How to see which app is using your network on a Mac

To see what's using your Mac's network, start with Activity Monitor → Network for a per-app data breakdown, then drop to nettop or lsof in Terminal when you need to know which servers an app is actually talking to. Here's each tool and when to reach for it.

1. Activity Monitor: how much each app sends

This is the built-in, no-Terminal answer for "which app is eating my bandwidth."

1. Open Activity Monitor (Spotlight → "Activity Monitor").
2. Click the Network tab.
3. Sort by Sent Bytes or Rcvd Bytes to rank processes by total data moved, or by Rcvd Bytes/sec to see what's busy right now.

The catch: it shows volume, not destination. You'll learn that com.apple.photolibraryd sent 2 GB, but not to where. For that, you need the next tools.

2. nettop: live throughput per process

nettop is a built-in live monitor (think top, but for network). No install:

nettop

It refreshes in place, showing each process with its bytes in/out and open connections. Add -P to group by process and -m tcp to focus on TCP:

nettop -P -m tcp

Press q to quit. This is the fastest way to watch which process lights up the moment something starts transferring.

3. lsof: every connection, with the host

When you want to see exactly which remote servers a Mac is connected to right now, lsof lists open network files (connections) with the process and address:

sudo lsof -i -P -n

• -i: network connections only
• -P: show port numbers, not service names
• -n: show IP addresses, not reverse-DNS (faster, and shows the raw host)

Each row is a live connection: the process name, its PID, and the remote host:port it's talking to. To check a single app, filter by name:

sudo lsof -i -P -n | grep -i zoom

This is the honest "what's phoning home" view, but it's a snapshot, and IP addresses aren't always human-readable.

4. A per-connection firewall: see and stop it

If you want outbound connections surfaced as they happen (with the option to block one), a per-connection firewall is the tool:

• LuLu: free and open-source, from Objective-See. Alerts you when an app makes a new outbound connection and lets you allow or deny it.
• Little Snitch: the long-standing paid option, with detailed maps and rules.

macOS's own Application Firewall (System Settings → Network → Firewall) only controls incoming connections; it won't tell you what's reaching out. That's the gap these tools fill.

Why this matters

Most "phoning home" is benign: sync daemons, update checks, telemetry. But it's your Mac, and it's reasonable to want to see it. Background network use also drains battery and, on a metered connection, real money. If a process is unexpectedly busy, cross-reference it with iCloud sync high CPU (bird, cloudd, nsurlsessiond); those daemons are the usual explanation for steady background traffic.

Every connection, by app and host: without the Terminal

The built-in tools each show a slice: volume here, live throughput there, hosts in a third command. Plumby puts them together: every connection on your Mac, grouped by app and by host, in plain language from the menu bar. See what's reaching out, and block one once so it stays a rule. No analytics of its own, and nothing about your traffic ever leaves your Mac; it only shows you your own machine.