How to see which app is using the internet on your Mac

Check Network in Activity Monitor

The bottom of the Network pane shows packets and data received or sent, including current throughput in bytes per second. Activity Monitor can also show network activity in its Dock icon.

1. Open Activity Monitor and select Network.
2. Use View → Columns to show the available sent and received data fields.
3. Sort the relevant column and watch which values change while the transfer is happening.
4. Search for a process name or open its information panel to identify the related app.
5. Repeat the observation after the expected transfer finishes.

Match the process to expected work

Nonzero traffic while you are not touching the Mac is not proof of unwanted behavior. Confirm the app, its current task, and whether traffic stops when that task completes.

• Cloud storage may sync files after an edit or after the Mac wakes.
• Browsers may stream media, download files, or keep active web apps connected.
• Backup and software-update services can transfer data in the background.
• A process name may be a helper belonging to a visible app.

Separate app traffic from a Wi-Fi problem

Throughput measures data moving through the Mac; it is not a test of the maximum speed or quality of the internet connection. A low transfer rate may reflect the remote service, the app, or the local network.

If the Mac is connected to Wi-Fi but pages, mail, or streaming fail, use Apple’s Wireless Diagnostics. Apple notes that this analysis reports detected issues without changing network settings.

Use KernPulse to notice the transfer

KernPulse can show current upload and download rates in the menu bar and a pair of live network trends in its panel. This is useful when a transfer begins outside an open Activity Monitor window: first confirm that data is moving, then open Activity Monitor to identify the process.

The reading is a combined rate for the active Wi-Fi or Ethernet interfaces KernPulse monitors. It is not an internet speed test.

Know what KernPulse does not inspect

KernPulse does not provide per-app network accounting, packet capture, destination addresses, domain names, or a 24-hour network log. It does not inspect network payloads.

If a process remains unexplained, use Activity Monitor, the app’s sync or transfer panel, and your network administrator’s approved tools. Do not end an unfamiliar system process only because traffic is present.