Much like you can monitor Mac OS X filesystem usage through the command line, you can also discover what apps and individual processes are currently using your Macs internet connection. This is a really handy trick if you know your bandwidth is being used by something, or if you’re just trying to track down what applications or background processes are connecting to the outside world.



To determine what Mac apps, daemons, processes, or whatever else is using the internet, we’re going to turn to the command line of Mac OS X and use a more advanced variation of the excellent lsof command. And yes, this will work for any version of MacOS or Mac OS X, and internet connection type through any service, whether it’s wi-fi and wireless networking or ethernet, and this would also work on a linux machine since lsof is a standard networking tool binary.

We will cover two ways to do this, the first provides easy to read output and will print names of applications and processes that are connecting to the outside world, and the second string will provide extremely detailed information regarding what PID is connecting to which host and using what protocol. You can use either, or both, depending on your specific needs.

How to Show Names of Application & Process Using Internet in Mac OS X

Open the Terminal app if you haven’t done so already and enter the following command exactly:

lsof -nPi | cut -f 1 -d " "| uniq | tail -n +2

You may want to copy / paste that string if you’re not familiar with the command line, just be sure the entire string is executed on a single line of syntax.

Running that lengthy command will give you output looking something like this:

SystemUIS

Dropbox

iChatAgen

Finder

iTunes

Google

ssh

These are just the application and process names of what is actively using the internet. Now, obviously there isn’t much more data here, but if you’re just trying to track down a rogue bandwidth hogging app it’s sometimes adequate for that purpose.

Of course there are many situations where extended information of what process and/or apps are using a network connection, how, and to what remote address, and that’s what we’ll cover next.

How to Show Detailed Info for Process ID Connecting to Internet from Mac OS X

If you want more detailed information than what is shown in the above command string, we can revise the above command so that we get more raw data out of lsof by removing the pipes to other command line utilities, leaving us with unrefined details directly from lsof. You’ll also notice I cut out the -n flag because I want to see the host names this time around:

lsof -Pi

This will provide much more detailed data, including the app name, PID, protocol, IP address, hostname, and the current status of the connection. All very helpful data.

If that is information overload, try piping the command through ‘more’ so it is easier to read in chunks, or use grep to sort data for a specific app or process, like so:

$ lsof -Pi |grep iChatAgen

iChatAgen 228 David 10u IPv4 0x0bfe44ec 0t0 UDP 127.0.0.1:5191->bos-d25v-r2d2.blue.aol.com:5191

iChatAgen 228 David 13u IPv4 0x1e148b1e 0t0 TCP 192.168.1.29:50051->206.198.4.49:5190 (ESTABLISHED)

lsof is a powerful utility with a myriad of uses. I covered using lsof to track down bandwidth issues quite some time ago, but it was using just the -i flag which is significantly more simplified. You can use any of the variations covered, and each has it’s own use cases that can be helpful.

Command line tools are aimed at advanced users, but those newer to Mac OS X or who just don’t like Terminal can use apps like Private Eye to help see what is using a Macs internet connection in a similar manner, albeit much more user friendly and entirely in a traditional Mac application.