nettop -PLive network traffic per process (press q to quit).
When to use it
Use these checks when the network is busy and you don't know why, when you're curious which servers an app talks to, or when you want to make sure nothing unexpected is sending data.
Steps
1. Activity Monitor: who uses the most data
Open Activity Monitor › Network tab and sort by Sent Bytes or Rcvd Bytes. You see totals per process, but not where the data goes.2. Terminal: where connections go
nettop -Pshows live traffic per process. lsof lists each connection's remote address and port.lsof -nP -i -sTCP:ESTABLISHEDTranslate addresses to owners
Look up remote addresses with dig -x (reverse DNS) or whois to see who owns them.dig -x 17.253.144.10 +short3. A network monitor app
Apps such as LightAtom combine the two: every process, its connections, the domain names behind the addresses, byte counts and a map, updated live.
Output explained
A few lines from lsof -nP -i -sTCP:ESTABLISHED on a Mac:
COMMAND PID USER … NAME
rapportd 478 jane … TCP [fe80::5f:daca:262:290f]:55046->[fe80::44a:8f3:2321:3fbe]:65067 (ESTABLISHED)
Safari 1201 jane … TCP 192.168.1.23:60330->17.253.144.10:443 (ESTABLISHED)
- rapportd talks to another Apple device on the local network (fe80:: addresses are link-local): that's Continuity, such as Handoff with your iPhone.
- Safari has an HTTPS connection (port 443) to 17.253.144.10, which reverse DNS and ASN lookups show belongs to Apple.
Many system processes (mDNSResponder, nsurlsessiond, apsd, cloudd) connect regularly; that's normal macOS behaviour.
Options and variations
| Flag | Meaning | Example |
|---|---|---|
| nettop -P | Collapse to one row per process | nettop -P |
| nettop -m tcp|udp | Only TCP or UDP sockets | nettop -m tcp |
| lsof -i -sTCP:ESTABLISHED | Only active TCP connections | lsof -nP -i -sTCP:ESTABLISHED |
| sudo lsof … | Include processes of other users and root | sudo lsof -nP -i |
Common errors
| Error | Cause | Fix |
|---|---|---|
| lsof shows few system processes | Root-owned processes need sudo | Run sudo lsof -nP -i. |
| Addresses don't tell you much | CDNs and cloud hosting hide the real service | Use the domain name instead; LightAtom's DNS helper records it. |
Do it in the app
This is what LightAtom is built for: its connections view lists every app with each server it talks to, the domain behind the IP and the bytes moved, and the Map shows where they are.
Frequently asked questions
How can I see what my Mac is connecting to?
Activity Monitor's Network tab shows data per process, and lsof -nP -i in Terminal shows each connection's remote address. A network monitor app shows both, with domain names, live.
How do I see which app is using the internet on my Mac?
Open Activity Monitor › Network and sort by bytes, or run nettop -P in Terminal for live per-process traffic.
Is it normal for macOS to make many connections?
Yes. Processes like apsd (push notifications), cloudd (iCloud), nsurlsessiond (background downloads) and mDNSResponder (DNS) connect regularly. Look up any unfamiliar name before worrying.