Mac network monitor: how to see which app is using your internet, with built-in tools and without

How do I see which app is using my internet on a Mac?

Open Activity Monitor (press ⌘Space, type Activity Monitor, press Return) and click the Network tab. Each row is an app or a background process, with columns for Sent Bytes, Rcvd Bytes, Sent Packets and Rcvd Packets. Click Rcvd Bytes so the arrow points down and the biggest downloaders rise to the top; click Sent Bytes to find the biggest uploaders.

The panel at the bottom of the window shows the Mac as a whole. Apple describes it as the total packets in and out, the total data received and sent, and the data received and sent per second, which Apple calls throughput. The graph next to it is the live picture: a flat line means the network is quiet, a solid block means something is moving a lot of data now.

The catch that confuses almost everyone: the per-process numbers are cumulative. As Intego's guide to Activity Monitor explains, they show totals since each app was launched, or since the Mac restarted for system processes. A process that shows 8 GB received may have done all of that last night and be idle now. So read the table as "who has used the most since startup" and the graph as "is anything busy right now". To catch the app that is busy right now, watch which row's numbers keep climbing over half a minute, or use nettop, below.

The Activity Monitor guide covers the other tabs, which matter when a busy network also makes the Mac hot or slow.

Which Mac network monitor should I use?

What the built-in tools can and cannot show

Activity Monitor, Network tab. Can show: which processes have moved the most data since they started, and the Mac's total throughput live. Cannot show: which websites or servers an app is talking to, per-app speed right now, or anything from before the last restart. It also has no way to block anything.

nettop. A Terminal command built into macOS. Its manual describes it as a program that displays a list of sockets or routes with counts updated periodically. Type nettop -P and press Return to get one line per process with bytes in and bytes out, refreshing as you watch; press d to switch to the change since the last refresh, which is the closest thing to a live per-app speed, and q to quit. Can show: who is busy right now, and, if you expand a process, the connections it has open. Cannot show: friendly app names in every case (you see process names like nsurlsessiond), history, or blocking. It is technical but read-only, so it cannot break anything.

Wireless Diagnostics. Hold Option, click the Wi-Fi icon in the menu bar, and choose Open Wireless Diagnostics. Apple's guide says it checks the connection between your router and the internet, lists issues it finds with possible fixes, and does not change your network settings. Can show: whether your Wi-Fi itself is the problem. Cannot show: which app is using bandwidth.

Network Utility is gone. MacRumors reported in 2020 that Apple deprecated Network Utility in macOS Big Sur, with its functions moved to Terminal commands and Wi-Fi checks to Wireless Diagnostics. Guides that tell you to open it are out of date. For a quick speed test, macOS 12 and later include the networkQuality command in Terminal.

Third-party network monitors: LuLu, Little Snitch and menu bar meters

Built-in tools tell you how much. A per-app connection monitor tells you where: every server each app connects to, as it happens, with the option to allow or block it. These are the two best known on the Mac.

• LuLu, from Objective-See (the non-profit security project run by Patrick Wardle). Objective-See describes it as a free, open-source firewall that blocks unknown outgoing connections. When an app you have not approved tries to connect out, LuLu shows an alert with the app's name and the destination, and you choose allow or block, once or for good. It runs on macOS 10.15 and later. It is a firewall first: excellent for "what is this app phoning home to?", less so for "how many gigabytes did it use?".
• Little Snitch, from Objective Development. It shows a connection alert so you can allow or deny each connection, and its Network Monitor shows where your Mac connects to on the internet, grouped by app, domain or country, with a map of servers and a traffic chart covering current and past activity for up to twelve months. That history and the data volumes per connection make it the more complete monitor of the two. It is paid software; without a license it runs in a time-limited demo mode.
• Menu bar bandwidth meters. Several small apps put the current upload and download speed in the menu bar, and some list the top apps underneath. They are handy for noticing when something starts a big transfer, but most read the same counters as Activity Monitor and do not show destinations or block anything.

A fair rule of thumb: if you only want to know which app used your data, Activity Monitor is enough. If you want to know what an app connects to, or stop it, install LuLu or Little Snitch. Either way, the first few days bring a lot of alerts, nearly all of them from macOS itself; allowing Apple's own processes is the normal choice.

What normally uses a lot of data on a Mac

When people open the Network tab for the first time, the top rows are almost always Apple processes with unfamiliar names. These are the usual ones, ranked by how much data they tend to move.

Each of these has its own page: softwareupdated, photolibraryd, bird, cloudd, nsurlsessiond and backupd. You will also see mDNSResponder high in the Packets columns, because it handles name lookups for every app, and networkserviceproxy if you use iCloud Private Relay, because your Safari traffic passes through it. Neither is using data for itself.

The pattern that matters is direction and duration. Downloads after an update or a sign-in are normal. Uploads that never stop from a process you cannot place are the case worth investigating.

What is that process in the Network tab?

Type the name exactly as it appears in Activity Monitor and see what it is and whether it is safe to quit.

When the network is busy because of a sync or update process, it is usually also using CPU and battery. Safe to Quit explains processes like cloudd, bird, photolibraryd, nsurlsessiond and softwareupdated, and says whether to leave them to finish; it does not measure per-app network traffic, which is what Activity Monitor and the tools above are for.

How to find and stop what is using your bandwidth

1. Check the live graph first

   Activity Monitor, Network tab. If the graph at the bottom is flat, nothing on this Mac is using the network now, and the slowness is your Wi-Fi or provider.

2. Sort by Rcvd Bytes, then Sent Bytes

   Click each column so the biggest numbers are on top. Note the top three names.

3. Watch which numbers are still climbing

   Wait thirty seconds. The row whose numbers keep rising is the one busy now. Or run nettop -P in Terminal and press d.

4. Identify it before acting

   If it is an Apple sync, update or backup process, let it finish, ideally plugged in overnight. If it is an app you opened, pause its download or quit it.

5. Pause sync if you are on a limited connection

   On a phone hotspot, pause iCloud Photos sync in the Photos settings and delay large downloads until you are back on your normal network.

6. Restart if a process will not settle

   A process stuck re-uploading the same data for hours usually settles after a restart.

7. Install a connection monitor if you need to know where

   If you cannot identify a process that keeps uploading, LuLu or Little Snitch will show where it connects and let you block it while you investigate.

When to worry about network activity on a Mac

Most surprising network use is iCloud doing exactly what it was asked to do. A few signs deserve a closer look.

• Constant uploads from something you cannot identify. High Sent Bytes that keep rising from a process name you cannot find in the lookup or on Apple's site. Check System Settings, General, Login Items for anything you did not add, and use a connection monitor to see where it is sending data.
• Data use with every app quit. One Apple Community member found their Mac mini was behind a household data overrun; with everything quit, a background process is still the source, and the Network tab sorted by Sent and Rcvd Bytes is the place to start.
• A remote access tool you did not install. Screen sharing and remote support apps move a lot of data while connected. If you see one you do not remember setting up, quit it and remove it from Login Items.

What not to do: block Apple's own processes in a firewall to save data, or force quit them. Blocking softwareupdated stops security updates, and blocking cloudd or bird breaks iCloud sync in ways that are hard to notice until a file is missing. Pause sync in settings instead, and let updates finish when you are on an unmetered connection.