How to See Network Traffic on a Mac: Who Is Downloading
Who is using the network and how much: per-app traffic in Activity Monitor and nettop, live speed in a desktop widget, and Low Data Mode.
Open Activity Monitor, go to the Network tab and sort by Rcvd Bytes: whatever is downloading the most rises to the top, and the bottom of the window shows overall traffic and speed. In Terminal, nettop shows traffic per process.
There are two different questions here: “who is downloading?” and “how fast is it right now?” The first is answered by a list of processes, the second by a gauge that is always in view.
Who is downloading: Activity Monitor
Open Activity Monitor (⌘-Space, type “activity”, press Return) and go to the Network tab. Each process has four columns: Sent Bytes, Rcvd Bytes, Sent Packets and Rcvd Packets.
- Who is downloading — sort by Rcvd Bytes;
- who is uploading — sort by Sent Bytes: that’s how you spot, say, a backup to the cloud.
These are amounts, not speeds: an app that downloaded a lot an hour ago stays near the top even if it has long gone quiet. To see who is downloading right now, watch whose number keeps growing.
The bottom of the window has the totals: packets in and out, data received and sent — overall and per second. The graph next to them switches between Packets and Data; for “how much are we downloading” you want Data. And View → Dock Icon → Show Network Usage turns Activity Monitor’s Dock icon into a live network graph.
The other tabs are covered in the Activity Monitor guide.
The same in Terminal: nettop
nettop -P
nettop shows network activity and refreshes every second; -P collapses
the connections into one line per process. The bytes_in column is data
received, bytes_out is data sent. Press d to switch to the difference
between refreshes, which shows who is downloading right now. Press q to
quit.
Without -P, each process lists its connections with addresses — handy
when you want to know where a process is talking to. And
nettop -P -t expensive keeps only “expensive” interfaces, which is how
macOS marks, for example, a Personal Hotspot from an iPhone.
How much per day or per month
Here macOS is more modest than the iPhone. The Network and Wi‑Fi sections
of System Settings have no traffic statistics — neither per app nor a
monthly total like Cellular on an iPhone. Activity Monitor and nettop
show running totals, but not broken down by day, and a process
disappears from the list, numbers and all, once it quits.
If you need to count traffic per month — on a capped plan, say — your carrier’s account or your router’s counter is the more reliable place.
Speed always in view
Rather than keeping Activity Monitor open, you can put the speed on the desktop or in the menu bar:
- a desktop widget is visible whenever your windows are out of the way and updates no more than once a minute. How to add one is in the guide to Mac widgets;
- a menu bar monitor is always visible and updates more often. The options are compared in menu bar system monitors. Per-app traffic right in the menu bar is something full-featured monitors such as iStat Menus can do — what each one offers and costs is in the system monitor comparison.
Mobile data and iPhone hotspot
If your Mac is on a Personal Hotspot or a capped network, turn on Low Data Mode: System Settings → Wi‑Fi → Details… next to the network → Low Data Mode. Apple says it reduces your data usage over the selected Wi‑Fi network. The setting is remembered for that network; other networks work as usual.
An example of what changes: iCloud Photos pauses automatic syncing while Low Data Mode is on.
Suspicious traffic
Big numbers usually have boring explanations:
- updates to macOS and apps;
- iCloud — Drive, Photos, backups;
- Time Machine, if it backs up to a network drive;
- Photos syncing after an import or a fresh sign-in.
What to check if an unfamiliar process is sending a lot:
- Find it on the Network tab and double-click it to open the process window. The Open Files and Ports tab shows where the app lives and which files it has open.
- Look at its connections in
nettopwithout-P: where it goes. - If you didn’t install the app or don’t recognize it, quit it and uninstall it rather than just ending the process — otherwise it comes back.
There’s no need to quit macOS system processes: they settle down once they’re done.
In the app
Mac Resources answers the second question — “how fast right now” — but not the first: it has no per-app traffic, because the macOS sandbox doesn’t give access to other processes. There’s no daily or monthly total either.
- Network — a medium widget: download and upload speed with an hour-long graph;
- System and Last Hour — network as a single number: the larger of download and upload, with a ↓ or ↑ arrow.
The speed is an average since the previous reading, not over the last second: in a quiet network a one-second reading would show zero while traffic is flowing. Only interfaces with a route to the network are counted, and VPN tunnels are excluded — otherwise the same traffic would be counted twice. The menu bar badge has no network figure: speed has no upper limit to take a percentage of. Widgets update once a minute; the app is free and runs on macOS 14 and later.
For the full guide to the tool that answers “who”, see Activity Monitor.