How to Monitor Outgoing Network Connections on Mac
Once I decided to leave a fresh Mac sitting on a desk for an hour, opened nothing, and watched what it said to the internet. It was not silent. Software update checks, a document app syncing something, a few processes I had to look up by name. Nothing sinister, but nothing I had asked for either. Watching that traffic is part of my job, and it has made me permanently suspicious of a quiet-looking machine.
An outgoing connection is one your Mac starts: an app reaching out to a server somewhere, rather than a server reaching in. That is where the interesting traffic lives, because it is your data leaving. macOS will show you all of it, but it scatters the answer across three tools and hides the good part in Terminal. Here is the order I go in.
Can Activity Monitor show which apps are using the internet?
It shows you how much, not where to. Open Activity Monitor, click the Network tab, and you get packets in and out, data sent and received, and a per-process breakdown of the volume. Apple’s documentation lists exactly those columns and stops there. So you can spot the app that is moving far more data than it should, sort by Sent Bytes, and find your suspect in about ten seconds.
It will not tell you which server that app is talking to. But I still start here, because “which app is chatty” is usually the question I actually have.
How do I see every outgoing connection in Terminal?
Use nettop, which comes bundled with macOS. Open Terminal and run nettop. You get a live table of every connection on the machine, grouped by process, with the remote address and the bytes moving each way, refreshing as you watch. It is the closest thing macOS has to a real monitor.
Two others are worth knowing. lsof -i -P lists open connections with the process that owns each one, and filtering it to established connections leaves only what is talking right now. netstat -an shows connection states and ports. The nettop walkthrough at OS X Daily covers the flags.
Get Svitlana Varbanets’s stories in your inbox
Join Medium for free to get updates from this writer.
The catch is that these tools speak in process names and IP addresses. You will see a process called trustd connecting to an address in Amazon’s range and have no idea whether that is fine. It is fine, as it happens. Finding that out means a search per line, which is where most people give up.
How do I know if a connection is suspicious?
Judge it by whether the app has a reason to be online, not by the address. A local image editor calling a server it has never needed before is worth a look. A browser talking to a hundred hosts is a browser. The ones I flag are the apps I never opened: software that launches at login is doing its talking while you are not watching, which is exactly why it goes unnoticed.
How do I watch connections without living in Terminal?
Use a per-app network monitor. I test FireWally at Nektony, and it exists because of the trustd problem: it lists every app that goes online, shows what each one is sending live plus totals for the current hour and day, and explains in plain language why the app is connecting. That last part is the difference between a list of addresses and an answer. It is free on the App Store and needs macOS 13 or later.
I still open nettop for the raw view. But for the question most people have, a list of app names beats a list of IP addresses.
Monitoring is where I stop here. If you decide an app has no business online at all, that is a separate move: the built-in firewall only covers incoming connections, so blocking an app’s outbound traffic takes a per-app firewall rather than the setting you would expect.
What I actually watch for
Volume first, then names. If one app is sending far more than the others, I want to know why. If a process I do not recognize is connecting while I am doing nothing, I look it up. Most of the time the answer is boring and I move on, which is the point: you cannot tell what is unusual until you have seen normal on your own machine.
I do this whenever a Mac feels busier than it should. The apps are always chattier than they need to be, and none of them ever announce it.
