How to see which app is using your network on a Mac

The quick answer

Open Activity Monitor (⌘ Space, type “Activity Monitor”) and click the Network tab. Click the Sent Bytes or Rcvd Bytes column header to sort. The top rows are the processes that have moved the most data since they started.

That’s totals, not right now. For live per-process speed, use Terminal:

nettop -P -d

• -P shows one line per process instead of every connection.
• -d is delta mode: each refresh shows bytes since the last one, so busy processes stand out.
• Press q to quit, h for help.

A one-shot list you can sort

nettop has a logging mode that prints one sample and exits, which is handy for grep and sort:

nettop -P -L 1 -J bytes_in,bytes_out -x \
  | sort -t, -k2 -nr | head -10

mDNSResponder.712,757294864,167354773,
com.apple.WebKit.Networking.4122,312004211,9120338,
Dropbox.1503,120558120,88410221,

Each line is process.pid,bytes_in,bytes_out. Change -k2 to -k3 to sort by upload instead of download.

mDNSResponder near the top is normal: it handles DNS for every app, so it sees lots of small packets.

“Helper” isn’t an answer

Browsers and Electron apps do their networking in helper processes. In Safari it’s com.apple.WebKit.Networking; in Chrome, a Google Chrome Helper running the network service (--utility-sub-type=network.mojom.NetworkService in its command line); in Slack, Discord and VS Code, a ... Helper. To see which app owns a helper, look up its parent:

ps -o pid,ppid,command -p <pid>

System daemons are a separate case. nsurlsessiond downloads on behalf of other apps, cloudd and bird handle iCloud Drive, and softwareupdated fetches macOS updates. If one of those is busy, the cause is a sync or update, not the daemon itself.

Common culprits

Process	Usually means
nsurlsessiond	Background downloads for an app or the App Store
cloudd, bird	iCloud Drive or Photos syncing
softwareupdated	macOS update downloading
backupd	Time Machine to a network disk
com.docker.backend	A container pulling an image or serving traffic
Dropbox, Google Drive	File sync after a big change

What to do about it

• Pause it: most sync apps have a pause button in their menu bar icon. For iCloud Photos, Photos › Settings › iCloud has a pause option.
• Quit it: if it’s a helper you don’t recognize, quit its parent app and see if the traffic stops.
• Check it isn’t phoning home unexpectedly: nettop without -P lists each connection with its remote address, so you can see where data is going.
• Turn on Low Data Mode on a metered network: System Settings › Wi-Fi › Details next to your network › Low Data Mode. It asks apps to hold off background transfers.

If the network is slow but no app is busy, the problem is probably the connection itself: see how to check network latency. To track how much you use over a month, see tracking data usage.

Seeing it live

Stat Space shows live upload and download in the menu bar and the top network processes for free. Its Network by app section is a Pro feature: upload and download per app, with Chrome helpers, WebKit networking and Electron helpers grouped into the app that owns them, and totals since launch. It reads the same NetworkStatistics data nettop uses, and samples only while that section is on screen. Pro also adds “who’s phoning home”, a read-only list of remote hosts per app.

It shows traffic; it doesn’t block it. Blocking needs a network extension, which Stat Space deliberately doesn’t install.