Mac Network Monitor: Track Speeds, IPs, and Connections

Activity Monitor is the most accessible starting point for network monitoring on macOS. Open it from Applications > Utilities, then click the Network tab. You will see every running process listed with columns for Sent Bytes, Received Bytes, Sent Packets, and Received Packets. Sorting by Received Bytes reveals which processes are consuming the most download bandwidth, while sorting by Sent Bytes shows which ones are uploading the most data.

For a more detailed, real-time view, open Terminal and run nettop. This command-line tool refreshes every few seconds and shows each process along with its active network connections, bytes in, bytes out, and the remote address it is communicating with. Press "d" while nettop is running to toggle between cumulative and delta modes. Delta mode is particularly useful because it shows bandwidth consumed since the last refresh, giving you a live picture of network activity.

Starting with macOS Monterey, Apple included the networkQualitycommand. Running it in Terminal performs a speed test against Apple's CDN and reports upload capacity, download capacity, and responsiveness (measured in round trips per minute). This is helpful for verifying that your internet connection is performing as expected without needing to visit a third-party speed test website.

The networkQuality command is the simplest way to test your connection speed directly from Terminal. It measures both upload and download throughput simultaneously and reports the results in Mbps. Adding the -v flag provides a verbose output that includes individual test stream results and additional latency metrics. Adding -s runs the upload and download tests sequentially rather than in parallel, which can be useful for isolating each direction.

Activity Monitor shows cumulative bytes sent and received per process since the process started, but it does not display a live speed reading. To see how fast data is moving at any given moment, you need to observe the delta between refreshes manually. This makes Activity Monitor better suited for identifying which processes have transferred the most data overall, rather than measuring instantaneous throughput.

Menu bar network monitors fill this gap by showing real-time upload and download speeds persistently in your menu bar. These tools sample the network interface at regular intervals (typically every one to two seconds) and display the current transfer rate. This allows you to spot bandwidth spikes immediately without opening any application. Some tools also provide historical sparkline graphs so you can see speed trends over the last minute or longer.

Activity Monitor's Network tab is the quickest graphical method. Click the "Rcvd Bytes" column header to sort processes by how much data they have downloaded. The heaviest consumers appear at the top. You can also click "Sent Bytes" to find processes uploading the most data. Double-clicking any process opens a detail panel with additional information, including the number of open network ports.

The nettopcommand provides a richer view. It lists every process with an active network connection and shows the remote address, port, protocol, bytes in, and bytes out. This is especially useful for identifying processes that maintain persistent connections to remote servers, such as cloud sync agents, messaging apps, or background update services. Press "p" in nettop to toggle between showing all processes and only those with active connections.

For a snapshot of all open network connections at a single point in time, run lsof -i in Terminal. This lists every process with an open Internet socket, including the protocol (TCP or UDP), local and remote addresses, and connection state (ESTABLISHED, LISTEN, and so on). Adding -i tcp filters the output to TCP connections only. Combining lsof with grep lets you search for specific ports or remote hosts, for example lsof -i | grep ESTABLISHED shows only active connections.

The Option-click method is the fastest way to check your current Wi-Fi signal quality. RSSI (Received Signal Strength Indicator) is measured in dBm, where values closer to zero indicate a stronger signal. A reading of -30 to -50 dBm represents an excellent connection, -50 to -70 dBm is good, and anything below -80 dBm indicates a weak signal that may cause dropped connections or slow speeds.

The noise level, also measured in dBm, represents the amount of interference on the channel. The difference between your RSSI and the noise level is called the signal-to-noise ratio (SNR). A higher SNR means a cleaner, more reliable connection. If the noise level is high relative to your signal strength, you may benefit from switching to a less congested Wi-Fi channel in your router settings.

Wireless Diagnostics provides ongoing monitoring and additional analysis tools. After opening it (Option-click the Wi-Fi icon, then select "Open Wireless Diagnostics"), go to Window > Scan to see all nearby networks, their channels, signal strength, and security settings. The Performance window shows real-time graphs of signal strength, noise, and channel quality over time. This is valuable for identifying intermittent Wi-Fi issues that only occur at certain times or when specific devices are active.

Built-in macOS tools spread network information across multiple apps and Terminal commands. MoniThor consolidates all of this into a single menu bar panel. You can see your current upload speed, download speed, Wi-Fi SSID, connection type, and all three IP addresses (local IPv4, IPv6, and public IP) without opening any additional windows.

The real-time speed display updates continuously in the menu bar, showing current throughput in human-readable units (KB/s, MB/s, or GB/s). Each direction has its own 60-sample sparkline history graph, so you can see speed trends at a glance. Peak speed tracking records the highest upload and download speeds since the app launched, which is helpful for verifying that your connection is reaching its advertised speeds.

Your public IP address refreshes automatically every 5 minutes. This means you will know immediately if your external address changes, which is important for remote access setups, VPN verification, and general connectivity awareness. The interface name display (en0, en1, and so on) confirms which adapter is carrying your traffic, making it easy to verify that you are connected through the correct network interface.

Cloud sync services are one of the most frequent causes of sustained high network usage. iCloud Drive, Dropbox, Google Drive, and OneDrive all synchronize files in the background. If you recently added a large number of files or photos, the sync process can consume significant bandwidth for hours. Checking Activity Monitor for processes like "bird" (iCloud), "Dropbox," or "Google Drive" will confirm whether a sync is underway.

Automatic macOS and app updates are another common source. macOS downloads system updates in the background by default, and App Store apps update automatically unless you disable the setting. The "softwareupdated" and "nsurlsessiond" processes in Activity Monitor indicate active downloads from Apple servers. These transfers can be several gigabytes for major macOS updates.

Streaming services such as Netflix, YouTube, Spotify, and Apple Music consume bandwidth proportional to their quality settings. Video streaming at 4K resolution uses approximately 15 to 25 Mbps, while standard definition uses around 3 Mbps. Browser tabs can also be a hidden source of network activity. Tabs with auto-refreshing content, active WebSocket connections, or embedded video players continue to use bandwidth even when you are not actively viewing them. Closing unused tabs or using a tab suspender extension can reduce background network consumption significantly.