How to see which app is using the internet on a Mac, with nettop
nettop lists data in and out per process. On our Mac the top three were all macOS: apsd, mDNSResponder and a browser helper. How to read it and what is normal.
How do I see network use per app?
Activity Monitor's Network tab lists bytes sent and received per process since it started. In Terminal, nettop gives the same per process view:
nettop -P -L 1 -J bytes_in,bytes_out -x | sort -t, -k2 -nr | head -15| Process on our Mac | Received | Sent | What it is |
|---|---|---|---|
apsd | 14.2 MB | 1.2 MB | Push notifications |
mDNSResponder | 11.3 MB | 5.5 MB | DNS lookups and Bonjour |
| A Chrome helper | 10.8 MB | 2.8 MB | Web pages |
| An editor's plugin helper | 101 KB | 101 KB | Extension traffic |
netbiosd | 28 KB | 156 KB | Windows network names |
rapportd | 18 KB | 5 KB | Talking to your other Apple devices |
Totals are since each process started. The two biggest were macOS itself: see apsd and mDNSResponder.
What is normal?
Push, DNS, iCloud and the browser should lead. Background downloads show up as nsurlsessiond. Anything unknown sending a lot is worth looking up before you block it.
See it live
Free Mac's System tab shows network throughput live beside processor, memory and battery, and opens into per process detail. See also rapportd.
Related: Compressed memory explained and Wired memory explained.
Common questions
How do I see which app is using the internet on a Mac?
Activity Monitor's Network tab, or nettop -P in Terminal, which lists bytes in and out per process.
What is apsd and why does it use so much data?
Apple's push notification service. All push traffic goes through it; it received 14 MB in 30 hours on our Mac.
Is it normal for macOS processes to use the network?
Yes. Push, DNS, iCloud and updates are usually the biggest users.