Recently, two articles appeared on TechRadar documenting various command line tweaks for various apps and functions of Mac OS X. While I didn’t find anything new there, it’s nice to have two articles that summarize a bunch instead of tracking them down one by one across countless bookmarks.

To be honest, most command line tweaks don’t appeal to me. For example, I’d sooner go back to running DOS than go back to using Safari’s “standard” tabs; I love the tabs on top. Still, it’s nice to know I could make the change if I felt so inclined.

What’s surprising to me is that some of the tweaks I do like are incredibly simple — for example, the command that turns on stack highlighting even when using the mouse (No. eight in the first article above). Obviously, having the cursor over an item tells me which one will be activated if I click, and yet I like the highlight as a further indicator.

I also like the one to remove the arrows from iTunes’ interface (No. seven in the second article). Again, this is a little thing, yet I value it in a manner that’s completely out of proportion to the actual change it makes. Put simply, I hate those arrows.

Meanwhile, there’s a tweak for Safari I really like that’s not in either article. It’s one that forces a click to open in a new tab (instead of a window). You can find that one here. Though documented for Safari 3.1, I use it for the Safari 4 beta with no issues.

I’m curious what you think. Which tweaks do you really like? Do you have any to add, and do they seem like major or minor changes to you?

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Why iPad 2 Will Lead Consumers Into the Post-PC Era
• The Near-Term Evolution of Social Commerce
• Content Farms: The Players, The Benefits, The Risks

I turned to Ecamm’s PhoneView program as it has been much Twittered about lately and is from the makers of the most excellent Call Recorder software (highly useful for Skype interviews). Along with providing access to SMS history (which is what I really wanted) it also claims to provide easy access to your iTunes media, photos, notes, call history and contacts, including the ability to drag and drop each file from the iPhone to your desktop.

After downloading the trial version, just plug in your iPhone and it will automagically recognize the device and load up the data from it:

While I will not be showing the SMS retrieval portion (it would pretty much be a gigantic redacted block), the notes feature,

call history feature (with export to tab-delimited file capability),

and disk view mode make it a very handy tool.

This is one app where I highly recommend tweaking the default preferences since it will come up each time you connect your iPhone if you do not disable that ability.

I was all set to purchase PhoneView, but kept having shopping cart issues and really wanted to get the SMS bits off of it prior to both clearing the SMS databases and installing iPhone OS 2.0.2, so I turned to a less interactive solution that requires a bit of command-line-fu.

First, grab unravel, a small Perl script which you will use to rifle through your iPhone backup files (which are liberally generated these days). Then, using the Finder’s “Go to Folder…” option (via the “Go” menu), enter: ~/Library/Application Support/MobileSync/Backup

Each of the weirdly named directories contains various backups of your iPhone data. Copy the Perl script to the most recently modified folder. Now, you will need the full path of that folder to continue and I suggest using either the Finder toolbar or keyboard-shortcut version of Open Terminal Here to make your life much easier. Either manually, or via “Open Terminal Here”, fire up Terminal.app, change directories and run the Perl script (yours may be named unravel.perl.pl or unravel.perl depending on how you or your browser saved it).

You can browse the results by going to ~/iPhone/Backup in the Finder. The SMS database is in ~/iPhone/Backup/Library/SMS and I recommend grabbing the open source SQLite Database Browser to look at and export any of the SQLite databases.

If you can get through Ecamm’s shopping cart, the $19.95USD is a pretty good deal as it gives you a decent interface and free upgrades for life. If you just need to grab information once in a while or have some casual interest in what can be pulled from the iPhone backup files, then unravel may be a good option for you.

What extra tools do you use to manage your iPhone data? If you’ve used unravel or PhoneView, sound off in the comments!

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Mobile Q4: All Eyes Were on Android, 4G and the Rising Tablet Tide
• Report: A Mobile Video Market Overview
• In Q3, the Tablet and 4G Were the Big Stories

Give that command a minute to run and prepare to be overwhelmed with information in a cryptic, textual, tabular format. The command, used in that way, is actually pretty useless (from an interactive standpoint). Its true power becomes unleashed with the proper command-line options, execution privileges and when grouped with some other command-line-fu. After the small primer in this post, you should be well equipped to figure out what applications are talking on the network, what files your applications have open and what is keeping your volumes from being able to be ejected.

Before we begin, it may be a bit confusing when a utility that claims to list open files can provide information on network traffic. You have to remember that in OS X (UNIX-like systems in general) an open file may be a regular file, a directory, a block special (enables communication with device drivers) file, a character special (facilitates communication with a device one character at a time) file, a library, a stream or a network file (i.e. a network connection).

The examples in this post also make heavy use of CLIX (Command Line Interface for OS *X*). As you’ll see, lsof output can be a bit much for those just getting started with Terminal.app and CLIX provides a nice wrapper around the OS X command line utilities and allows you to keep similar commands organized with a much friendlier output window than the Terminal. It comes with an amazing set of pre-built command libraries that are well worth the time to go through. You will come away with a great education on the innards of OS X.

Files A-Plenty

While we do ultimately want to use lsof to find out what is happening on the network, seeing just what is “open” at any given moment on your Mac can be quite eye-opening. If you installed CLIX, navigate to the “CLIX Command Files” folder and double-click list.clix.

Sort the list that comes up by “Title” and locate “Open Files”, double-click and (command-line purists can just run lsof -l +L -R -V).

You should see a fairly substantial output list. These are all the open files you can see with your user privileges. CLIX has an option to enter your administrative password (Edit->Sudo…) that will let the lsof command use admin privileges (which will make the list even more substantial) if you prefix it with sudo (and a space). It can be very useful to add a series of CLIX entries with “sudo” prefixes to commands like lsof if you find yourself using them quite a bit.

A small modification (which you can add as an item to “list.clix” or just enter in the terminal gives you a way to see what process (application) has a file open on a mounted volume (which is problematic if you want to eject that volume). Just enter:

lsof -l +L -R -V | grep "/Volumes"

and look through the first and last columns to tie application name to the resource it has open. You can see from my example that Preview has one graphic open on another volume. You may need to execute this as sudo lsof -l +L -R -V | grep "/Volumes" if your user privleges are not sufficient to see what is open (this should not be the case, but it can help find those stubborn open files that are keeping your disk from dismounting).

A further small modification is to see what a particular application (process) has open. Simple change the command to be: lsof -l +L -R -V -c Safari (change “Safari” to the app you are interested in) and the output will be filtered to only include what is open by what you specify.

What Goes Where?

Back in CLIX, navigate to “Open Network Files” and run that command line (lsof -l -i +L -R -V) [again, prefix this with sudo to see more entries].

In this example, you can see that:

• the Finder is connected to the local machine
• Radioshift is listening for connetions
• Dropbox is super busy
• SystemUIServer (a background process that controls several aspects of the Mac OS X user interface) is chillin’
• and Safari & Adium are engaged in some sort of external communication (both of which seem valid)

What you should be looking out for are network connections to or from destinations that you do not recognize or unfamiliar application (process) names that are engaged in network communication. Generally speaking, if you do not recognize the name (when running without sudo) then you may have some not-so-cool things going on.

A More Mac-like Experience

It’s A Very Good Thing to know how things work under the hood, but you may be the type of user who – like most drivers – want someone else to “change the oil”. As has been indicated previously, Little Snitch is a great program to both help you detect what is going on and give you control over it. The app is not free – it costs $29.95 – but if it helps prevent even one bad connection from getting through, then it may be a very justifiable expense.

If you have any questions or suggestions on this topic or come up with a cool CLIX command library you want to share, definitely drop a note in the comments.

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Why iPad 2 Will Lead Consumers Into the Post-PC Era
• The Near-Term Evolution of Social Commerce
• Content Farms: The Players, The Benefits, The Risks

This post covers two of three key programs for managing bandwidth: iftop (a command-line utility) and SurplusMeter (a GUI tool). The third utility – lsof (another command-line utility) – will require a dedicated article in-and-of itself.

How Much Am I Consuming?

SurplusMeter is a small tool from the fine folks over at SkoobySoft with one mission: to show you how much bandwidth you are consuming with the option to enter any known caps to ensure you are not over your limit. You can download SurpluMeter directly from their site. It is a PPC binary compatible down to OS X 10.3.9. For those who want to live life on the wild side, you can grab the source code and compile it yourself. I have built an OS X 10.5 compatible Universal Binary version which you can download via this post. No matter which way you decide to go, it is important to copy the application to your local volume as it runs an agent program – which runs in the background collecting bandwidth data – that will make it difficult to remove mounted volumes if you keep it running.

The main view of SurplusMeter is fairly straightforward. You can set which day to start the monthly tracking period on and specify your known bandwidth cap – which can also include upstream usage. Monitoring can be paused if you know you will be moving between networks, the collected data can be reset and you can even choose which interface to monitor via their “English” names vs OS X short device names (e.g. “Ethernet port” vs “en0“). For my example, I did a short sample of bandwidth on my AT&T 3G ExpressCard, hence the PPP modem selection. If there were hiccups during program execution or you know of other bandwidth usage on your connection not emanating from your Mac, you can add bytes to the current data collector.

Similarly, you can also remove bytes if you were measuring data on an interface that moved between networks.

SurplusMeter is kind enough to store its data in ~/Library/Application Support/SurplusMeter/surplusmeter_data.plist in a very human- and machine-readable format (a well-annoted Apple plist) so you can do what you like with it:

In general, it is a great, special purpose utility to have around.

What’s Going On Here?

SurplusMeter tells you that you are using bandwidth, but does not provide any further details. This is where tool number two – iftop – comes into play. You can grab a pre-built package of iftop (“interface top”) from AFP548.com or grab the source and try your hand at building it (you may need to download some support libraries). Users of various “ports” tools should be able to find iftop in one of the repositories.

Where the command-line tool top provides a mechanism for determining what processes are consuming precious system resources (in a very similar fashion to the Activity Monitor application), iftop does something similar for network usage on a particular interface.

You will need some more technical information to run iftop successfully. First, you will need to know which network interface you want to monitor. To find out which interfaces you have on your system, open Terminal.app and run the command:

ifconfig -l

My output from that shows:

lo0 gif0 stf0 en0 fw0 en1 vmnet8 vmnet1 ppp0

Interface en0 generally is equivalent to “Ethernet” and en1 is usually equivalent to your AirPort card. ppp0 would refer to most modems, including 3G cards. Additional interfaces may be related to a VMware or Parallels install, your local firewall interface or other local types of network devices.

With Terminal.app open, run iftop -h to see what the command line options are for the tool:

Synopsis: iftop -h | [-npbBP] [-i interface] [-f filter code] [-N net/mask]

   -h                  display this message
   -n                  don't do hostname lookups
   -N                  don't convert port numbers to services
   -p                  run in promiscuous mode (show traffic between other
                       hosts on the same network segment)
   -b                  don't display a bar graph of traffic
   -B                  Display bandwidth in bytes
   -i interface        listen on named interface
   -f filter code      use filter code to select packets to count
                       (default: none, but only IP packets are counted)
   -F net/mask         show traffic flows in/out of network
   -P                  show ports as well as hosts
   -m limit            sets the upper limit for the bandwidth scale
   -c config file      specifies an alternative configuration file

For this example, the most useful options are “-i” to let us choose which interface to monitor and “-P” to show which ports are in use. The tool requires elevated privileges to work so you have to run the following to start your view: sudo iftop -P -i ppp0 (again, replace “ppp0” with “en0” or “en1” or whatever interface you need to monitor).

You should see something similar to the following screen upon successful execution (minus the annotation):

The main part of the display lists, for each pair of hosts, the rate at which data has been sent and received over the preceding 2, 10 and 40 second intervals. The direction of data flow is indicated by arrows, <= and =>. So in this example, where I started iTunes just after kicking off iftop, we can see that:

• 166.129.237.160 (my local machine) made a series of http (web) requests to Apple servers
• some of Apple’s servers do not resolve from IP addresses to host names
• the average transfer rate over 40 seconds is between 0.2 kilobytes and 9 kilobytes per second

After quitting iTunes and running for a while, then letting it sit “idle” (not actively doing network activity), you can see that the pattern of usage can change dramatically.

While iftop can let you see more of what is going on, it cannot tell you which applications or processes are causing the usage. You can infer quite a bit (i.e. http traffic is most likely coming from your browser – but this is not necessarily the case as shown by the last screen), but finding out core details is where lsof can be of real value and will be covered in our next installment.

While I have presented a free way to monitor bandwidth usage, Guy Meyer has a set of tools – Net Monitor & Net Monitor Sidekick which do something similar but are not free (the Sidekick program is in beta which is expired so I was not able to test it).

If you are using any of these or similar tools to monitor bandwidth utilization, drop a note in the comments to share your insights with TAB readers and keep an eye out for our post on lsof!

Related research and analysis from GigaOM Pro:
Subscriber content. Sign up for a free trial.

• Why iPad 2 Will Lead Consumers Into the Post-PC Era
• The Near-Term Evolution of Social Commerce
• Content Farms: The Players, The Benefits, The Risks