Version 1.3.3 (119)

Fewer false alarms

A report is only useful if its warnings are real, and several were not.

• No more false captive portal on ordinary home networks. To check for a hotel-style sign-in page, the app requests a plain web address on Network Weather's own server. When that server started answering by switching the request to a secure address, the app mistook its own redirect for a sign-in page and reported a "Mild" captive portal on every network. One Mac logged 341 of these in an afternoon. A redirect to a different site still counts as a portal.
• A brief Wi-Fi dropout no longer reads as a "Brutal" captive portal. A portal can answer every name lookup with its own address, so the app looks up three unrelated sites and checks whether they all come back the same. During a dropout two of those lookups failed, and the one answer that came back was treated as all of them. A verdict now needs every site to answer, all with the same address.
• Carrier-grade NAT is no longer called double NAT. Providers such as T-Mobile Home Internet and Starlink share one public address among many customers, which gives your router an internet-side address that looked like a second router in the house. The app raised a "Double NAT Detected" warning and advised bridge mode or a DMZ, which nobody at home can set up. That address is now shown as a plain detail beside the WAN IP and in the report's technical details, and a real second router is still flagged.
• No WPA3 suggestion for WPA2 networks. WPA2 with AES is secure enough for a home, but three parts of the report still nudged those networks toward WPA3. Only WPA/TKIP, WEP and open networks are now flagged for their encryption.
• No red DNS error for your router's DNS server while a VPN is on. The app's own test of that server can go into the tunnel, so a missing answer says nothing about the router. It now shows a grey "not measured" mark.
• UniFi sites stop seeing warnings about hardware that is working. Copper 10GBASE-T SFP+ modules are no longer reported as a failing fiber link, a fault on a direct-attach cable says to reseat or replace the cable rather than check a fiber link, and UniFi Protect cameras, which run at 100 Mbps by design, no longer raise "slow port" findings.

Reports that are easier to act on

• Problems to Fix is one list, most severe first. The report used to split its fix cards into "Existing setup", "What changed" and "Outside your home", and "What changed" did not mean changed since your last scan. The sections are gone, and the most severe fix comes first.
• Security findings are labelled Security. WPS, open networks, router audit findings, end-of-life routers and vulnerable firmware all carried a Performance badge. They now carry the Security badge, and routine firmware updates get a new Maintenance badge.
• Recommendations include what you need to finish them. The UniFi DHCP Guard recommendation names the network and gives the address to enter, and transmit-power advice says the setting is per access point, where to find it, which level to choose, and how many access points need the change.
• Cards no longer repeat their title or show an empty advice box, and a Wi-Fi note that gave you nothing to do is no longer a card at all.
• The router's own WAN link rate is labelled as reported by the router, rather than presented as a measured limit on your connection.

Security basics from ASUS and TP-Link routers

When you sign Network Weather in to your router, a deep scan now asks it a short list of security questions and reads the answers from the router's own settings.

• On ASUS routers: whether the admin page can be reached from the internet, whether WPS is on, and whether UPnP is on.
• On TP-Link Archer routers: whether the admin page can be reached from the internet, whether WPS is on, and the encryption of every main, guest and IoT Wi-Fi network, so an open one is flagged.

Each finding says where to change the setting in the router's web interface. A question a router cannot answer yet is shown as not checked, with the reason, never as passed.

Your router is recognized again on macOS 27

macOS 27 stopped showing apps the table that pairs network addresses with hardware addresses, so on macOS 27 the router showed up as unknown, with no maker. Network Weather now reads the router's hardware address from the Mac's own network configuration instead, and says in its log when macOS is holding the table back. Switches and other devices on the network are still unknown on macOS 27.

macOS 27 also hides your Mac's own hardware address behind a placeholder. The Connection card showed that placeholder with Xerox as its maker, and the app kept asking the router about it every few seconds. The placeholder is now treated as unknown everywhere.

Battery health is reported again on macOS 27

macOS 27 moved a battery's capacity figures into a different place in the system's device registry, so Network Weather read nothing there and showed every macOS 27 laptop at 0% battery health. It now reads whichever layout the machine publishes, and macOS 14 through 26 are unchanged. macOS 27 publishes no battery temperature at all, so that field is left empty rather than filled with a substitute.

Weak-signal warnings you can trust

• A bogus reading no longer raises a warning. macOS occasionally reports a Wi-Fi signal of -128 dBm between normal readings. The app took it at face value, which could raise a "Very Weak WiFi Signal" warning and an unneeded Wi-Fi rescan. Readings outside -110 to -1 dBm are now ignored, and a nearby access point reported at an impossible 0 dBm is never suggested as a better one.
• A weak signal is noticed with the window closed. With no window open, the warning could never start. A signal that stays weak for about five minutes now raises it, and a very weak one also sends a notification.
• The warning rests on fresh readings. Stretches with no reading no longer count as weak or as recovered, an old scan value no longer stands in for the live signal, and a warning with no fresh reading for five minutes is withdrawn.
• While the internet is down, a weak signal is flagged after about 30 seconds, as intended, instead of waiting five minutes.

The Radio tab no longer freezes the app

Left open, the Radio tab redrew its entire contents every two seconds, channel map and every neighboring network included, whether or not anything about the air had changed. On a busy band that redraw took longer than macOS allows before it decides an app has stopped responding, so a Radio tab sitting open produced a steady stream of beachballs that got worse the longer it sat there. One Mac in the field recorded 5,887 unresponsive-app events in thirty days, almost all of them on this tab.

The tab now redraws when the scan results themselves change, or when you join or move to a different access point. The "scanned Ns ago" countdown keeps ticking on its own. A related case is fixed with it: a scan that comes back empty while your Mac is not on any network now clears the tab, where before it could leave neighbors and findings on screen that no longer existed.

Router credentials stay on your Mac

Network Weather signs in to your router to read its status, and two log lines written during that exchange carried more than they should have. One recorded a D-Link authentication challenge whose body holds a cookie and a public key; the other recorded TP-Link's session encryption key and initialization vector in plain text. Warning-level log lines are forwarded to us as diagnostics, and the local log file is attached to an in-app feedback report when you tick "include debug logs", so both had a route off your machine.

Both lines now record only what distinguishes one failure from another: which expected fields were readable, and whether a key was present at all. A check in the build rejects any new log line that prints a credential.

Your name stays out of error reports as well. A failing background archive wrote an error naming your home folder (/Users/<your name>/...) on every sample, and that error reached our diagnostics. Anything sent off your Mac, in diagnostics and in crash reports, now shows the home folder as ~; the log on your Mac keeps the full path.

A slow Wi-Fi service no longer holds up the app

Network Weather asks macOS's Wi-Fi service for nearby networks, saved networks and the details of your connection, and some of those calls can take a long time, for example during an active Wi-Fi scan. Several of them ran on threads the rest of the app shares, and their time limits ran on a system thread pool that stops taking new work once enough tasks are stuck, so a slow answer could hold up unrelated work and a check could wait well past its limit.

Those calls now run on their own queues and give up on time. A stuck read of the nearby-network list gives up after 5 seconds, requests that arrive together share one read, and while one refresh is slow the app shows the previous reading after one second. VPN detection no longer stalls for 30 seconds when Tailscale's service stops answering; it gives up after 3 seconds and identifies Tailscale another way.

The router it watches is the one you are connected through

Moving a Mac between Wi-Fi and Ethernet behind the same router left Network Weather reading the previous connection's hardware records, so it reported the hardware address of a router it was no longer talking to. It now follows whichever physical connection carries your traffic, prefers a wired one when both are live, and throws away anything it captured before the switch.

A full-tunnel VPN caused a quieter version of the same problem. Tunnels carry none of the low-level traffic this check depends on, so a router resolved to a tunnel could never actually be observed. Network Weather now looks for the router only on the physical connection, and reports nothing when there is not one to find, rather than reporting something wrong.

Moving between two networks whose routers share an address (both at 192.168.0.1, say) kept the old router's make, model, hardware address and details on screen. The router is now identified again after every network change, and records captured on the previous network can no longer bring the old router's hardware address back.

The share buttons wait until there is something to share

Copying a status report or a network snapshot was offered as soon as your Mac was online, which for about the first measurement cycle after launch is before Network Weather has taken a single reading. Clicking in that window copied nothing and said nothing. The buttons now switch on when a report can actually be produced.

Better crash and hang reports

Crash and hang reports are how problems that never reach a support email get found and fixed, and several things were wrong with them.

• Nothing can silently switch crash reporting off. The app installed an exception handler of its own without chaining to the crash reporter's, so the first time that code ran, an entire class of crash stopped being reported for the rest of the session. That handler is gone, and a check in the build rejects a new one.
• Crashes in the first moments of a launch are reported again. Reporting started on a background task, which delayed the point at which a crash handler existed without moving any work off the main thread. It now starts first thing.
• One unhappy Mac can no longer use up the reporting budget. A single machine sent 5,896 of 8,300 reports in fourteen days. Unresponsive-app reports are now limited to five per hour and twenty per day per run of the app; crash reports are never dropped.
• A report says what the network was doing. Reports from a network product used to name the macOS version and the Mac model and nothing else. Each now carries the link type, whether a VPN was carrying traffic, the gateway's vendor and model, the recent warning-level log lines, and a link to that machine's own diagnostic history.
• Hangs are grouped by the screen they happened on, so a Radio hang and a Settings hang are separate problems rather than one unresolvable pile.

Updating no longer asks whether you want to quit

Sparkle, the framework that installs Network Weather's updates, ends the running app with the same kind of quit event that Cmd+Q sends. The app could not tell the two apart, so every update raised a "Quit Network Weather?" confirmation and then waited for you to click it before the install continued. The app now recognizes the quit belonging to an update it is already installing and gets out of the way.

Smaller fixes

• The Gateway detail has a new "Slowest (5 min)" row: the slowest reply from your router in the last five minutes, so short, repeating bursts of delay, the kind that ruin video calls, stay visible. It is for information only and changes no status or finding.
• With "Open UI at launch" off, the app really starts as just the menu-bar icon. Windows left open when it last quit, crashed or was stopped are no longer restored, and opening the app from Finder or the Dock brings its window up.
• A scan report stays open when you switch tabs and come back.
• The Status tab says when notifications for Network Weather are turned off in System Settings, with a link to the right settings page.
• The UniFi integration recovers on its next refresh after a single controller error, instead of stopping until the app is relaunched.
• A deep scan signs back in to your router once when the router's session has expired, instead of asking you to re-enter a password that was fine. If that sign-in fails, the checks name the real obstacle.
• D-Link routers report their internet-side address and connected devices, so a D-Link behind another router is reported as double NAT, and a D-Link sign-in that errors is retried instead of being treated as a wrong password.
• Your internet provider shows under the name on your bill today: Suddenlink customers see Optimum; RCN, Grande and Wave Broadband customers see Astound Broadband; US Cellular customers see T-Mobile. Provider names are matched as whole words, so "Hosting" no longer shows Ting and "Wilcox" no longer shows Cox.
• Full-tunnel VPNs whose default route points straight at the tunnel, such as Tailscale exit nodes, WireGuard and OpenVPN, are recognized as full tunnel, and Tailscale is reported only for Tailscale's own addresses.
• Wired Ethernet error counters are read from the right place. They were always empty before; they are compared between samples, so a lifetime count raises nothing.
• A Wi-Fi network switch no longer puts you back on a network you left on purpose while it checked the new one.
• Third-party USB-C chargers that report no name show the description they do report, and UniFi Cloud Gateways, switches and access points show product names ("Flex Mini", "Switch Ultra") instead of codes such as "UCGMAX".
• VoiceOver reads the right report card after you page through the fix cards.
• In configuration profiles for managed Macs, neverAsksForAdminLogin now works, and c2BaseURL sets the C2 server URL.
• The startup line in the log shows the real version and build instead of "1.0.0".
• Traces share one copy of the bundled address-to-network database instead of loading a fresh one for every tracer the app builds.
• The traceroute library can now cancel traces without clearing its lookup caches; Network Weather does not use those controls yet.
• The updater framework moves to Sparkle 2.10.0.
• Network Weather now records how it was installed (a browser download, Homebrew, an in-app update, or another command-line install) once at install time, so we can tell which channels bring people to the product. The record holds no username and no file path. What is collected, and how to opt out of the advertising measurement it feeds, is described in the privacy policy.