Every process, daemons included
Apps, helpers and system daemons that run as root all show up, without running anything as root yourself.
Every connection, per app, live
See which app is using the internet on your Mac, what it connects to, and how much data each connection moves, updated every second.
| ▾ Google Chrome Helper | PID 43350 | ↓ 1.2 MB/s ↑ 40 kB/s | ↓ 18.7 MB ↑ 4.2 MB | 13 | |
| 142.250.74.78:443 | www.google.com | TCP | ↓ 12.1 MB ↑ 1.9 MB | ESTABLISHED | |
| [2606:4700::6812:202f]:443 | chatgpt.com | TCP | ↓ 3.3 MB ↑ 610 kB | ESTABLISHED | |
| unconnected UDP | UDP | ↓ 3.3 MB ↑ 1.7 MB | UNCONNECTED | ||
| ▾ Slack Helper | PID 1882 | ↓ 8 kB/s ↑ 2 kB/s | ↓ 2.4 MB ↑ 380 kB | 4 | |
| 44.237.180.172:443 | wss-primary.slack.com | TCP | ↓ 1.9 MB ↑ 310 kB | ESTABLISHED | |
| ▸ Spotify | PID 2210 | ↓ 410 kB/s | ↓ 64.0 MB ↑ 1.1 MB | 6 | |
| ▸ macOS processes | ↓ 9.8 MB ↑ 2.6 MB | 41 |
Illustration of the Activity view.
Bytes per connection and per app
Downloaded and uploaded bytes for each connection, rolled up per app. The counters match what macOS’s own nettop reports.
Live rates
Each app’s current download and upload speed, refreshed once a second, so you can see what’s busy right now.
The domain behind each IP
Connections are labelled with the name the app actually looked up, like www.google.com, instead of a bare address.
QUIC and other UDP traffic
Unconnected UDP sockets, such as Chrome’s QUIC, talk to many servers at once. They’re grouped into one row per app so the totals still add up.
Search, filter, jump to the map
Search by app, address or domain, show only active connections, and right-click an app to see its connections on the world map.
How it works
LightAtom reads the same kernel network statistics that the nettop command uses. That gives it every TCP and UDP socket on the Mac, with cumulative byte counters, without root and without capturing packets.
It never reads what’s inside your traffic. The one narrow exception is the optional domain-name helper, which reads DNS answers only (see Domain names).
Per-app totals include every byte of each connection seen since LightAtom started, and don’t shrink when connections close. Rates are the change in bytes between one-second scans.
Questions
How do I see which app is using the internet on my Mac?
Open LightAtom: every app with a network connection is listed with its live download and upload rate. Sort by rate to see what’s using the most right now, or expand an app to see each server it’s connected to.
Does LightAtom need administrator rights?
No. It sees every process, including root daemons, as a normal user. Showing domain names needs a small helper that you approve once in System Settings.
Does it read my traffic?
No. It reads connection lists and byte counters from the kernel, never packet contents. The optional domain-name helper reads DNS answers only.
How is this different from Activity Monitor?
Activity Monitor’s Network tab shows how many bytes each process sent and received, but not where. LightAtom shows each remote server, the domain behind it and the bytes per connection.
Can LightAtom block connections?
No. LightAtom shows what’s happening; it doesn’t block or change any traffic. If you want to block apps, use a firewall alongside it.