I see suddenly that my downstream bandwidth is 400 KBps which is the maximum my ISP gives me, so there's an application downloading at its top capacity.
The thing is I didn't start any download, so it's doing it in the background without telling.
How can I know which app or process is using it?
Or, basically, how can I determine how much bandwidth each open process or application is using?

  • I've stumbled across a firewall app before that can graph network usage per app and per user... but I can't seem to find it anymore. :/ Jun 29, 2011 at 5:12
  • HandsOff shows per-app usage
    – hsmiths
    Jun 29, 2011 at 12:21
  • was the automatic software update?
    – clt60
    Jun 29, 2011 at 14:47
  • @jm666: That was my first suspect, but it wasn't
    – Petruza
    Jun 29, 2011 at 18:50

9 Answers 9


This help at all? Take a look at the NetMonitor Sidekick add on. Have not tried it myself but will probably load on virtual machine to see how it works.


  • It shows "This version of Net Monitor Sidekick is not compatible with your OS X system software" on Catalina.
    – nhkhanh
    Sep 19, 2020 at 4:12

Quote: "How can I know which app or process is using it?"

You can try nettop(1) in the Terminal. It is pre-installed, and refreshes every few seconds to provide a dashboard of all open network connections (by process) with their usage. Better than lsof since it shows the usage data too.

$ nettop

Then hit 'd' and look for odd-looking entries or entries with consistently large traffic in the 'bytes in' or 'bytes out' column. The 'd' instructs nettop to only show differences in each screen refresh.

Practical usage notes:

If you don't recognize the process name, Google it.

If you don't want the process around, get the pid (the number next to the process name in nettop), and kill it with kill -9 <pid>. If that doesn't solve it, find out if you can uninstall the process.

If you're interested in what the process is transmitting over the network, use the client port number for that particular connection (e.g. '53133' from> to run a tcpdump(1) to see the data in the packets being exchanged: sudo tcpdump -nnvvXSs 1514 port 53133

If you're interested in the destination the process is talking to, but the destination IP address doesn't have a reverse DNS hostname (like in the previous example), then try visiting that IP address in a web browser as https://IP, click the broken lock icon in the address bar, and view the certificate details to find out which domain is served there (*.google.com in this case). This won't work if SSL port 443 isn't open on the destination.

  • 1
    I don't understand the reason for the negative vote. AFAICT, the answer is exactly what the OP is looking for (how to monitor which process is using up the bandwidth).
    – 2rdmc
    Jan 25, 2015 at 17:30
  • 2
    At first glance nettop seems even more cryptic than top. For instance I can't see how to get the most active processes at the top. Nov 10, 2017 at 4:44

Just to complement the (terrific) nettop answer - some complained that the output is cryptic. For clean output, try:

nettop -P -k state,interface -d

Flags explained:

-P collapses the rows of each parent process

-k state,interface removes less informative columns that stand between you and the bytes in/out columns

-d activates the delta option (same as pressing the d button)

Use the h button or run man nettop for some more options.

  • 1
    I threw on -t wifi -m tcp -x because I like the raw number, I want TCP only, and only want to monitor the wifi interface. Further adding -s 10 gives you a more representative 10 second sample window. Just remember to shift one decimal digit over to get bytes/sec.
    – BaseZen
    May 6, 2020 at 22:43

You can easily view all network activity from the Activity Monitor; it's built right in to OS X.

  • Open Applications > Utilities > Activity Monitor
  • Click Network tab

Activity Monitor, Network Tab; Sorted by Packets Sent

  • 9
    Is there a way to see bandwidth per second, as opposed to total bytes? Oct 13, 2018 at 9:38
  • @Crummy if you right-click the column headers you can modify what columns are shown. Not sure if there's per-second column, but there should be something there that can help. Oct 24, 2018 at 20:13
  • 1
    Sadly there is no such column. That is the reason I am reading answers for this question :) Sep 13, 2022 at 14:35

lsof and iftop (direct Link to install package) are the best tools that come to mind.

Also, take a look at this question.

  • But it doesn't show which app is using the bandwidth
    – Petruza
    Jun 29, 2011 at 21:07
  • @Petruza, you can identify the program associated with a particular connection using lsof and then monitor the bandwidth of the connection with iftop. It should be enough information to audit the suspect connections/programs. Jun 30, 2011 at 15:31
  • @Petruza, in your case you would probably start with iftop to identify the connection using up your bandwidth then trace the connection to the owning app with lsof or netstat. Jun 30, 2011 at 15:53

Rubbernet is a really great app that allows you to see the per application network usage of your Mac plus it supports Remote Monitoring. You can install a Rubbernet plugin any Mac that you have administrative access and then monitor the per application bandwidth utilization of all the Macintosh on your network from your own computer.

It does cost money (30 Euros on their website but for some reason its $19.99 on the Mac App Store but they have a fully functional Free Trial on their website. I haven't bought the app yet, so I can not confirm that you can buy one license for the app and then install the plugin on any number of Macs for now additional charge. But that seems to be the situation.

The Developers are the same folks who do the Linkinus IRC Client.

link to rubbernet removed as it lead to a website with a fake alert about updating out of date Flash

  • Seems like this software does not exist anymore. Going to the Rubbernet page when searching google results in a spam page.
    – teradyl
    Jun 15, 2020 at 6:43

Update: This app no longer exists

Another option that is not quite as good as it does not have any kind of remote monitoring mechnaism and didn't seem to do as good a job is OS Track. Its also available on the Mac App Store for free. I didn't really like this app as it seemed to consume a lot of resources itself. But that might be something they fixed in a later version.


sudo fs_usage might id the process


Little Snitch offers a great Network Monitor that gives all sorts of details including transfer rates and which processes have used the most data. You can also block anything you want or dig into things in more detail quite easily.

The nettop answers were by far the best, however if you're more of a GUI kind of person and want a recently supported and updated tool, check out Little Snitch.

Screenshot from Interface of Little Snitch

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .