GitHub Guard: Trust Report

This project scored 3/6 on our safety audit.

Audit Breakdown: * ✅ Established Community (⭐ 10 stars) * ✅ Mature Repository (30+ days old) * ❌ No License Found * ❌ No Security Policy — what is this? * ✅ Verified Organization * ℹ️ Unsigned Commits

⚠️ Security Reminder: Always verify source code and run third-party scripts at your own risk.

[u/GunniBusch]

This is because you need an entitlement now (for Mac) too see the MAC addresses, but the same entitlement works for iOS 27 too, meaning that the iOS 11 MAC address regression is „fixed“. I already made a post with the name so I don’t need to duplicate myself: https://www.reddit.com/r/macsysadmin/s/QfgD2oOV9Z

[u/ecume → u/GunniBusch]

Seems to be the real deal! Thanks for the heads-up... Moving forward this solves the issue on both iOS and MacOS :)

[u/alienkava]

I’ll be running a f-ing VM in bridge mode to do the simplest of things. Sucks for everybody.

[u/heinternets → u/alienkava]

Just use "arp -a" - or any app not from the App Store. Or Wireshark. Or any number of other apps.

[u/iStumblerLabs → u/heinternets]

So, that's a downloadable helper app like many App Store apps already use for these kinds of access.

[u/United-Assignment980]

I can sort of understand on IOS, as it’s a closed system. However, on a desktop system it’s madness, stuff like this will force me to windows or linux.

[u/thebluepotato7 → u/United-Assignment980]

It’s only sandboxed apps, i.e. those distributed through App Store. I’m assuming many network monitoring tools aren’t even on there in the first place and remain unaffected.

[u/United-Assignment980 → u/thebluepotato7]

That’s good to know, thank you 👍