How to see which app is using your internet on a Mac

The moment usually arrives the same way. A download crawls, a call stutters, or the monthly data figure from your provider is higher than it has any right to be. Something on the Mac is talking to the internet, and you'd like to know which app it is before you start closing things at random.

macOS keeps this information. It's accurate and it's free. It's just spread across a couple of tools that were built for other jobs, and neither of them keeps the answer where you can see it. This is a short guide to finding out — the built-in way, the Terminal way, and (optionally) the glance-and-forget way.

Where macOS actually shows per-app network use

The built-in home for this is Activity Monitor, in its Network tab.

1. Open Activity Monitor (in /Applications/Utilities, or press ⌘ + Space and type "Activity Monitor").
2. Click the Network tab along the top.
3. Click the Rcvd Bytes column header to sort by data received, or Sent Bytes to sort by data sent.

The process at the top of the list is the one that has moved the most data since Activity Monitor started watching. The graph along the bottom shows your total send and receive rate for the whole machine, updating live.

Why that's harder than it sounds

It works, but it fights you in three ways.

• The per-app figures are cumulative totals, not a live rate. The columns show bytes moved since the tab began sampling, so a process that hammered the network an hour ago can still sit at the top long after it went quiet. Finding what's busy right now means watching which row climbs fastest, by eye.
• The process names are cryptic. The culprit often shows up as something like nsurlsessiond, com.apple.WebKit.Networking, or cloudd rather than the app you'd recognize. Those are system helpers doing work on behalf of other apps, and mapping them back to "Photos is uploading" takes some knowing.
• Nothing stays visible. The numbers only exist while the window is open, and they reset when you quit Activity Monitor. It's a tool you go to, not one that tells you.

The Terminal way: nettop

If you want an actual live rate per process, macOS ships one in Terminal: nettop.

Open Terminal and run:

nettop -P

The -P flag groups activity by process rather than by individual connection. You'll get a table that updates in place, with bytes in and bytes out ticking up live for each process. Press q to quit. For a single snapshot you can pipe instead of watching:

nettop -P -L 1

It's precise and it's already installed. The catch is that it's a dense wall of monospaced text with the same cryptic process names, and it only exists while a Terminal window is open and focused on it. Useful for a one-off investigation; not something you'd keep running all day.

The shortcut: a free menu bar app

This is the small gap that became Bandwidth Meter — a free macOS menu bar app that keeps live upload and download rates next to the clock, and a click away, the per-app breakdown that Activity Monitor makes you dig for.

The menu bar shows current up and down rates at all times. Click it and the popover opens with a live traffic graph, your Wi-Fi and public-IP details, whether the connection is actually reachable, your last speed test, and a per-app traffic table — sorted by who's using the most, updating continuously, no columns to babysit.

A few details that matter:

• Free and open source under MIT. The source is on GitHub.
• No telemetry. Traffic is measured locally on your Mac. The app phones home for one thing only: checking its update feed. Nothing about your network, your apps, or your usage is sent anywhere.
• No helper processes, no installer. It reads the same system network counters the built-in tools use. Nothing is left running behind it, and nothing lingers after you delete it.
• macOS 26.4 or later, Apple Silicon. Signed and notarized by Apple, with Sparkle handling updates from there.

Get Bandwidth Meter →

If you'd rather stick to the built-ins

Nothing wrong with that — the tools are already on your Mac. Here's the short version to keep:

• Activity Monitor → Network tab. Sort by Rcvd Bytes or Sent Bytes to see who has moved the most. Remember the figures are running totals, not live rates.
• nettop -P in Terminal. Live per-process rates in real time. Press q to exit. Dense, but honest.
• Watching the aggregate. Activity Monitor's bottom graph, or the send/receive figures, tell you whether anything is busy before you go hunting for what.

Between them you can answer almost any "what's using my connection" question. It's a couple of tools and a bit of squinting more than a single glance, which is the whole reason a menu bar readout exists.

Common questions

How do I see which app is using the most data on my Mac?

Open Activity Monitor, switch to the Network tab, and sort by Rcvd Bytes or Sent Bytes. The top process has moved the most data since the tab started sampling. For a live rate rather than a running total, use nettop in Terminal or a menu bar app that shows per-app throughput continuously.

Does macOS have a built-in bandwidth monitor in the menu bar?

No. The menu bar shows Wi-Fi signal strength, but not upload and download throughput. To see live network rates you need Activity Monitor, the nettop command, or a third-party menu bar app built for it.

Why is my Mac using so much data in the background?

The usual suspects are iCloud and Photos syncing, Time Machine backing up to a network destination, macOS or App Store updates downloading, Spotlight re-indexing cloud content, and browser tabs left open on pages that refresh themselves. The Network tab or a per-app traffic view will show which one is responsible, often hiding under a system process name like nsurlsessiond or cloudd.

Either way, the answer to "what's using my internet right now?" is sitting on your Mac already. Now you know the three places to find it, and how much squinting each one costs.