# Find Which App Is Using Your Network on Mac

> Activity Monitor counts totals since each process started, which hides the app saturating your link right now. Use nettop for live traffic and lsof for destinations.

Published: 2026-08-12 | Updated: 2026-08-16

Something is using the connection. The Wi-Fi indicator is busy while you are not doing
anything, a tethered connection burns through its allowance in an afternoon, or a video
call degrades every time you sit down to work. macOS can answer this, but the tools are
scattered and the most prominent number in each of them is cumulative rather than live,
which sends people to the wrong process.

**Short answer:** Activity Monitor's Network tab names the process, but its columns count
totals since each process started. For what is moving data *right now*, use `nettop`. For
which remote hosts a process is talking to, use `lsof -i`.

## Activity Monitor names the process

Open Activity Monitor and select the **Network** tab. Every process that has moved data
appears with bytes sent and received.

Sorting those columns is what sends people after the wrong process. They are totals
accumulated since each process launched, so a daemon running since your last reboot
outranks the app saturating your link this minute. Sorting by "Rcvd Bytes" reliably puts
the wrong thing at the top.

Two rows alarm people and usually should not:

- **mDNSResponder** handles DNS and local network discovery for the whole system. On a
  Mac that has been up for weeks it can show gigabytes. It is a proxy for everything else
  resolving names, not an app downloading in the background.
- **kernel_task** appears because network work crosses the kernel. See
  [kernel_task high CPU](https://mole.fit/blog/kernel-task-high-cpu-mac) for the same misattribution in
  its CPU form.

The bottom of the window has a live graph of data in and out per second. That graph, not
the columns, is the thing to watch while you change something.

## `nettop` shows what is moving now

`nettop` is the tool that answers the real question. It ships with macOS and needs no
installation.

```
nettop -P -L 1 -J bytes_in,bytes_out
```

```
,bytes_in,bytes_out,
syslogd.362,0,22701,
apsd.368,685304,414375,
mDNSResponder.480,4189609493,104188210,
```

`-P` aggregates per process rather than per connection, `-L 1` takes a single sample and
exits instead of running interactively, and `-J` selects the columns. Run it
interactively without `-L` and it refreshes in place, which is the mode you want while
hunting.

To watch deltas rather than totals, take two samples a few seconds apart and compare. A
process that gained tens of megabytes between them is the one to investigate. A process
with a huge total and no change between samples is idle history.

## `lsof -i` shows where it is connecting

Once you have a name, the next question is usually where it is sending data.

```
sudo lsof -i -n -P | grep ESTABLISHED
```

`-n` skips reverse DNS and `-P` skips port-name lookup, which makes the output fast and
literal. You get the process, the local port, and the remote address for every open
connection. Without `sudo` you only see your own processes, which is often enough.

Resolving those addresses is where honesty matters: an IP that belongs to a large cloud
provider tells you almost nothing, because most of the internet is hosted there. Treat it
as a hint, not an identification.

## The usual answers

Before assuming something is wrong, check the things that are supposed to use the network
without being asked.

| Cause | How to recognise it | Where to control it |
|---|---|---|
| iCloud Photos sync | Sustained upload after importing photos | Photos > Settings > iCloud |
| iCloud Drive | Activity after large file changes | System Settings > Apple Account > iCloud |
| macOS or App Store updates | `softwareupdated`, `appstoreagent` | System Settings > General > Software Update |
| Third-party sync clients | Dropbox, Google Drive, OneDrive helpers | The app's own preferences |
| Backup software | Long steady upload on a schedule | The backup app |
| A browser tab | Video, a stuck upload, an autoplaying page | Chrome's Task Manager, Safari's Activity window |

Software Update deserves special mention because it downloads in the background by
default and a full macOS installer is several gigabytes. On a metered connection that
single setting is often the whole problem.

## What macOS will not tell you

Three limits, because several popular articles skip them:

- **There is no built-in per-app bandwidth history.** Activity Monitor and `nettop` both
  report from process start or from the moment you started watching. Nothing in macOS
  keeps a per-app record you can consult afterwards.
- **Per-process totals are not per-app totals.** A browser spreads its traffic across
  renderer processes, and a helper daemon may carry traffic for several apps at once.
- **Traffic through a VPN or a system extension may be attributed to the extension**
  rather than to the app that generated it.

A tool claiming a complete historical per-app breakdown is either installing a network
filter of its own or estimating, and you want to know which before trusting the number.

## A repeatable check

1. Watch Activity Monitor's live graph at the bottom of the Network tab, not the columns.
2. Take two `nettop -P -L 1` samples a few seconds apart and diff them.
3. For the process that grew, run `lsof -i -n -P` to see where it is connected.
4. Pause the suspect app or sync service and confirm the graph drops.
5. If nothing drops, the traffic is not from a user app; check Software Update and iCloud.

Step four is the one people skip, and it is what separates an identification from a
guess.

## Where a monitor fits

[Mole](https://mole.fit/) keeps live network throughput in the menu bar next to CPU, memory, and thermal
state, so a busy connection is visible when it happens rather than reconstructed
afterwards. It reports the throughput it can measure and does not install a network
filter to claim a per-app history macOS does not provide.

## FAQ

### Why does mDNSResponder use so much data?

It resolves names and handles local network discovery for the entire system, so the
traffic of many other processes is counted against it. It is not downloading anything of
its own.

### Can I see how much data an app used yesterday?

Not from macOS. There is no built-in per-app history. Third-party tools that offer this
install a network extension to observe traffic themselves.

### How do I find what is using data on a hotspot?

Turn on Low Data Mode for that network in System Settings > Wi-Fi > Details, which stops
several background services including automatic update downloads, then use the `nettop`
diff above for whatever is left.

### Is high network activity a sign of malware?

It is rarely the first sign, and the usual explanations above cover almost every case.
Work through them before treating steady background traffic as suspicious.

---

Canonical HTML page: https://mole.fit/blog/what-app-is-using-my-network-mac
Blog index for agents: https://mole.fit/blog/llms.txt
Site index for agents: https://mole.fit/llms.txt