12

I see suddenly that my downstream bandwidth is 400 KBps which is the maximum my ISP gives me, so there's an application downloading at its top capacity.
The thing is I didn't start any download, so it's doing it in the background without telling.
How can I know which app or process is using it?
Or, basically, how can I determine how much bandwidth each open process or application is using?

  • I've stumbled across a firewall app before that can graph network usage per app and per user... but I can't seem to find it anymore. :/ – Jason Salaz Jun 29 '11 at 5:12
  • HandsOff shows per-app usage – hsmiths Jun 29 '11 at 12:21
  • was the automatic software update? – jm666 Jun 29 '11 at 14:47
  • @jm666: That was my first suspect, but it wasn't – Petruza Jun 29 '11 at 18:50
1

This help at all? Take a look at the NetMonitor Sidekick add on. Have not tried it myself but will probably load on virtual machine to see how it works.

http://netmonitor.s3-website-us-east-1.amazonaws.com/net.html

14

Quote: "How can I know which app or process is using it?"

You can try nettop(1) in the Terminal. It is pre-installed, and refreshes every few seconds to provide a dashboard of all open network connections (by process) with their usage. Better than lsof since it shows the usage data too.

$ nettop

Then hit 'd' and look for odd-looking entries or entries with consistently large traffic in the 'bytes in' or 'bytes out' column. The 'd' instructs nettop to only show differences in each screen refresh.

Practical usage notes:

If you don't recognize the process name, Google it.

If you don't want the process around, get the pid (the number next to the process name in nettop), and kill it with kill -9 <pid>. If that doesn't solve it, find out if you can uninstall the process.

If you're interested in what the process is transmitting over the network, use the client port number for that particular connection (e.g. '53133' from 10.0.0.1:53133->74.125.68.100:80) to run a tcpdump(1) to see the data in the packets being exchanged: sudo tcpdump -nnvvXSs 1514 port 53133

If you're interested in the destination the process is talking to, but the destination IP address doesn't have a reverse DNS hostname (like in the previous example), then try visiting that IP address in a web browser as https://IP, click the broken lock icon in the address bar, and view the certificate details to find out which domain is served there (*.google.com in this case). This won't work if SSL port 443 isn't open on the destination.

  • I don't understand the reason for the negative vote. AFAICT, the answer is exactly what the OP is looking for (how to monitor which process is using up the bandwidth). – 2rdmc Jan 25 '15 at 17:30
  • At first glance nettop seems even more cryptic than top. For instance I can't see how to get the most active processes at the top. – hippietrail Nov 10 '17 at 4:44
5

You can easily view all network activity from the Activity Monitor; it's built right in to OS X.

  • Open Applications > Utilities > Activity Monitor
  • Click Network tab

Activity Monitor, Network Tab; Sorted by Packets Sent

  • 1
    Is there a way to see bandwidth per second, as opposed to total bytes? – Crummy Oct 13 '18 at 9:38
  • @Crummy if you right-click the column headers you can modify what columns are shown. Not sure if there's per-second column, but there should be something there that can help. – Michael Thompson Oct 24 '18 at 20:13
3

Rubbernet is a really great app that allows you to see the per application network usage of your Mac plus it supports Remote Monitoring. You can install a Rubbernet plugin any Mac that you have administrative access and then monitor the per application bandwidth utilization of all the Macintosh on your network from your own computer.

It does cost money (30 Euros on their website but for some reason its $19.99 on the Mac App Store but they have a fully functional Free Trial on their website. I haven't bought the app yet, so I can not confirm that you can buy one license for the app and then install the plugin on any number of Macs for now additional charge. But that seems to be the situation.

The Developers are the same folks who do the Linkinus IRC Client.

link to rubbernet removed as it lead to a website with a fake alert about updating out of date Flash

2

lsof and iftop (direct Link to install package) are the best tools that come to mind.

Also, take a look at this question.

  • But it doesn't show which app is using the bandwidth – Petruza Jun 29 '11 at 21:07
  • @Petruza, you can identify the program associated with a particular connection using lsof and then monitor the bandwidth of the connection with iftop. It should be enough information to audit the suspect connections/programs. – Somantra Jun 30 '11 at 15:31
  • @Petruza, in your case you would probably start with iftop to identify the connection using up your bandwidth then trace the connection to the owning app with lsof or netstat. – Somantra Jun 30 '11 at 15:53
2

Just to complement the (terrific) nettop answer - some complained that the output is cryptic. For clean output, try:

nettop -P -k state,interface -d

Flags explained:

-P collapses the rows of each parent process

-k state,interface removes less informative columns that stand between you and the bytes in/out columns

-d activates the delta option (same as pressing the d button)

Use the h button or run man nettop for some more options.

1

Another option that is not quite as good as it does not have any kind of remote monitoring mechnaism and didn't seem to do as good a job is OS Track. Its also available on the Mac App Store for free. I didn't really like this app as it seemed to consume a lot of resources itself. But that might be something they fixed in a later version.

0

sudo fs_usage might id the process

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .