How to see which app is using your network on a Mac

To see which app is using your network on a Mac, you need a list of apps with a network column that you can sort. macOS’s Force Quit window and System Settings do not show per-app network use, so you need a process list that includes it: Foreman has a Network column on its Processes page, and Terminal has a command for it. Sort by Network, and the app at the top is the one moving the most data.

Once you have the name, the fix is usually simple: pause the sync or the download, or wait for it to finish. The harder part is that the culprit is often a background process you never opened.

Why a slow connection is not always the Wi-Fi

Before you hunt, make sure the problem is on the Mac and not on the line. If every device in the house is slow, an app on your Mac is not the cause, and the router or the provider is. If only the Mac is slow, or only while something is running, an app is a likely suspect.

A single app can use most of a home connection without any sign on screen. A cloud folder uploading a large video, a game updating in the background, a backup running to a drive in another room: none of these shows a window. The only symptom is that web pages load slowly and video calls stutter, which is why people blame the Wi-Fi.

Find it with a Network column

In Foreman, open the Processes page and click the Network column header to sort. Above each column is the whole Mac’s total, so you can see how much traffic there is in all and which rows account for it. Each app’s helper processes are added into the app, so a browser with fifteen helpers appears as one row with one figure, and opening the row shows the helpers.

Watch it for ten to twenty seconds rather than one glance. Network use is bursty, and the one that matters is the one that stays high. The Performance page has a Network graph (labelled Wi-Fi) with sent and received, and a minute of history, which shows at a glance whether the traffic is a spike or a steady load. Under the graph it lists the apps using the most, so you can go from “the network is busy” to a name in one step.

Foreman reads these figures live. It does not alert you, and it does not block anything, so it shows you the culprit and leaves what to do next to you.

Find it from Terminal

If you would rather not install anything, Terminal can show per-process network use with the command nettop. Run nettop -P to see one line per process, and press q to leave. It is a live, full-screen table in a plain-text window, and it is less friendly than a sorted column, but it is built into macOS and it works.

The bytes_in and bytes_out columns are the ones to watch. They are running totals, so a process whose numbers are large and still climbing is the one moving data. If a name means nothing to you, search the name before you act on it.

The usual suspects

Most of the time it is one of these.

Cloud sync. iCloud Drive, Dropbox, Google Drive and similar services upload and download in the background. If you have just added a large folder or a big video, the upload can take hours. Look for the sync apps by name, and for macOS’s own sync helpers: Foreman’s names for them are iCloud sync (cloudd), iCloud Drive (bird) and Cloud files (fileproviderd). What is bird on a Mac explains the iCloud Drive one.

Background downloads. nsurlsessiond, which Foreman shows as Background downloads, downloads and uploads data for apps and for macOS. It is a common name at the top of a network list, and it is not malware: it is the system doing a transfer on behalf of another app. What is nsurlsessiond on a Mac goes into what it is fetching.

Software updates. macOS updates and App Store apps download in the background. A large update can use the connection for a long time, then stop.

Photos. If iCloud Photos is turned on and you imported a lot of pictures, Photos uploads them over the connection. It continues quietly until everything is up.

Browsers. Video, a streaming tab, a web app that polls, a tab that auto-plays. A browser is often the top row simply because you are using it, and that is normal. If it is high while you are not watching anything, a tab in the background is doing it. How to tell if one browser tab is slowing down your Mac shows how to find the tab.

Backups. Time Machine to a network drive, or an online backup service, can saturate the line for the first run.

What to pause

You rarely need to end anything. Pausing is better, because the work resumes later instead of being lost.

• Cloud sync. Most sync apps have a pause button in their menu bar item. Pause it for an hour while you take a call, then resume it.
• Photos. Photos lets you pause iCloud syncing for a while from inside the app. Or leave the Mac on power overnight and let the upload finish.
• A download you started. Pause or cancel it in the app that is downloading it.
• Low Data Mode. For a network you are paying for by the gigabyte, such as a phone hotspot, macOS has a Low Data Mode switch for that network, which helps reduce how much data the Mac uses on it. It is in System Settings > Wi-Fi, in the network’s details.
• A runaway app. If one app is sending data constantly and you do not know why, quit it. In Foreman, End Task asks it to quit the normal way, so it can save, and a second press within a minute forces it. If it keeps coming back, why an app keeps reopening after you quit it on a Mac explains why and how to stop it.

Foreman’s Efficiency Mode is built around an app’s processor time and disk use, so for a big transfer, pausing it at the source is the more direct fix.

What the numbers do and do not tell you

A figure of megabytes per second is a speed, so it only matters if it is close to your connection. An app at a few hundred kilobytes a second is not hurting you. An app at the top of the list moving most of what your line can carry is.

The Network column shows how much data each process is moving. It does not show who it is talking to, and it cannot block anything, because it is a reading and not a firewall. If you want an app to stop talking, the way is to quit it, pause it, or remove it.

If you want the column on hand, Foreman is $12 once and free for 24 hours. The other half of this post, nettop and the pause controls in your sync apps, costs nothing.