See network usage per process on Mac

Total bandwidth use is easy enough to read — the menu bar Wi-Fi icon or your router will tell you. Breaking it down by process is where macOS gets tight-lipped. Whether you’re chasing a leak, debugging a sync tool, or just curious, here’s how to get per-process numbers.

The toolbox

nettop (built-in, the real deal)

nettop is Apple’s per-process network monitor. It’s not pretty, but it’s accurate.

1. Open Terminal.
2. Run sudo nettop -P -m route -J bytes_in,bytes_out,rx_dupe,re-tx.
3. -P aggregates by process, -m route picks the mode, -J selects columns.
4. Press d to toggle delta mode (per-interval rather than cumulative).
5. Press q to quit.

Save a snapshot: sudo nettop -P -L 1 > nettop.txt (the -L 1 means take one sample then exit).

Activity Monitor: Network tab

GUI alternative. Sort by Sent Bytes/sec or Rcvd Bytes/sec for live; sort by Sent/Rcvd Bytes for cumulative-since-start totals. Useful, but the numbers reset whenever a process restarts.

lsof (for “what’s connected to where”)

If you want to know not just how much, but where a process is talking to:

sudo lsof -i -P -n | grep ProcessName

You’ll see remote IPs and ports — handy for spotting “why is this app talking to a server in Singapore?”

A menu bar monitor

For ongoing awareness, a menubar readout is the lowest-friction option. Beacon shows live up/down throughput in the bar and a per-process breakdown one click away.

1. Install Beacon.
2. Enable Network in Settings > Menu Bar — pick combined speed, separate up/down, or a sparkline.
3. Click the readout — the top processes appear with current Kbps, no terminal needed.

Notes on accuracy

A few things worth knowing when comparing numbers:

• Apple counts at the socket layer, not the wire — encrypted overhead and TCP retransmits aren’t perfectly reflected.
• Cumulative counters reset when the process exits. A browser restart zeroes its total.
• Background activity from kernel_task or mDNSResponder doesn’t always attribute cleanly to a single user app.
• For a real-wire-level view, you’d need tcpdump on the interface — overkill for most cases, essential when you need certainty.

For day-to-day “what’s hogging the connection” questions, nettop or a menu-bar monitor is plenty. tcpdump is the nuclear option you save for when something is lying to you.