Sign up ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.

I see suddenly that my downstream bandwidth is 400 KBps which is the maximum my ISP gives me, so there's an application downloading at its top capacity.
The thing is I didn't start any download, so it's doing it in the background without telling.
How can I know which app or process is using it?
Or, basically, how can I determine how much bandwidth each open process or application is using?

share|improve this question
I've stumbled across a firewall app before that can graph network usage per app and per user... but I can't seem to find it anymore. :/ –  Jason Salaz Jun 29 '11 at 5:12
HandsOff shows per-app usage –  hsmiths Jun 29 '11 at 12:21
was the automatic software update? –  jm666 Jun 29 '11 at 14:47
@jm666: That was my first suspect, but it wasn't –  Petruza Jun 29 '11 at 18:50

6 Answers 6

up vote 1 down vote accepted

This help at all? Take a look at the NetMonitor Sidekick add on. Have not tried it myself but will probably load on virtual machine to see how it works.

share|improve this answer
thanx!......... –  Petruza Nov 7 '11 at 19:33
Link dead @ Oct 2015 –  Tetsujin Oct 3 at 6:37

Rubbernet is a really great app that allows you to see the per application network usage of your Mac plus it supports Remote Monitoring. You can install a Rubbernet plugin any Mac that you have administrative access and then monitor the per application bandwidth utilization of all the Macintosh on your network from your own computer.

It does cost money (30 Euros on their website but for some reason its $19.99 on the Mac App Store but they have a fully functional Free Trial on their website. I haven't bought the app yet, so I can not confirm that you can buy one license for the app and then install the plugin on any number of Macs for now additional charge. But that seems to be the situation.

The Developers are the same folks who do the Linkinus IRC Client.

share|improve this answer

lsof and iftop (direct Link to install package) are the best tools that come to mind.

Also, take a look at this question.

share|improve this answer
But it doesn't show which app is using the bandwidth –  Petruza Jun 29 '11 at 21:07
@Petruza, you can identify the program associated with a particular connection using lsof and then monitor the bandwidth of the connection with iftop. It should be enough information to audit the suspect connections/programs. –  Somantra Jun 30 '11 at 15:31
@Petruza, in your case you would probably start with iftop to identify the connection using up your bandwidth then trace the connection to the owning app with lsof or netstat. –  Somantra Jun 30 '11 at 15:53

Another option that is not quite as good as it does not have any kind of remote monitoring mechnaism and didn't seem to do as good a job is OS Track. Its also available on the Mac App Store for free. I didn't really like this app as it seemed to consume a lot of resources itself. But that might be something they fixed in a later version.

share|improve this answer

Quote: "How can I know which app or process is using it?"

You can try nettop(1) in the Terminal. It is pre-installed, and refreshes every few seconds to provide a dashboard of all open network connections (by process) with their usage. Better than lsof since it shows the usage data too.

$ nettop

Then hit 'd' and look for odd-looking entries or entries with consistently large traffic in the 'bytes in' or 'bytes out' column. The 'd' instructs nettop to only show differences in each screen refresh.

Practical usage notes:

If you don't recognize the process name, Google it.

If you don't want the process around, get the pid (the number next to the process name in nettop), and kill it with kill -9 <pid>. If that doesn't solve it, find out if you can uninstall the process.

If you're interested in what the process is transmitting over the network, use the client port number for that particular connection (e.g. '53133' from> to run a tcpdump(1) to see the data in the packets being exchanged: sudo tcpdump -nnvvXSs 1514 port 53133

If you're interested in the destination the process is talking to, but the destination IP address doesn't have a reverse DNS hostname (like in the previous example), then try visiting that IP address in a web browser as https://IP, click the broken lock icon in the address bar, and view the certificate details to find out which domain is served there (* in this case). This won't work if SSL port 443 isn't open on the destination.

share|improve this answer
I don't understand the reason for the negative vote. AFAICT, the answer is exactly what the OP is looking for (how to monitor which process is using up the bandwidth). –  2rdmc Jan 25 at 17:30

sudo fs_usage might id the process

share|improve this answer

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.