I've got a relatively limited broadband connection (I live miles from the nearest exchange) and from time to time net access (but nothing else) slows to a near crawl.

I know from a bit of monitoring software that the connection is being fairly heavily used which would explain it but I don't know what's using it. There are certainly plenty of things which might (these days there are dozens of apps that will either regularly or infrequently check data or download updates) but how can I find out?

I'm happy to pay (a small amount of) money if needed, though in that case I'd rather it were a recommendation that me just Googling for something.

5 Answers 5


Little Snitch lets you grant Internet access to programs selectively, so you can decide what port numbers and hostnames an app is allowed to talk to.

It is a very handy personal firewall, and one of the first thing I'd install on a new Mac. Preventing apps from phoning home or doing whatever on the Internet can be crucial for the privacy-minded.

  • 1
    Little Snitch is invaluable in handling what is going in/out from your computer on an application level.
    – Chealion
    Jul 17, 2009 at 15:46
  • 1
    Little Snitch also lets you display a monitoring panel that shows up/down traffic for each app accessing your network connection. It looks like this: obdev.at/Images/littlesnitch/network-monitor-zoomed.jpg
    – chrish
    Nov 1, 2011 at 13:52

How about iftop? Get via:


iftop usage

Step 0: install iftop via MacPorts or Homebrew (this will also automatically install any dependencies)

sudo port install iftop
brew install iftop

Step 1: see list of network "interfaces" on your system (by default iftop uses en0, which on Cricket broadband gives you a blank screen)

ifconfig -l    # shows: lo0 gif0 stf0 en0 en1 wlt1 fw3 vnic0 vnic1 vboxnet0 ppp0

Step 2: run iftop with different network "interfaces" until iftop works (ppp0 on my system)

sudo iftop -i ppp0    # have to use sudo to avoid "pcap_open_live(ppp0): (no devices found) /dev/bpf0: Permission denied"

Step 3: exit iftop by pushing "q"

  • 1
    Where does one get iftop on OS X? sudo: iftop: command not found
    – Daniel Beck
    Nov 1, 2011 at 10:11
  • Run "sudo port install iftop" (if you have macports installed). This will install iftop and its dependencies. Nov 1, 2011 at 10:17
  • 1
    Thanks. It's also available on Homebrew. This information would be useful as part of the post though ;-)
    – Daniel Beck
    Nov 1, 2011 at 10:20
  • Nice, I had to use a different interface (en1), got the blank screen at first. Also, +1 for homebrew instead of macports.
    – noio
    Jun 13, 2012 at 11:24

You can get part of the way there with the following command run from inside a terminal:

sudo lsof |grep TCP | grep ESTAB

This will list all the open TCP connections. The first column will list the applications that are making the connection, so you might be able to figure out which is the likely culprit. An example couple lines of output might look like:

ssh       10099            tim   21u     IPv4 0x1164766c        0t0       TCP>home:ssh (ESTABLISHED)
Mail      13216            tim   23u     IPv4 0x11660270        0t0       TCP>##.##.##.##:imaps (ESTABLISHED)

So I can see that both Mail and ssh are using connections. If the solution isn't obvious from this, you can use dtrace to get some more details. Specifically, check out DTrace Tools, some of which are already installed on your Mac under /usr/bin:

bitesize.d cpuwalk.d creatbyproc.d dappprof dapptrace diskhits dispqlen.d dtruss errinfo execsnoop fddist filebyproc.d hotspot.d httpdstat.d iodbctest iodbctestw iofile.d iofileb.d iopattern iopending iosnoop iotop kill.d lastwords loads.d newproc.d opensnoop otool pathopens.d pidpersec.d plockstat priclass.d pridist.d procsystime runocc.d rwbypid.d rwbytype.d rwsnoop sampleproc seeksize.d setuids.d sigdist.d syscallbypid.d syscallbyproc.d syscallbysysc.d topsyscall topsysproc weblatency.d

I think the one you want for your situation is probably either tcpsnoop or tcptop, which do not seem to be available on the Mac by default, which makes me wonder if there were some porting issues.

  • Is sudo required here? Jul 18, 2009 at 21:56
  • It is to capture connections from other users which may be making network connections. Even if you are the only user, it is possible that some system accounts may be making network connections.
    – Tim
    Jul 20, 2009 at 15:46

Nettop is a built in command line tool. You can start it in the Terminal by typing nettop. The default view is a bit too verbose, so I always press c and d keys to see one application per line (c) and see the current bandwidth usage instead of the total network traffic (d). You probably need to maximize the terminal window to see all columns.

More info and screenshots here.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .