Tell me more ×
Ask Different is a question and answer site for power users of Apple hardware and software. It's 100% free, no registration required.
up vote 5 down vote favorite
1

Very occasionally when using my Mac, I notice my internet connection slowing down. Using Activity Monitor I can see that it's because something is downloading data at the full rate my connection can support --- but I don't know how to tell what's responsible for it. It can be caused by several different things (Dropbox syncing; some app doing an automatic update; most recently it was a video buffering in a browser tab that I'd forgotten about) so it'd be really handy to have a way to tell which app is responsible for the network use. Is such a thing possible in OS X? Ideally I'm looking for a free solution. (Command line is OK.) I'm on Snow Leopard if it makes a difference.

share|improve this question

4 Answers

up vote 3 down vote accepted

You can try this dtrace one-liner:

sudo dtrace -n 'syscall::recvfrom:return { @[pid,execname] = sum(arg0); }'

Let it run for a while, then hit Control-C. It will print a summary of the number of bytes read from sockets, distributed among processes. For a more detailed view, replace sum by quantize. Or just to see a count of socket reads, replace sum by count.

Disclaimer: I have only tried this on Lion, but AFAIK no great changes in dtrace-ability have occured between SL and Lion.

share|improve this answer
1  
Many thanks! Simple and effective and does exactly what I needed. Works just fine on Snow Leopard. – Nathaniel Jul 8 '12 at 10:25
...although actually, using "sum" the numbers look a bit odd - Google Chrome usually gets a negative number (!). But using quantize they look sensible. – Nathaniel Jul 8 '12 at 10:29
Negative numbers, huh? Maybe it's a case of overflow. Or if you get small negative numbers, remember that system calls return -1 if an error occured. If it's overflow, my guess is that it wouldn't happen when you run a 64 bit kernel. – Harald Hanche-Olsen Jul 8 '12 at 10:43
They're medium-sized negative numbers. Here's a typical output (taken while re-loading this page in Chrome): 250 Google Chrome -159 ; 39 KernelEventAgen 1 ; 19 mDNSResponder 2240 ; but I might just be misinterpreting them - when I use 'quanitze' there's a "value" column which can have a negative values, and a "count" column. It looks like the sum command reports the sum of (value)*(count). Maybe negative values mean incoming packets, or something? – Nathaniel Jul 8 '12 at 10:58
No, this is all about incoming data … I guess that chrome does frequent polling by calling recvfrom with a short timeout set in the socket, in which case the return value -1 results if there is no data. See the manual page for recvfrom. – Harald Hanche-Olsen Jul 8 '12 at 11:08
up vote 5 down vote

Firewalls

You could use Little Snitch or HandsOff. They are great firewalls and both have a "Network Monitor" feature, that will do the job:

Little Snitch includes a Network Monitor, showing detailed information of all incoming and outgoing network traffic.
A status icon in the menu bar provides a summary of current network activity, and a monitor window with more comprehensive information pops up automatically in case of new traffic events.

Hands Off is an application to monitor and control the access of applications to your network and disks. Being able to monitor the normally unnoticeable activities enables you to make informed decisions regarding the transfer of your private information, hence avoiding confidential information leakage.

enter image description here enter image description here

The network monitors of: Little Snitch (left), HandsOff (right)

Nettop

A free and built-in cli solution (unfortunately it is not included in Snow Leopard) would be nettop. nettop groups traffic by program and port and measures various network statistics.

Other

There are few other programs, that capture and measure traffic (iftop, wireshark, tcpdump), but they don't know the originated pid. To make the connection you should use netstat.

share|improve this answer
Thanks! I've edited the question to indicate that I'm ideally looking for a free solution (€30 is too much for something I'd use only very occasionally), but if there isn't a free way to do it then I'll accept this answer. – Nathaniel Jul 7 '12 at 13:15
Sorry, my bad. I'll try to find a free alternative and will update my answer. – mspasov Jul 7 '12 at 13:18
Ha! nettop was new to me. Looks handy. – Harald Hanche-Olsen Jul 7 '12 at 17:46
I'd accept this answer too if it were possible. If I upgrade to Lion it looks like nettop will be really handy. – Nathaniel Jul 8 '12 at 10:30
up vote 2 down vote 
sudo fs_usage -f network

will give you all network accesses by all applications (and processes). Usually the process creating a lot of traffic is the one which appears most often in the output.

share|improve this answer
1  
Thanks, this is really useful. I'm impressed by the number of helpful answers to this question. – Nathaniel Jul 8 '12 at 10:30
up vote 1 down vote

The "DTrace book" has a script, soconnect.d, that does this.

Copy the "Mac OS X" version, paste it in a text file, then run it from the terminal with sudo dtrace -s soconnect.d.

share|improve this answer
But that does not give you a notion of the amount of network traffic a process receives does it? It only tracks connections, as far as I can tell. – Harald Hanche-Olsen Jul 7 '12 at 14:53
Thanks, this is really useful. – Nathaniel Jul 8 '12 at 10:30

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.