See which app is using your network

Steps

1. 01Step 1 of 6

   Step 1. Open Network

   Press ⌘5. The first view, Interfaces, shows the traffic through your Mac as a whole: received in blue above the line, sent in rose below it, on one shared scale.

   NetworkTraffic through your Mac’s network interfaces.

   InterfacesApps & processesConnectionsSearch or jump to…⌘KPauseRecord

   Interfaces · Sampled 10:42:18 · every 2s

   Live10:42:18

   1.6

   MB/sReceived

   Last 60 s: peak 2.1 MB/s · average 1.5 MB/s

   210

   KB/sSent

   Last 60 s: peak 321 KB/s · average 207 KB/s

   Mostly receiving data.

   Physical interfaces · not process or VPN totalsProcess lists include local and VPN traffic.

   Network trafficPhysical interfaces only · includes local-network trafficAll1 min5 min15 min

   10:32:1810:37:18now · 10:42:18

   5 MB/sreceived

   0

   sent5 MB/s

   Click or drag across the chart to inspect a sample.300 / 300 samples

   Connection and Wi-Fi linkLocal macOS readings · no internet probe or Wi-Fi scan

   Local route availableRead at 10:42:14

   Available route interfaces: en0

   en0Wi-Fi link reported

   Signal-52 dBm

   Noise-91 dBm

   Signal / noise39 dB

   Transmit link866 Mbps

   Channel149

   A local route does not prove internet access. Transmit link rate is negotiated Wi-Fi speed, not measured download speed. Network names are not requested.

   Local IP addresses (4)

   Network interfaces1 of 3 physical interfaces marked up · interface names follow macOS; an interface being up does not prove internet connectivityRates at 10:42:18

   en0Physical · Up

   1.8 MB/sreceived + sent

   ↓ 1.6 MB/s18.42 GB received

   ↑ 210 KB/s2.16 GB sent

   en1Physical · Down

   0 B/sreceived + sent

   ↓ 0 B/s0 bytes received

   ↑ 0 B/s0 bytes sent

   en2Physical · Down

   0 B/sreceived + sent

   ↓ 0 B/s0 bytes received

   ↑ 0 B/s0 bytes sent

   Show virtual and tunnel interfaces7 virtual and tunnel interfaces hidden

   Avoid counting the same traffic twiceA VPN can carry traffic through a virtual tunnel and a physical interface. Overview totals use physical interfaces only. Interface totals generally begin at boot or when the interface is created.

   Explore the apps behind the trafficSwitch to Apps & processes for macOS per-process network accounting and socket inspection. Its coverage differs from interface totals. l/Activity reads counters and endpoints without inspecting packet contents or installing a network extension.

2. 02Step 2 of 6

   Step 2. Switch to apps

   In the title bar, click Apps & processes. The card Network by app lists apps with the busiest first, each with its received and sent speed.

   NetworkTraffic through your Mac’s network interfaces.

   InterfacesApps & processesConnectionsSearch or jump to…⌘KPauseRecord

   Process network · every 5s

   Network by app

   Socket accounting from nettop; includes local and virtual traffic. Closed sockets can reset counters. Rates need two readings of the same process lifetime.

   Filter process or PIDInclude idleGroup appsSampled 10:42:13

   App / processReceived / sSent / sSocket totals ↓ / ↑

   Kite Browser23/23 processes reporting1.4 MB/s86 KB/s2.84 GB / 196.2 MB

   Northwind Sync3/3 processes reporting64 KB/s1.1 MB/s418.7 MB / 3.92 GB

   Roundtable5/5 processes reporting310 KB/s290 KB/s612.4 MB / 574.8 MB

   Harbor9/9 processes reporting220 KB/s180 KB/s1.26 GB / 884.3 MB

   Tempo Player2/2 processes reporting96 KB/s2 KB/s214.6 MB / 3.1 MB

   nsurlsessiond1/1 process reporting48 KB/s6 KB/s86.4 MB / 9.8 MB

   Forge IDE14/14 processes reporting12 KB/s4 KB/s48.2 MB / 12.6 MB

   Brightline Mail3/3 processes reporting6 KB/s3 KB/s22.9 MB / 6.4 MB

   mDNSResponder1/1 process reporting3 KB/s2 KB/s4.2 MB / 3.6 MB

   Tessel Design4/4 processes reporting2 KB/s1 KB/s6.8 MB / 1.9 MB

   10 matches · busiest firstPreviousPage 1 of 1Next

   * Measured subtotal; other members are unavailable. — No measured value. Socket totals can reset when connections close.

   Open a process in Processes to inspect numeric connection endpoints. Traffic totals include loopback and VPN paths, so they do not sum to physical interface totals. No packet contents or DNS lookups are collected.

3. 03Step 3 of 6

   Step 3. Widen or narrow the list

   Group apps is ticked, so helpers are added to their app. Untick it for one row per process. Tick Include idle to also list apps that have sockets open but are sending nothing right now. The field above filters by name or PID.

   NetworkTraffic through your Mac’s network interfaces.

   InterfacesApps & processesConnectionsSearch or jump to…⌘KPauseRecord

   Process network · every 5s

   Network by app

   Socket accounting from nettop; includes local and virtual traffic. Closed sockets can reset counters. Rates need two readings of the same process lifetime.

   Filter process or PIDInclude idleGroup appsSampled 10:42:13

   App / processReceived / sSent / sSocket totals ↓ / ↑

   Kite Browser23/23 processes reporting1.4 MB/s86 KB/s2.84 GB / 196.2 MB

   Northwind Sync3/3 processes reporting64 KB/s1.1 MB/s418.7 MB / 3.92 GB

   Roundtable5/5 processes reporting310 KB/s290 KB/s612.4 MB / 574.8 MB

   Harbor9/9 processes reporting220 KB/s180 KB/s1.26 GB / 884.3 MB

   Tempo Player2/2 processes reporting96 KB/s2 KB/s214.6 MB / 3.1 MB

   nsurlsessiond1/1 process reporting48 KB/s6 KB/s86.4 MB / 9.8 MB

   Forge IDE14/14 processes reporting12 KB/s4 KB/s48.2 MB / 12.6 MB

   Brightline Mail3/3 processes reporting6 KB/s3 KB/s22.9 MB / 6.4 MB

   mDNSResponder1/1 process reporting3 KB/s2 KB/s4.2 MB / 3.6 MB

   Tessel Design4/4 processes reporting2 KB/s1 KB/s6.8 MB / 1.9 MB

   10 matches · busiest firstPreviousPage 1 of 1Next

   * Measured subtotal; other members are unavailable. — No measured value. Socket totals can reset when connections close.

   Open a process in Processes to inspect numeric connection endpoints. Traffic totals include loopback and VPN paths, so they do not sum to physical interface totals. No packet contents or DNS lookups are collected.

4. 04Step 4 of 6

   Step 4. Look at one process

   Rows that are exactly one process have an eye button at the end. Click it to open that process, then choose the Connections tab of the sheet. Each socket is listed with its protocol, local and remote address and state.

   NetworkTraffic through your Mac’s network interfaces.

   InterfacesApps & processesConnectionsSearch or jump to…⌘KPauseRecord

   Process network · every 5s

   Network by app

   Socket accounting from nettop; includes local and virtual traffic. Closed sockets can reset counters. Rates need two readings of the same process lifetime.

   Filter process or PIDInclude idleGroup appsSampled 10:42:13

   App / processReceived / sSent / sSocket totals ↓ / ↑

   Kite Browser23/23 processes reporting1.4 MB/s86 KB/s2.84 GB / 196.2 MB

   Northwind Sync3/3 processes reporting64 KB/s1.1 MB/s418.7 MB / 3.92 GB

   Roundtable5/5 processes reporting310 KB/s290 KB/s612.4 MB / 574.8 MB

   Harbor9/9 processes reporting220 KB/s180 KB/s1.26 GB / 884.3 MB

   Tempo Player2/2 processes reporting96 KB/s2 KB/s214.6 MB / 3.1 MB

   nsurlsessiond1/1 process reporting48 KB/s6 KB/s86.4 MB / 9.8 MB

   Forge IDE14/14 processes reporting12 KB/s4 KB/s48.2 MB / 12.6 MB

   Brightline Mail3/3 processes reporting6 KB/s3 KB/s22.9 MB / 6.4 MB

   mDNSResponder1/1 process reporting3 KB/s2 KB/s4.2 MB / 3.6 MB

   Tessel Design4/4 processes reporting2 KB/s1 KB/s6.8 MB / 1.9 MB

   10 matches · busiest firstPreviousPage 1 of 1Next

   * Measured subtotal; other members are unavailable. — No measured value. Socket totals can reset when connections close.

   Open a process in Processes to inspect numeric connection endpoints. Traffic totals include loopback and VPN paths, so they do not sum to physical interface totals. No packet contents or DNS lookups are collected.

5. 05Step 5 of 6

   Step 5. Or browse every connection

   The third view in the title bar, Connections, lists every open socket on the Mac. Choose an app on the left. Select a socket on the right and a card shows which program owns it, where that program lives and who signed it. Show Process takes you to it in Processes.

   NetworkTraffic through your Mac’s network interfaces.

   InterfacesApps & processesConnectionsSearch or jump to…⌘KPauseRecord

   Refresh ConnectionsRefresh every 30 secondsExport

   App, process, PID, or executableAddress, port, protocol, or interface

   ListenersUnix sockets

   Partial coverage318 sockets · 312/486 processes inspected · 174 unavailable · 0 descriptors unreadable · 0 limited · Captured 10:42:07

   All apps137

   Apps

   Brightline Mail6

   cloudd3

   ControlCenter2

   Forge IDE14

   Harbor22

   identityservicesd3

   Kite Browser41

   Lumen Edit3

   Northwind Sync9

   nsurlsessiond4

   Quill Notes2

   rapportd5

   Roundtable12

   sharingd4

   Tempo Player4

   Tessel Design3

   ProcessProtocolLocal endpointRemote endpointStateLocal interface

   Kite BrowserPID 912 · FD 28TCP192.168.1.20:52114203.0.113.41:443Establisheden0

   Kite BrowserPID 912 · FD 31TCP192.168.1.20:52118198.51.100.7:443Establisheden0

   Kite BrowserPID 912 · FD 36UDP192.168.1.20:61204203.0.113.9:443—en0

   Kite Browser HelperPID 934 · FD 22TCP192.168.1.20:52131198.51.100.24:443Establisheden0

   Kite Browser HelperPID 934 · FD 25TCP192.168.1.20:52140192.0.2.18:443Establisheden0

   Kite Browser HelperPID 934 · FD 27TCP192.168.1.20:52162203.0.113.77:443Close waiten0

   Kite Browser HelperPID 934 · FD 30UDP192.168.1.20:58820192.0.2.53:443—en0

   Kite Browser HelperPID 941 · FD 19TCP192.168.1.20:52177198.51.100.112:80Establisheden0

   Kite Browser HelperPID 941 · FD 21TCP192.168.1.20:52183203.0.113.5:443Establisheden0

   Kite Browser HelperPID 947 · FD 18TCP192.168.1.20:52190192.0.2.200:8443Establisheden0

   Kite Browser HelperPID 947 · FD 23TCP192.168.1.20:52204198.51.100.61:443Establisheden0

   Kite Browser HelperPID 952 · FD 17TCP192.168.1.20:52211203.0.113.120:443Establisheden0

   Kite Browser → Kite Browser Helper · PID 934TCP · FD 22

   /Applications/Kite Browser.app/Contents/Frameworks/Kite Browser Helper.app/Contents/MacOS/Kite Browser Helper

   com.kitesoftware.KiteBrowser.helper · Team: K1T3BR0W5R · Signing metadata · not a trust verdict

   192.168.1.20:52131 → 198.51.100.24:443 · Established · Local interface en0

   Show Process

   Addresses stay numeric: no DNS lookup or packet capture. “Local interface” identifies the interface owning a unique local address, not the connection’s route. Wildcard, ambiguous, or unavailable bindings show —. TCP listeners are filtered by their reported listening state; UDP has no TCP listening state.

6. 06Step 6 of 6

   Step 6. Keep a copy if you need one

   Open Export and choose Visible connections as CSV… for what the filters show, or Complete snapshot as JSON… for everything.

   NetworkTraffic through your Mac’s network interfaces.

   InterfacesApps & processesConnectionsSearch or jump to…⌘KPauseRecord

   Refresh ConnectionsRefresh every 30 secondsExport

   App, process, PID, or executableAddress, port, protocol, or interface

   ListenersUnix sockets

   Partial coverage318 sockets · 312/486 processes inspected · 174 unavailable · 0 descriptors unreadable · 0 limited · Captured 10:42:07

   All apps137

   Apps

   Brightline Mail6

   cloudd3

   ControlCenter2

   Forge IDE14

   Harbor22

   identityservicesd3

   Kite Browser41

   Lumen Edit3

   Northwind Sync9

   nsurlsessiond4

   Quill Notes2

   rapportd5

   Roundtable12

   sharingd4

   Tempo Player4

   Tessel Design3

   ProcessProtocolLocal endpointRemote endpointStateLocal interface

   Kite BrowserPID 912 · FD 28TCP192.168.1.20:52114203.0.113.41:443Establisheden0

   Kite BrowserPID 912 · FD 31TCP192.168.1.20:52118198.51.100.7:443Establisheden0

   Kite BrowserPID 912 · FD 36UDP192.168.1.20:61204203.0.113.9:443—en0

   Kite Browser HelperPID 934 · FD 22TCP192.168.1.20:52131198.51.100.24:443Establisheden0

   Kite Browser HelperPID 934 · FD 25TCP192.168.1.20:52140192.0.2.18:443Establisheden0

   Kite Browser HelperPID 934 · FD 27TCP192.168.1.20:52162203.0.113.77:443Close waiten0

   Kite Browser HelperPID 934 · FD 30UDP192.168.1.20:58820192.0.2.53:443—en0

   Kite Browser HelperPID 941 · FD 19TCP192.168.1.20:52177198.51.100.112:80Establisheden0

   Kite Browser HelperPID 941 · FD 21TCP192.168.1.20:52183203.0.113.5:443Establisheden0

   Kite Browser HelperPID 947 · FD 18TCP192.168.1.20:52190192.0.2.200:8443Establisheden0

   Kite Browser HelperPID 947 · FD 23TCP192.168.1.20:52204198.51.100.61:443Establisheden0

   Kite Browser HelperPID 952 · FD 17TCP192.168.1.20:52211203.0.113.120:443Establisheden0

   Kite Browser → Kite Browser Helper · PID 934TCP · FD 22

   /Applications/Kite Browser.app/Contents/Frameworks/Kite Browser Helper.app/Contents/MacOS/Kite Browser Helper

   com.kitesoftware.KiteBrowser.helper · Team: K1T3BR0W5R · Signing metadata · not a trust verdict

   192.168.1.20:52131 → 198.51.100.24:443 · Established · Local interface en0

   Show Process

   Addresses stay numeric: no DNS lookup or packet capture. “Local interface” identifies the interface owning a unique local address, not the connection’s route. Wildcard, ambiguous, or unavailable bindings show —. TCP listeners are filtered by their reported listening state; UDP has no TCP listening state.