How to Monitor Network Activity on Mac, App by App

Your video call starts to stutter, a download crawls, or the Wi-Fi feels slow for no reason. Very often the router is fine and something on your own Mac is quietly uploading a backup or downloading an update.

The short answer: open Activity Monitor and click the Network tab to see how much each app has sent and received. Those numbers are totals since each app started, so to see what is using the network right now, run nettop in Terminal. Both tools are built into macOS and need no administrator password.

Activity Monitor: totals for every app

1. Press Command-Space, type Activity Monitor, and press Return.
2. Click the Network tab at the top of the window.

Every process that has used the network appears in the list, including system processes that have no icon. The columns that matter:

• Sent Bytes: how much the process has uploaded.
• Rcvd Bytes: how much it has downloaded.
• Sent Packets and Rcvd Packets: the same traffic counted in packets.

The panel at the bottom shows packets per second and a live graph for the whole Mac, which is the quickest way to confirm something is busy at all.

The catch: these are totals, not speeds

The byte columns count everything a process has sent or received since it started. A browser that has been open for a week can sit at the top of the list while doing nothing at all right now, and an app that started downloading a minute ago may still be further down.

So do not just sort and blame the top row. Sort by Rcvd Bytes, then watch for a minute. The process whose number keeps climbing is the one using your connection.

Watching from the Dock

Activity Monitor can also turn its Dock icon into a small live traffic graph: choose View > Dock Icon > Show Network Usage. It shows no numbers and no app names, but it tells you at a glance whether data is moving, as long as Activity Monitor stays open.

nettop: what is using the network right now

macOS includes a command-line tool, nettop, that shows network traffic per process. Its delta mode reports how much each process moved during the last interval, which is the real "who is using my internet" answer.

Open Terminal and run:

nettop -P -d -L 2 -s 5 -J bytes_in,bytes_out

What the flags do:

• -P gives one line per process instead of one per connection.
• -d switches to delta mode, so numbers are traffic during the interval rather than since launch.
• -L 2 -s 5 takes two samples five seconds apart and then exits.
• -J bytes_in,bytes_out keeps only the download and upload columns.

The first block of output is the running total. Read the second block: it shows how many bytes each process received and sent in those five seconds. On our test Mac, running macOS 27.0.1, it worked without sudo and listed system processes as well as apps.

A real run on our test Mac looked like this (second block, idle lines removed):

,bytes_in,bytes_out,
kernel_task.0,1416,1080,
mDNSResponder.477,6987,2654,
agy.43616,27339,17320,
IRC Connection .40738,263,52,

The first number is bytes downloaded in those five seconds, the second is bytes uploaded. Here the busiest process was agy, a command line tool, while kernel_task and mDNSResponder moved only a few kilobytes.

Two things to know when reading it:

• Names are cut to 15 characters, so Google Chrome's helper shows up as Google Chrome H. The number after the dot is the process ID, which you can look up in Activity Monitor.
• A VPN can take the credit. With a VPN connected, a large share of the traffic can appear under the VPN's own tunnel process. On our test Mac that was a process called PacketTunnel.

Leave out -L 2 -s 5 and nettop runs as a live, updating view instead. Press q to quit.

What the usual suspects are

• Browsers. Chrome, Safari and others split work into helper processes, so the traffic belongs to whichever tab or extension that helper serves.
• Cloud sync. iCloud Drive, OneDrive, Dropbox and Google Drive upload and download in the background whenever files change.
• nsurlsessiond. The system service that downloads on behalf of apps and macOS itself, including software updates. We explain it in What Is nsurlsessiond?.
• trustd. Small amounts of traffic while macOS checks security certificates. See What Is trustd?.
• mDNSResponder. macOS's name lookup service. It touches the network constantly, but in small amounts.

How to stop an app using your bandwidth

• Quit it, if it is an app you do not need right now.
• Pause the sync from the cloud app's menu bar icon while you are on a call.
• Schedule macOS updates for later in System Settings > General > Software Update, if nsurlsessiond is downloading at a bad moment.

Keep an eye on it without opening anything

Activity Monitor and nettop are good for investigating. They are poor at warning you, because you only open them once the connection already feels slow.

MacStats puts a live internet usage meter in your menu bar, showing your Mac's upload and download speed, so a background transfer is obvious the moment it starts. The dashboard adds a graph of the last minute, and with MacStats Pro, history going back days.

MacStats shows traffic for the whole Mac, not for each app. When the menu bar tells you something is busy, Activity Monitor's Network tab or nettop tells you which app it is. Our MacStats vs Activity Monitor comparison covers how the two fit together.

See a background download the moment it starts.

Download MacStats for Free

Frequently asked questions

How do I see which app is using my internet on a Mac?

Open Activity Monitor, click the Network tab, and sort by Rcvd Bytes. Those numbers are totals since each app started, so watch which one keeps rising. For traffic right now, run nettop -P -d -L 2 -s 5 -J bytes_in,bytes_out in Terminal and read the second block of output.

Why does Activity Monitor show huge network numbers for an app I am not using?

The Sent Bytes and Rcvd Bytes columns count everything since that process started, not current speed. An app left open for days can show gigabytes while idle.

Can I see network usage per app without Terminal?

Yes. Activity Monitor's Network tab lists every process with its sent and received totals. Terminal's nettop is only needed if you want traffic for the last few seconds rather than since launch.

Does MacStats show network usage per app?

No. MacStats shows the live upload and download speed for the whole Mac in the menu bar, plus a graph in its dashboard. To find which app is responsible, use Activity Monitor's Network tab or nettop.

Why is my Mac using the internet in the background?

Usually it is macOS downloading updates through nsurlsessiond, or a cloud service such as iCloud Drive, OneDrive or Dropbox syncing files that changed.