Check a Mac for Unauthorized Network Connections

Quick answer: To see which processes on your Mac have network connections, open Activity Monitor's Network tab, or run sudo lsof -i -P -n | grep ESTABLISHED in Terminal to list each connection with its process and remote address. A connection deserves a closer look when you can't tie its process to an app you installed or to macOS itself; then check the file path, the code signature and who owns the remote address.

Below: what normal traffic looks like, three ways to see your connections, how to investigate one step by step, and the common false alarms.

Learning to see what your Mac is doing on the network is worth it before you install any security tool. Once you know what normal traffic looks like, the connection that doesn't belong stands out.

What "Normal" Network Activity Looks Like

Before you start hunting for threats, you need to know what legitimate traffic looks like. Otherwise, you will scare yourself into thinking every connection is suspicious.

Your Mac runs dozens of system services that make outbound connections as part of normal operation. Here are the most common ones:

• cloudd handles iCloud syncing for files, photos, and keychain data. It connects to icloud.com and icloud-content.com frequently.
• trustd checks certificates, including OCSP checks that confirm a certificate hasn't been revoked. It connects to ocsp.apple.com regularly.
• mds and mds_stores build the Spotlight search index. That indexing work happens on your Mac.
• nsurlsessiond manages background downloads for the system and apps. Software updates, App Store content, and iCloud data all flow through this process.
• sharingd manages AirDrop, Handoff, and Universal Clipboard. It's active on your local network even when you are not actively sharing anything.

Common Apple domains you will see include apple.com, icloud.com, icloud-content.com, cdn-apple.com, and mzstatic.com. If your connections are going to these places, that is Apple's infrastructure doing its job.

Then there are your apps. Browsers are the noisiest: a single web page can open connections to dozens of servers, and browsers split their work across many helper processes. Slack, Spotify, Dropbox, and most modern apps keep persistent connections to their servers. This is expected.

The point is not to panic at the volume. The point is to establish a baseline so you can spot the one connection that does not belong.

Method 1: Activity Monitor Network Tab

The simplest approach is built right into macOS.

1. Open Activity Monitor (Applications > Utilities > Activity Monitor) and click the Network tab.
2. Click the Sent Bytes column header to sort by how much each process has sent since it started. Rcvd Bytes shows what it received.
3. Look at the Sent Packets and Rcvd Packets columns too. A process with many packets but few bytes is sending lots of small messages.
4. Double-click a process you don't recognize, then open the Open Files and Ports tab to see its open files and network sockets.

The top entries will usually be your browser, iCloud services, and any streaming apps. That is normal. What you are looking for is a process you do not recognize that is sending a significant amount of data. Activity Monitor shows totals, not where the data went, so for real visibility you need Terminal.

Method 2: Terminal Commands

Terminal gives you far more detail than Activity Monitor. Here are three commands, each with a different strength.

See all active connections

sudo lsof -i -P -n | grep ESTABLISHED

This lists every process with an active, established network connection. Without sudo, lsof only shows processes running under your own account, so anything running as root is missing. -P shows port numbers instead of service names, and -n skips hostname lookups so the command returns quickly. The output looks something like this:

Google    1234 hassanain  45u  IPv4 0x1a2b3c  TCP 192.168.1.5:54321->142.250.80.46:443 (ESTABLISHED)
cloudd    5678 hassanain  12u  IPv4 0x4d5e6f  TCP 192.168.1.5:54987->17.57.144.20:443 (ESTABLISHED)
Spotify   9012 hassanain  22u  IPv4 0x7a8b9c  TCP 192.168.1.5:55123->35.186.224.45:443 (ESTABLISHED)

Here is how to read it: the first column is the process name, the second is the PID (process ID), then the user, then the connection details. The part after the arrow (->) is the remote server — the IP address and port your Mac is talking to. Port 443 means HTTPS, which is standard encrypted web traffic.

If you want to see all connections, not just established ones, drop the grep:

sudo lsof -i -P -n

This shows LISTEN states too, which are ports your Mac has open and waiting for incoming connections.

Alternative: netstat

netstat -an | grep ESTABLISHED

This shows a similar view but without process names — just IP addresses and ports. It is faster to run and useful when you want a quick count of how many connections are active. Use lsof when you need to know which process owns a connection and netstat when you just want the big picture.

Live monitoring

nettop -m tcp

This is the most detailed built-in tool. It gives you a continuously updating view of TCP connections on your Mac, grouped by process, with bytes in and out, connection state, and remote addresses.

Press h for the list of keys and q to quit. Spend five minutes watching nettop while you use your Mac normally. You will quickly get a sense of which processes are chatty and which are quiet. If something new shows up that you did not trigger, that is worth investigating.

Method 3: Investigating a Suspicious Connection

So you spotted a connection that looks off — maybe a process you do not recognize connecting to an IP address you have never seen. Here is how to investigate it step by step.

Step 1: Get the process details

Take the PID from the lsof output and run:

ps -p [PID] -o pid,user,command

Replace [PID] with the actual number. This shows the full command that launched the process, including its file path and any arguments. A typical app has a path like /Applications/AppName.app/Contents/MacOS/AppName. Something running from /tmp, /var/folders, or a Downloads folder deserves a closer look.

Step 2: Find the executable

lsof -p [PID] | grep txt

The lines marked txt show the executable file and shared libraries the process has loaded. The first txt entry is the main binary.

Step 3: Check the code signature

codesign -dv --verbose=4 /path/to/binary

This tells you who signed the software and whether the signature is valid. For an app from an identified developer, you'll see the developer's name and Authority=Apple Root CA at the end of the chain. "code object is not signed at all" is worth a closer look, although command-line tools you installed yourself are often unsigned or signed ad hoc.

Step 4: Look up the remote IP

nslookup [IP]

Replace [IP] with the remote address from the lsof output. This performs a reverse DNS lookup and tells you the hostname associated with that IP, if there is one. If it resolves to something like ec2-34-209-xxx.us-west-2.compute.amazonaws.com, you know it is an AWS server — which could be almost any company's service. If it resolves to a domain you recognize (google.com, apple.com, cloudflare.com), you can relax.

For IPs that do not resolve to anything meaningful, search them on ipinfo.io or abuseipdb.com to see who owns the address and whether others have reported it.

What Suspicious Connections Look Like

These patterns are worth a closer look:

Addresses with no hostname and no clear owner. Many legitimate servers have no reverse-DNS name either, so treat this as a reason to look up who owns the address, not as proof of anything.

Unknown processes on non-standard ports. Web traffic uses ports 80 and 443. DNS uses 53. If a process you do not recognize is connecting on port 8443, 4444, 8080, or some other non-standard port, investigate it.

Large amounts of data being sent. Most apps receive far more data than they send; backup and sync apps are the obvious exception. If a process you can't identify is uploading a lot of data to an unknown server, find out what it is. Check the "Sent Bytes" column in Activity Monitor or watch the upload numbers in nettop.

Connections that persist after you close everything. Close all your apps and browser windows. Wait a minute. Then run sudo lsof -i -P -n | grep ESTABLISHED again. You will still see system services (cloudd, trustd, nsurlsessiond), but you should not see unfamiliar processes maintaining connections.

Processes you did not start. If a process name means nothing to you and it is making network connections, that is worth a full investigation using the steps above. Not everything unknown is malicious — macOS has plenty of obscure helper processes — but you should always be able to trace a connection back to something you installed or something Apple ships. Here is our full guide on identifying hidden processes.

Common False Alarms

Before you start worrying, here are some things that look suspicious but are normal:

nsurlsessiond transferring large amounts of data. This usually means a software update or iCloud sync is happening. It is Apple's background download manager, and large transfers are part of its job.

mDNSResponder making many connections. It handles DNS lookups for the whole system, plus Bonjour and local network discovery. It is chatty by design, especially on networks with other Apple devices.

trustd connecting to OCSP servers. macOS checks the certificates of signed apps and secure websites, and trustd makes those checks. Normal.

Your browser showing dozens of connections. Each tab, extension and embedded page element can open its own connections. A long list of browser helper processes with open network sockets is normal, not a sign of compromise.

symptomsd and CommCenter making connections. symptomsd is macOS's network diagnostics daemon: it watches connection quality and helps macOS choose between networks. CommCenter handles cellular and calling features, such as taking iPhone calls on your Mac. Both are part of macOS.

If you are still unsure whether something is legitimate, search the process name along with "macOS" online. Between Apple's documentation and community forums, most system processes are well documented. We also have pages on common macOS processes, such as trustd, cloudd and symptomsd.

How CoreLock Can Help

Everything described above works. But it is manual, it is time-consuming, and it requires you to know which commands to run and how to interpret the output. Most people will do it once, find it interesting, and never do it again.

CoreLock is my product, so weigh this accordingly. Its free scan includes a network check: it reports services on your Mac that are listening for connections from other devices (not just from the Mac itself), and it recognizes port 11434 as the usual port of Ollama, a local AI model server. A listening address alone doesn't prove that another device can connect or that the service is reachable from the internet, so treat a listener as something to look at, not as proof of exposure.

The same scan checks running apps, app permissions, startup items, AI agents and the Downloads folder, and it runs without an account, as often as you like. CoreLock has no per-app allow or block rules; its Shields switch the macOS Firewall and Stealth mode on or off. If you want allow and block rules per app, Objective-See's LuLu is a free, open-source outbound firewall, and Little Snitch is a network monitor and application firewall.

If you want a second look at what's listening on your Mac without memorizing lsof flags, download CoreLock for free.

Your Mac's network is not a black box. Connections can be traced to a process, and processes can be identified. The tools are already on your machine. You just need to know where to look.