NetworkToggle
Requires macOS 26 · Free · Signed and notarized by Apple
Your laptop is sitting in a dock with a gigabit cable in it, and everything is still going over Wi-Fi. NetworkToggle puts the connection you are actually using in your menu bar, and lets you change it deliberately instead of finding out an hour later.
Screenshot
The menu shows what you are connected to now, and the priority order underneath. Drag to reorder; macOS uses the topmost connection that is actually working.
Why this keeps happening
macOS files each new dock at the bottom of the list
Every dock has its own Ethernet chipset with its own hardware address. Plug in an unfamiliar one and macOS treats it as a brand-new connection, adding it to the bottom of its priority list, underneath Wi-Fi, where it will never get picked. Configuring one dock does nothing for the next one.
A connection without a proper lease never gets promoted
macOS only promotes a connection that has both an address and a router. A slow handshake, or a dock that hands out a self-assigned address, leaves Ethernet sitting permanently below Wi-Fi even though the cable is plugged in.
Connections that are already open do not move
Even once new traffic starts using Ethernet, connections that were already open stay on Wi-Fi until they close. A VPN tunnel that came up over Wi-Fi keeps running over Wi-Fi. Only cycling Wi-Fi moves them, which is what the force-reconnect option does.
It checks that a connection actually works before moving you onto it
A dock whose uplink is dead looks completely healthy from the outside: the cable is in, the connection has an address, everything appears configured. So before switching automatically, NetworkToggle waits for the connection to settle and then pings the gateway. Only a real reply distinguishes a working dock from a dead one. If nothing answers, it tells you instead of switching you onto a connection that goes nowhere.
If you use a VPN
With a VPN connected, the menu shows the tunnel and the connection carrying it underneath, so you can see that you are on NordVPN over Thunderbolt Ethernet rather than just seeing a tunnel.
NetworkToggle will not move a running VPN onto a different connection. A tunnel stays bound to the address it was established on, and pulling it onto another connection stops it passing traffic until the order is put back. Any change that would do that asks you first. To choose which connection a VPN uses, set the order while it is disconnected, then connect.
Installing it
Open the downloaded disk image and drag NetworkToggle to your Applications folder.
Open it, click Install helper once, and approve the prompt that macOS shows you.
That is the whole setup. Changing connection order is a system-level setting, so it needs a small privileged helper to do the writing. The app itself holds no elevated rights, and reading your network configuration needs no permission at all.
Keeping it up to date
NetworkToggle updates itself from GitHub. Check for Updates in the menu does it on demand, and the check at launch stays quiet unless there is something to offer. A version you skip is not raised again on its own.
A downloaded build is refused unless its signature verifies, it carries the same Team ID as the copy you are running, and it passes Gatekeeper. Any failure aborts and leaves your installed copy alone.
Under the hood
Architecture
The app runs as you and does all the reading, since inspecting the network configuration needs no privilege. A separate helper daemon runs as root and is the only code that writes system configuration, exposed as four narrow methods that each re-validate their arguments. The daemon is installed with SMAppService, approved once in System Settings, rather than prompting for an admin password on every launch.
Security model
Both ends of the connection between app and helper pin the other's code signature to a requirement built from the Team ID rather than a code hash, so a substituted binary is rejected by the kernel before any command is seen. The reordering method refuses anything that is not a permutation of the current order, so a truncated list cannot silently demote the connections it leaves out. Ad-hoc signatures change on every rebuild and cannot be used; the build script fails rather than falling back to one.
Building from source
NetworkToggle is a Swift package and builds as a universal binary. Full build, notarization, and release instructions are in the repository.