Determining a Mac's SSID (like an animal)

SSID discovery in macOS 15 Sequoia need not require excessive execution cycles

Background

One of the many under-the-hood changes in macOS 15 Sequoia of which Mac Admins should be aware is how to determine a Mac’s currently assigned Service Set Identifier (SSID), commonly known as the name of the user’s selected Wi-Fi network.

Another, much more impactful under-the-hood change is the ability for MDM to DisableAssociationMACRandomization, for which Fraser Hess has authored a must-read article.

SSID discovery changes in macOS

macOS 13.6.9 through 14.3.1: Three options

✅ airport --getinfo

With macOS 13.6.9 (and most likely earlier) through 14.3.1, Mac Admins could leverage airport to determine a Mac’s SSID.

> sw_vers ; time /System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport --getinfo | /usr/bin/awk '/ SSID/{print $NF}'
ProductName:		macOS
ProductVersion:		13.6.9
BuildVersion:		22G830
Snelson Schloss
 --getinfo  0.00s user 0.01s system 70% cpu 0.015 total
awk '/ SSID/{print $NF}'  0.00s user 0.00s system 25% cpu 0.014 total

> sw_vers ; time /System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport --getinfo | /usr/bin/awk '/ SSID/{print $NF}'
ProductName:		macOS
ProductVersion:		14.3.1
BuildVersion:		23D60
Snelson Schloss
 --getinfo  0.00s user 0.01s system 48% cpu 0.026 total
awk '/ SSID/{print $NF}'  0.00s user 0.00s system 8% cpu 0.026 total

✅ wdutil info

If a Mac Admin preferred, wdutil could be leveraged to determine the SSID with macOS 13.6.9 (and most likely earlier) through 14.3.1.

# sw_vers ; time /usr/bin/wdutil info | /usr/bin/awk '/SSID/ { print $NF }' | head -n 1
ProductName:		macOS
ProductVersion:		13.6.9
BuildVersion:		22G830
Snelson Schloss
/usr/bin/wdutil info  0.01s user 0.01s system 18% cpu 0.123 total
/usr/bin/awk '/SSID/ { print $NF }'  0.00s user 0.00s system 4% cpu 0.122 total
head -n 1  0.00s user 0.00s system 2% cpu 0.122 total

# sw_vers ; time /usr/bin/wdutil info | /usr/bin/awk '/SSID/ { print $NF }' | head -n 1
ProductName:		macOS
ProductVersion:		14.3.1
BuildVersion:		23D60
Snelson Schloss
/usr/bin/wdutil info  0.01s user 0.01s system 10% cpu 0.145 total
/usr/bin/awk '/SSID/ { print $NF }'  0.00s user 0.00s system 2% cpu 0.144 total
head -n 1  0.00s user 0.00s system 1% cpu 0.143 total

✅ networksetup -getairportnetwork

Additionally, Mac Admins could also leverage networksetup with macOS 13.6.9 through 14.3.1.

> sw_vers; time /usr/sbin/networksetup -getairportnetwork en0 | /usr/bin/awk -F ": " '{ print $2 }'
ProductName:		macOS
ProductVersion:		13.6.9
BuildVersion:		22G830
Snelson Schloss
/usr/sbin/networksetup -getairportnetwork en0  0.01s user 0.02s system 66% cpu 0.040 total
/usr/bin/awk -F ": " '{ print $2 }'  0.00s user 0.00s system 9% cpu 0.040 total

> sw_vers; time /usr/sbin/networksetup -getairportnetwork en0 | /usr/bin/awk -F ": " '{ print $2 }'
ProductName:		macOS
ProductVersion:		14.3.1
BuildVersion:		23D60
Snelson Schloss
/usr/sbin/networksetup -getairportnetwork en0  0.01s user 0.02s system 71% cpu 0.033 total
/usr/bin/awk -F ": " '{ print $2 }'  0.00s user 0.00s system 9% cpu 0.032 total

macOS 14.4 and 14.4.1: Two options

❌ airport --getinfo

As Steve Dagley pointed out back in March 2024:

As of macOS Sonoma 14.4 using /System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport --getinfo no longer returns info about the active Wi-Fi connection.

If you want to collect the active SSID for macOS 14.4 or later you can use the wdutil tool

Collecting active SSID with macOS Sonoma 14.4 and later

> sw_vers ; time /System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport --getinfo                                   
ProductName:		macOS
ProductVersion:		14.4
BuildVersion:		23E214
WARNING: The airport command line tool is deprecated and will be removed in a future release.
For diagnosing Wi-Fi related issues, use the Wireless Diagnostics app or wdutil command line tool.
 --getinfo  0.00s user 0.00s system 77% cpu 0.006 total

✅ wdutil info

As referenced by the now deprecated airport binary, in macOS 14.4 and 14.4.1, wdutil could be leveraged to determine a Mac’s SSID.

# sw_vers ; time /usr/bin/wdutil info | /usr/bin/awk '/SSID/ { print $NF }' | head -n 1
ProductName:		macOS
ProductVersion:		14.4
BuildVersion:		23E214
Snelson Schloss
/usr/bin/wdutil info  0.01s user 0.01s system 11% cpu 0.158 total
/usr/bin/awk '/SSID/ { print $NF }'  0.00s user 0.00s system 1% cpu 0.157 total
head -n 1  0.00s user 0.00s system 1% cpu 0.157 total

# sw_vers ; time /usr/bin/wdutil info | /usr/bin/awk '/SSID/ { print $NF }' | head -n 1
ProductName:		macOS
ProductVersion:		14.4.1
BuildVersion:		23E224
Snelson Schloss
/usr/bin/wdutil info  0.01s user 0.01s system 11% cpu 0.153 total
/usr/bin/awk '/SSID/ { print $NF }'  0.00s user 0.00s system 1% cpu 0.152 total
head -n 1  0.00s user 0.00s system 1% cpu 0.152 total

✅ networksetup -getairportnetwork

Thankfully, Mac Admins could still leverage networksetup with macOS 14.4 and 14.4.1.

sw_vers; time /usr/sbin/networksetup -getairportnetwork en0 | /usr/bin/awk -F ": " '{ print $2 }'
ProductName:		macOS
ProductVersion:		14.4
BuildVersion:		23E214
Snelson Schloss
/usr/sbin/networksetup -getairportnetwork en0  0.01s user 0.01s system 71% cpu 0.031 total
/usr/bin/awk -F ": " '{ print $2 }'  0.00s user 0.00s system 7% cpu 0.031 total

> sw_vers; time /usr/sbin/networksetup -getairportnetwork en0 | /usr/bin/awk -F ": " '{ print $2 }'
ProductName:		macOS
ProductVersion:		14.4.1
BuildVersion:		23E224
Snelson Schloss
/usr/sbin/networksetup -getairportnetwork en0  0.01s user 0.01s system 72% cpu 0.031 total
/usr/bin/awk -F ": " '{ print $2 }'  0.00s user 0.00s system 15% cpu 0.031 total

macOS 14.5 through 14.7: One option

❌ airport --getinfo

In macOS 14.5, and continuing through macOS 14.6.1, the airport command-line tool remains deprecated and references wdutil.

> sw_vers ; time /System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport --getinfo                                    
ProductName:		macOS
ProductVersion:		14.5
BuildVersion:		23F79
WARNING: The airport command line tool is deprecated and will be removed in a future release.
For diagnosing Wi-Fi related issues, use the Wireless Diagnostics app or wdutil command line tool.
 --getinfo  0.00s user 0.00s system 78% cpu 0.007 total

> sw_vers ; time /System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport --getinfo                                    
ProductName:		macOS
ProductVersion:		14.7
BuildVersion:		23H124
WARNING: The airport command line tool is deprecated and will be removed in a future release.
For diagnosing Wi-Fi related issues, use the Wireless Diagnostics app or wdutil command line tool.
 --getinfo  0.00s user 0.00s system 43% cpu 0.007 total

❌ wdutil info

However, starting with macOS 14.5, and continuing through macOS 14.6.1, using the airport-referenced wdutil — which required execution as root — resulted in an unexpected <redacted>.

# sw_vers ; time /usr/bin/wdutil info | /usr/bin/awk '/SSID/ { print $NF }' | head -n 1
ProductName:		macOS
ProductVersion:		14.5
BuildVersion:		23F79
<redacted>
/usr/bin/wdutil info  0.01s user 0.01s system 11% cpu 0.158 total
/usr/bin/awk '/SSID/ { print $NF }'  0.00s user 0.00s system 1% cpu 0.157 total
head -n 1  0.00s user 0.00s system 1% cpu 0.157 total

# sw_vers ; time /usr/bin/wdutil info | /usr/bin/awk '/SSID/ { print $NF }' | head -n 1
ProductName:		macOS
ProductVersion:		14.7
BuildVersion:		23H124
<redacted>
/usr/bin/wdutil info  0.01s user 0.00s system 7% cpu 0.170 total
/usr/bin/awk '/SSID/ { print $NF }'  0.00s user 0.00s system 1% cpu 0.170 total
head -n 1  0.00s user 0.00s system 0% cpu 0.169 total

✅ networksetup -getairportnetwork

Luckily, with macOS 14.5 through macOS 14.6.1, Mac Admins can continue to leverage networksetup.

sw_vers; time /usr/sbin/networksetup -getairportnetwork en0 | /usr/bin/awk -F ": " '{ print $2 }'
ProductName:		macOS
ProductVersion:		14.5
BuildVersion:		23F79
Snelson Schloss
/usr/sbin/networksetup -getairportnetwork en0  0.01s user 0.01s system 69% cpu 0.032 total
/usr/bin/awk -F ": " '{ print $2 }'  0.00s user 0.00s system 8% cpu 0.031 total

❯ sw_vers; time /usr/sbin/networksetup -getairportnetwork en0 | /usr/bin/awk -F ": " '{ print $2 }'
ProductName:		macOS
ProductVersion:		14.7
BuildVersion:		23H124
Snelson Schloss
/usr/sbin/networksetup -getairportnetwork en0  0.01s user 0.01s system 48% cpu 0.036 total
/usr/bin/awk -F ": " '{ print $2 }'  0.00s user 0.00s system 7% cpu 0.036 total

macOS 15 Beta 8: One (temporary) option

❌ airport --getinfo

As expected, the airport command-line tool remains deprecated and references wdutil.

> sw_vers ; time /System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport --getinfo                                    
ProductName:		macOS
ProductVersion:		15.0
BuildVersion:		24A5331b
WARNING: The airport command line tool is deprecated and will be removed in a future release.
For diagnosing Wi-Fi related issues, use the Wireless Diagnostics app or wdutil command line tool.
 --getinfo  0.00s user 0.00s system 81% cpu 0.009 total

✅ wdutil info

Somewhat surprising is the return of non-redacted data when leveraging wdutil up through macOS 15 (24A5331b) Beta 8.

sw_vers ; time /usr/bin/wdutil info | /usr/bin/awk '/SSID/ { print $NF }' | head -n 1
ProductName:		macOS
ProductVersion:		15.0
BuildVersion:		24A5331b
Snelson Schloss
/usr/bin/wdutil info  0.01s user 0.01s system 11% cpu 0.165 total
/usr/bin/awk '/SSID/ { print $NF }'  0.00s user 0.00s system 2% cpu 0.165 total
head -n 1  0.00s user 0.00s system 2% cpu 0.164 total

❌ networksetup -getairportnetwork

However, starting with macOS 15 Beta 1, Mac Admins can no longer leverage networksetup to determine a Mac’s SSID.

sw_vers; time /usr/sbin/networksetup -getairportnetwork en0                                      
ProductName:		macOS
ProductVersion:		15.0
BuildVersion:		24A5331b
You are not associated with an AirPort network.
/usr/sbin/networksetup -getairportnetwork en0  0.01s user 0.01s system 68% cpu 0.031 total

macOS 15.0 (24A335) Release Candidate: Zero (?) options

❌ airport --getinfo

Not surprising, the airport command-line tool remains deprecated in macOS 15.0 (24A335) and references wdutil.

> sw_vers ; time /System/Library/PrivateFrameworks/Apple80211.framework/Versions/A/Resources/airport --getinfo                                   
ProductName:		macOS
ProductVersion:		15.0
BuildVersion:		24A335
WARNING: The airport command line tool is deprecated and will be removed in a future release.
For diagnosing Wi-Fi related issues, use the Wireless Diagnostics app or wdutil command line tool.
 --getinfo  0.00s user 0.00s system 45% cpu 0.013 total

❌ wdutil info

Most disappointing — and new to Sequoia’s Release Candidate — is <redacted> when leveraging the “it-worked-for-me-during-the-beta-cycle” wdutil.

Ditto on the arrival of redacted in wdutil info responses for MAC Address, SSID, and BSSID in 15.0 RC1.

It was NOT redacted in Beta 8, so once again Apple fails to document changes that would be impactful for organizations that manage Macs.

And they wonder why some security vendors think testing on pre-release versions of new macOS releases is a waste of time.

— Steve Dagley

> sw_vers ; time /usr/bin/wdutil info | /usr/bin/awk '/SSID/ { print $NF }' | head -n 1
ProductName:		macOS
ProductVersion:		15.0
BuildVersion:		24A335
<redacted>
/usr/bin/wdutil info  0.01s user 0.01s system 5% cpu 0.418 total
/usr/bin/awk '/SSID/ { print $NF }'  0.00s user 0.01s system 1% cpu 0.418 total
head -n 1  0.00s user 0.00s system 0% cpu 0.416 total

❌ networksetup -getairportnetwork

The arguably misleading information returned by networksetup with macOS 15.0 (24A335) isn’t a complete surprise. (While the Mac does have a wireless connection, I guess technically it isn’t an AirPort-flavored network.)

> sw_vers; time /usr/sbin/networksetup -getairportnetwork en0
ProductName:		macOS
ProductVersion:		15.0
BuildVersion:		24A335
You are not associated with an AirPort network.
/usr/sbin/networksetup -getairportnetwork en0  0.01s user 0.02s system 41% cpu 0.068 total

SSID discovery in macOS 15.0 (24A335)

The Code

Hats off to both Pico Mitchell and Trevor Sysock for their work in determining a Mac’s SSID in the brave new Sequoia world.

> sw_vers ; time system_profiler SPAirPortDataType | awk '/Current Network Information:/ { getline; print substr($0, 13, (length($0) - 13)); exit }'
ProductName:		macOS
ProductVersion:		15.0
BuildVersion:		24A335
Snelson Schloss
system_profiler SPAirPortDataType  0.12s user 0.19s system 7% cpu 3.815 total
awk   0.00s user 0.00s system 0% cpu 3.808 total

> sw_vers ; time /usr/libexec/PlistBuddy -c 'Print :0:_items:0:spairport_airport_interfaces:0:spairport_current_network_information:_name' /dev/stdin <<< "$(system_profiler SPAirPortDataType -xml)" 2> /dev/null
ProductName:		macOS
ProductVersion:		15.0
BuildVersion:		24A335
Snelson Schloss
/usr/libexec/PlistBuddy -c  /dev/stdin <<<  2> /dev/null  0.00s user 0.01s system 0% cpu 3.740 total

The Rub

One challenge with the first thankfully working approach is the time-intensive use of system_profiler | awk and I was pleasantly surprised that a seven-year-old post still works as expected.

(That said, you may wish to go with the second PlistBuddy approach and call it good.)

The EA

The following Jamf Pro Extension Attribute leverages Extension Attribute Frequency to only occasionally capture a Mac’s SSID. (After all, with what frequency does an in-office worker change their SSID?)

Time-intensive `system_profiler` command

SSID Extension Attribute

#!/bin/zsh
####################################################################################################
#
# ABOUT
#
#   A Jamf Pro Extension Attribute which determines the current SSID
#
####################################################################################################
#
# HISTORY
#
#   Version 0.0.1, 12-Sep-2024, Dan K. Snelson (@dan-snelson)
#       Original version (thanks, @BigMacAdmin and @Pico!)
#
#   Version 0.0.2, 12-Sep-2024, Dan K. Snelson (@dan-snelson)
#       Leverage Extension Attribute Frequency: https://snelson.us/2017/04/extension-attribute-frequency/
#
#   Version 0.0.3, 13-Sep-2024, Dan K. Snelson (@dan-snelson)
#       Updated to yet another Pico-authored command for SSID
#
####################################################################################################



####################################################################################################
#
# Variables
#
####################################################################################################

scriptVersion="0.0.3"
export PATH=/usr/bin:/bin:/usr/sbin:/sbin:/usr/local/bin/



####################################################################################################
#
# Extension Attribute Frequency
#
####################################################################################################

# Import client-side functions
source /path/to/organizations/client_side/functions.zsh

# Name of Extension Attribute
eaName="SSID"

# Number of days between executions
eaDays="3"



####################################################################################################
#
# Program
#
####################################################################################################

# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #
# Determine SSID (with macOS 15 and earlier)
# # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # # #

# Check for Extension Attribute execution
eaFrequency "${eaName}" "${eaDays}"

if [[ "${eaExecution}" == "Yes" ]]; then
    # result=$( system_profiler SPAirPortDataType | awk '/Current Network Information:/ { getline; print substr($0, 13, (length($0) - 13)); exit }' )
    result=$( /usr/libexec/PlistBuddy -c 'Print :0:_items:0:spairport_airport_interfaces:0:spairport_current_network_information:_name' /dev/stdin <<< "$(system_profiler SPAirPortDataType -xml)" 2> /dev/null )
    eaResult "${eaName}" "${result}"
else
    eaResult "${eaName}"
fi

jssLog "<result>${returnedResult}</result>"

exit 0

Determining a Mac’s SSID (like an animal)

Background

SSID discovery changes in macOS

SSID discovery in macOS 15.0 (24A335)

The Code

The Rub

The EA

Share:

Related Posts

EDR Script Runner (0.0.5)

macOS Forensically Sound* Workstation Lockout with CrowdStrike Falcon and Jamf Pro

BeyondTrust EPM: Flexibilities

Homebrew Version Extension Attribute