The question usually arrives with a symptom attached. A video call stutters, the upload light on the router won’t stop flickering, a metered hotspot melts away in an afternoon, and you want one specific answer: which app is doing this? macOS knows. Getting it to tell you is the trick. Here is every way, from the tools already on your Mac up.
Activity Monitor: free, built in, almost enough
Open Activity Monitor, pick the Network tab, and sort by “Sent Bytes.” There it is: every process, with its traffic. This is the right first move, and for a one-time “what just did that” it often suffices.
Its limits show up fast, though. Those byte counts accumulate since the process launched. An app that’s been open for three weeks sits at the top forever, even if it’s been quiet all day. The per-second rate columns are honest but instantaneous; a burst uploader that sleeps between bursts looks innocent every time you glance. And you have to be looking at the window at the guilty moment. Activity Monitor answers “who has used the network,” not “who is being weird lately.”
nettop: the Terminal answer
The same data, live, comes from nettop. Run it in Terminal and you get a per-process, per-connection table that updates in place. It’s genuinely good, and it’s what several monitoring apps (Readout included) read under the hood. It is also an ergonomics tax: a full-screen wall of connection rows, no history, nothing to catch a pattern for you. A tool for the moment you’re already suspicious, not for noticing.
A menu bar monitor: for noticing
The gap in both built-in tools is time. What you usually want is a rolling window, who moved how much in the last five minutes, visible at a glance, with something that taps you on the shoulder when a number is out of line.
That’s the shape of Readout’s per-app view: live rates plus five-minute totals per app, and an orange flag on anything that uploads more than 50 MB or downloads more than 500 MB inside that window. No cloud, no baseline model, just attribution with enough memory to catch the burst uploader that Activity Monitor keeps missing. Other monitors offer per-app views too; whichever you pick, the feature that matters is the window, not the instantaneous rate.
Firewalls: when watching isn’t enough
Everything above observes. If what you want is to stop an app from phoning home, that’s a different tool: an outbound firewall. Little Snitch (paid, from Objective Development) is the deep end; LuLu (free and open source, from Objective-See) covers most people. Readout deliberately isn’t one and won’t become one. A monitor that starts blocking traffic has changed what it can break. Monitor to find out who; firewall if the answer needs enforcing.
The usual suspects
Before suspecting malware, check the boring explanations. In my experience the answer is almost always one of these:
| Suspect | What it looks like |
|---|---|
| iCloud Photos | Large steady uploads after importing photos or video |
| Time Machine / backup apps | Big bursts on the hour, or all day after a large change |
| Browser sync & updates | Chrome and friends quietly fetching updates for every profile |
| Cloud drives | Dropbox, Google Drive, OneDrive re-syncing a moved folder |
| Software updaters | App Store, Sparkle-style updaters, game launchers pre-downloading |
| Spotlight & photoanalysisd | Indexing after big file changes; CPU-heavy more than network-heavy, but it cues backups |
If the flagged process is none of the boring things and you don’t recognize it, that’s exactly the moment the firewall section above is for.