Skip to main content
MyIPKit— Your network, explained.

Local network checks

The questions a browser cannot answer, and the exact command to answer each one yourself.

Reference only — nothing on this page runs or transmits anything
Information:

Why this page exists

A website cannot see inside your network, and that is deliberate. The server receives one thing: the public address of your gateway. Your private address, your subnet, your router and the devices on it are never part of an HTTP request, so no amount of code here can reveal them.

What MyIPKit can do is tell you exactly which command answers each question on your own machine, where no browser sandbox applies. That is this page.

Your operating system

Detected automatically from your browser. Change it if the guess is wrong.

Before you run anything

  • Every command on this page is read-only. None changes your configuration.
  • Commands marked as requiring elevated privileges will prompt for your password. Read them before you run them.
  • Only scan or probe networks you own or are authorised to test. This is a legal line in most countries, not a matter of etiquette.
  • Never paste a command from anywhere — including here — that you do not understand. Each entry below states what it does.

Your own addresses

MyIPKit shows the public address the internet sees. These show the private address your device holds inside your own network — the part a website never receives.

  • Your private IPv4 address on the active interface

    ipconfig getifaddr en0

    Expect something in 192.168.x.x, 10.x.x.x or 172.16–31.x.x. On macOS, en0 is usually Wi-Fi and en1 the wired port; try both.

  • Every interface and address, including IPv6

    ifconfig

    Look for inet (IPv4) and inet6 (IPv6) lines. An IPv6 address starting fe80: is link-local and never leaves your network; a global one usually starts with 2 or 3.

  • Whether you have working IPv6 connectivity at all

    curl -6 -s https://api64.ipify.org || echo "no IPv6"

    If this prints an address, your connection has end-to-end IPv6. If it fails, you are IPv4-only — which is still completely normal.

  • Your public address, from the command line

    curl -s https://api.ipify.org

    This should match what MyIPKit shows. A mismatch usually means a VPN, a proxy, or a browser using a different route than curl.

Your network layout

The router, the subnet, and which devices are on it. This is the information people most often expect a website to show, and the information a browser most firmly refuses to expose.

  • Your router (default gateway)

    route -n get default

    The gateway address is your router. Opening it in a browser usually reaches its admin page.

  • The full routing table

    netstat -rn

    Shows which interface traffic to a given destination will leave by. A VPN typically adds a route that captures the default.

  • Your subnet mask, so you know the size of your network

    ipconfig getpacket en0 | grep subnet_mask

    Put the address and mask into the subnet calculator on this site to see the exact usable range.

  • Devices your machine has recently talked to on the local network

    arp -a

    The ARP table lists neighbours seen recently, not every device present. Something idle since you booted will be missing.

  • Which hosts on your network are currently up

    Not installed by default
    nmap -sn 192.168.1.0/24

    nmap is not installed by default. macOS: brew install nmap. Debian/Ubuntu: sudo apt install nmap. Windows: nmap.org.

    A ping sweep, so hosts that ignore ICMP will not appear even though they are online.

    Replace the range with your own — read it from the gateway and mask above. Only scan networks you own or administer. Scanning someone else’s network is, depending on where you live, a criminal offence, and it will be logged.

  • Discover services advertising themselves on the network

    Not installed by default
    dns-sd -B _services._dns-sd._udp local.

    Linux: sudo apt install avahi-utils.

    Printers, speakers, NAS boxes and the like announce themselves over mDNS. This is discovery by consent, not scanning.

The path out

The Network Report on this site measures HTTP latency to the MyIPKit edge and nothing else. These measure the actual route, hop by hop.

  • True ICMP ping — what the browser cannot do

    ping -c 10 1.1.1.1

    Compare with the Network Report on this site. They often differ: many networks deprioritise ICMP relative to ordinary web traffic.

  • Every hop between you and a destination

    Not installed by default
    traceroute 1.1.1.1

    Debian/Ubuntu: sudo apt install traceroute.

    The first hop is your router. Stars mean a hop declined to reply, which is common and not by itself a fault. Look for where latency jumps sharply.

  • Continuous per-hop loss and latency

    Not installed by default
    mtr 1.1.1.1

    macOS: brew install mtr. Debian/Ubuntu: sudo apt install mtr.

    The single best tool for intermittent problems. Loss at one hop that disappears at later hops is that router deprioritising ICMP, not real packet loss.

  • Find the largest packet that fits without fragmenting

    ping -D -s 1472 -c 3 1.1.1.1

    1472 + 28 bytes of header = 1500, the normal ethernet MTU. If it fails but smaller sizes succeed, an MTU problem is likely — a classic cause of “some sites load, others hang” on VPNs and PPPoE links.

DNS from your own machine

The DNS Lookup tool on this site queries a public resolver. These query the resolver your network actually handed you, which is what decides where your traffic really goes.

  • Which resolvers your machine is configured to use

    scutil --dns | grep nameserver

    If these are your router or your ISP, your queries are visible to them. If they are 1.1.1.1 or 8.8.8.8, you have overridden the default.

  • Resolve a name using your own resolver

    dig example.com

    Compare with the DNS Lookup tool here. A difference means your resolver is serving a cached, filtered or overridden answer.

  • Compare your resolver against a public one

    dig example.com @1.1.1.1

    The clearest way to identify DNS-level filtering, captive portals and stale caches.

  • Trace a name from the root servers down

    dig +trace example.com

    Shows the full delegation chain. The right tool when a domain resolves for some people and not others.

  • Empty your local DNS cache

    Needs admin rights
    sudo dscacheutil -flushcache; sudo killall -HUP mDNSResponder

    Run this after changing a DNS record, before concluding that the change did not work.

Ports and connections on this machine

What your own machine is listening on and connected to. Entirely local, and the correct alternative to scanning yourself from the internet.

  • Everything listening for incoming connections

    Needs admin rights
    sudo lsof -nP -iTCP -sTCP:LISTEN

    Anything bound to 0.0.0.0 or :: accepts connections from the network. Bound to 127.0.0.1 it is reachable only from this machine.

  • Current established connections

    netstat -an | grep ESTABLISHED

    Useful for answering “what is this machine actually talking to right now?”.

  • Test whether one specific port on one host is reachable

    nc -vz example.com 443

    Check individual ports on hosts you administer. Sweeping ports across hosts you do not own is what a port scanner does, and it is not something MyIPKit will ever provide.

  • Inspect a TLS certificate as your machine sees it

    openssl s_client -connect example.com:443 -servername example.com < /dev/null 2>/dev/null | openssl x509 -noout -subject -issuer -dates

    Prints the subject, issuer and validity dates. If the issuer is unexpected, something is intercepting the connection — a corporate proxy, or something worse.

Wi-Fi quality

When the problem is between your device and the access point, no internet-side measurement will find it.

  • Signal strength, noise and negotiated rate

    system_profiler SPAirPortDataType | grep -A 10 "Current Network"

    On macOS, RSSI above −60 dBm is strong and below −75 dBm is weak. The gap between signal and noise matters more than signal alone.

  • Which channels the networks around you are using

    system_profiler SPAirPortDataType | grep -i channel

    On 2.4 GHz only channels 1, 6 and 11 do not overlap. Neighbours crowded onto your channel is a common cause of latency that looks like an ISP fault.

Reference only — nothing on this page runs or transmits anything

What a browser will and will not give a website

It is worth being precise about this, because a lot of sites imply otherwise.

What the server genuinely receives

  • The public IP address of your gateway — one address, for the one connection you made.
  • HTTP headers your browser chose to send, such as the User-Agent and language.
  • Approximate geolocation, derived by the edge network from that public address, and only ever approximate.

What it never receives

  • Your private address, your subnet mask or your router’s address.
  • Any list of devices on your network.
  • Your MAC address, your hostname or your ARP table.
  • Which ports are open on your machine or on anything else on your network.

The two old leaks, and why they are closed

WebRTC used to expose private addresses in its ICE candidates. Since 2020, Chrome, Edge, Firefox, Opera and Brave replace them by default with a randomised hostname ending in .local, and Safari does much the same. The address is no longer there to read.

Timing-based scanning — sending requests to private addresses and inferring what exists from how quickly they fail — was the other. Chrome 142 shipped Local Network Access in October 2025, which puts any request from a public site to a private or loopback address behind a permission prompt. Google’s stated reasons include reducing the ability of sites to fingerprint a visitor’s local network.

MyIPKit would not implement either technique even where it still worked. A public site that probes its visitors’ networks is a site that scans the networks of people who never agreed to it, and it earns the reputation that follows.

Why can this website not just show me my local network?

It is not a permission problem — a browser structurally does not hand that information to a website. The server only receives the public address of your NAT gateway; your private address, subnet, router and connected devices are never part of the request. Browsers also replace local addresses in WebRTC with randomised .local hostnames, and since Chrome 142 a public site cannot reach a local IP without an explicit permission prompt, precisely to stop sites fingerprinting your network.

Is it safe to run these commands?

Every command listed here is read-only: none of them changes your configuration. A few need administrator privileges to see all processes, and those are marked. The one genuine caution is the network scan, which you should only ever point at a network you own or administer.

The command output does not match what MyIPKit shows. Which is right?

Both, usually — they are measuring different things. MyIPKit reports the address the internet sees; your machine reports the address it holds locally. Behind NAT those are always different. If your public address differs between curl and this site, the usual cause is a VPN or proxy applying to one and not the other.