Which App Is Using the Internet on My Mac?

Quick answer: To see which apps are using the internet on your Mac, open Activity Monitor (Applications > Utilities), click the Network tab and sort by Sent Bytes or Rcvd Bytes. For live per-process detail, run nettop -P in Terminal, and run sudo lsof -i to see which servers each app, including system processes, is connected to.

Your Mac talks to the internet even when it looks idle. Apps check for updates, sync data, send telemetry, and sometimes do things you didn't explicitly ask for. Here's how to find out exactly which apps are using the internet on your Mac, using both built-in tools and some third-party options that'll give you a much clearer picture.

Activity Monitor's Network Tab: Your First Stop

Activity Monitor is right there in /Applications/Utilities/Activity Monitor.app, and it's honestly the easiest place to start. Open it up and click the Network tab at the top.

You'll see a list of every process currently sending or receiving data, along with how much data they're moving. The columns show "Sent Bytes" and "Rcvd Bytes" — that's data going out from your Mac and data coming in.

What you're looking for here are processes that are moving significant amounts of data when you're not actively using them. Chrome sitting at 50MB sent when you haven't touched it in an hour? That's worth investigating. An app you've never heard of that's consistently at the top of the list? Definitely suspicious.

The thing is, those numbers are totals since each process started, and a process that has quit drops off the list. Activity Monitor won't tell you when the data moved. For that, you need to catch apps in the act.

Using nettop to See Real-Time Network Activity

The terminal isn't scary once you get past the initial learning curve. Open Terminal (it's in /Applications/Utilities/Terminal.app) and run this command:

nettop -P

The -P flag shows you per-process network usage. You'll get a constantly updating view of which processes are using your network connection right now. It looks something like this:

nettop: listing processes by network usage
    PID COMMAND      SENT      RCVD      
   1234 Chrome       2.5MB     15.2MB    
   5678 Mail         156KB     892KB     
   9012 Spotify      45KB      1.2MB     

Press q to quit when you're done watching. This is more detailed than Activity Monitor and updates every second, so you can see what's happening as it happens.

Finding Which Apps Are Connected Right Now with lsof

If you want to see which apps have active network connections — not just data transfer, but actual open connections to remote servers — use lsof:

lsof -i

This shows every open internet connection on your Mac. You'll see output like:

COMMAND    PID     USER   FD   TYPE DEVICE SIZE/OFF NODE NAME
Chrome    1234   hassanain   45u  IPv4 0x12345      0t0  TCP 192.168.1.100:54321->server.example.com:443 (ESTABLISHED)
Mail      5678   hassanain   12u  IPv4 0x67890      0t0  TCP 192.168.1.100:54322->mail.icloud.com:993 (ESTABLISHED)

The important parts: COMMAND (the app), PID (process ID), and NAME (what server it's connected to). If you see connections to domains you don't recognize, that's your cue to dig deeper.

You can also filter this by specific ports. Want to see what's using HTTPS connections?

lsof -i :443

Or check for any suspicious connections on non-standard ports:

lsof -i :8080

Understanding What's Normal vs. Suspicious

Here's where experience matters. Some network activity is completely normal and expected:

Apple's own processes connect to apple.com, icloud.com, mzstatic.com (App Store), and push.apple.com (push notifications). You'll also see connections to ocsp.apple.com for certificate validation and configuration.apple.com for system updates.

Browsers like Chrome and Safari constantly maintain connections to Google's servers, CDNs, and whatever websites you have open. Even when you close all tabs, they might keep some connections alive for performance.

Apps like Dropbox, OneDrive, and Google Drive will always show network activity — that's literally their job.

What should make you suspicious? Apps you don't remember installing that are consistently using network resources. Processes with generic names like "agent" or "daemon" connecting to random IP addresses instead of recognizable domains. Any app using way more bandwidth than it should need for its function.

Little Snitch: The Network Activity Firewall

If you want to get serious about monitoring network activity, Little Snitch is a network monitor and application firewall for Mac. It's paid (see its maker's site for the current price), and it shows you connection attempts as they happen and lets you block specific apps or connections.

When you first install Little Snitch, it'll ask about a lot of connections. That's actually the point — it's showing you just how chatty your Mac really is. After a few days of setting up rules, you'll have a much clearer picture of what each app is trying to do online.

Because it filters at the system level rather than inside one app, it sees connections from background processes too, not only from the apps in your Dock.

LuLu: The Free Alternative

If you don't want to spend money on Little Snitch, LuLu is a free, open-source outbound firewall that does similar monitoring. It's made by Objective-See, which also makes KnockKnock and other focused Mac security tools.

LuLu shows you outgoing connections and lets you create rules to allow or block them. It's not quite as polished as Little Snitch, but it's completely free and does the job for basic monitoring.

You can download it from objective-see.com/products/lulu.html. The interface is simpler than Little Snitch, which honestly might be a good thing if you just want to see what's connecting without getting overwhelmed.

What System Settings Won't Show You

macOS has no per-app data-usage history in System Settings. Activity Monitor's totals are the closest built-in view. For history over hours or days, log nettop to a file (see below) or use a monitor like Little Snitch or LuLu.

What to Do When You Find Something Suspicious

Let's say you've found an app that's using more network resources than it should, or connecting to servers you don't recognize. How to find hidden apps on Mac can help you track down exactly what's running on your system.

First, don't panic and start killing processes randomly. Note down the process name, PID, and what servers it's connecting to. Then:

Search for the process name online. Many legitimate processes have obscure names — nsurlsessiond handles network requests for other apps, cloudd manages iCloud syncing, trustd handles certificate validation.

Check the app's location using Activity Monitor. Right-click on the process and select "Open Files and Ports" to see what files it has open, or use:

lsof -p [PID]

Replace [PID] with the actual process ID number.

If you're still suspicious, you can temporarily block the app's network access using Little Snitch or Lulu to see what breaks. If nothing important stops working, that's a good sign the network activity wasn't necessary.

Monitoring Network Activity Over Time

One limitation of all these tools is that they mostly show you what's happening right now. If you want to track network usage patterns over time, you'll need to get a bit more creative.

You can use nettop to log network activity to a file:

nettop -P -L 0 -s 60 >> ~/network_log.csv

This takes a per-process sample every 60 seconds and appends it, as comma-separated lines, to a file in your home directory until you press Control-C. Let it run for a few hours or overnight, then open the log to see which apps are most active when you're not using your Mac.

To be fair, this is probably overkill for most people. But if you're dealing with a Mac that seems slow or you're worried about data usage on a metered connection, it can be really helpful.

Common Network Hogs and What They're Doing

Some apps are just naturally network-heavy, and that's not necessarily suspicious:

Browsers — Chrome, in particular, can use hundreds of megabytes even when "idle" because of background tabs, extensions, and sync services.

Cloud storage apps — Dropbox, OneDrive, Google Drive are constantly syncing. If you just added a bunch of files, they might transfer gigabytes.

Streaming apps — Spotify, Apple Music, and video apps cache content in the background.

Software updaters — Apps checking for updates, downloading them in the background. Adobe Creative Suite is notorious for this.

System processes — macOS itself downloads security updates, App Store updates, and system data regularly.

The key is learning what normal looks like for your specific Mac and usage patterns. CoreLock's Network screen can help here. It lists your apps' open connections by IP address and port. Knowing what's normal for your Mac still matters, because a connection list alone doesn't tell you which ones you expected.

When Built-In Tools Aren't Enough

Honestly, there are some things that Activity Monitor and even lsof won't catch. Sophisticated malware can hide network connections or route them through legitimate processes. Some apps use system-level network APIs that don't show up cleanly in process lists.

If you suspect something more serious is going on, our guide on checking for unauthorized network connections covers more advanced techniques. And if you want a comprehensive security scan, what a free Mac security scan actually finds shows you exactly what you can expect from automated tools.

The Bottom Line on Network Monitoring

Learning to monitor network activity on your Mac isn't paranoia — it's basic digital hygiene. Your Mac is constantly communicating with servers around the world, and you should know what those conversations are about.

Start with Activity Monitor's Network tab to get a feel for what's normal. Graduate to nettop and lsof when you want more detail. Consider Little Snitch or Lulu if you want ongoing monitoring and control.

The goal isn't to block everything — it's to understand what's happening so you can make informed decisions. Some network activity is necessary and beneficial. Some isn't. The tools I've shown you will help you tell the difference.

Most of what you'll find is ordinary: updates, sync and the sites you have open. Not all of it is malicious, but all of it is worth understanding. Your Mac's network activity is like a window into what your apps are really doing when you're not looking.