Apple - How can I tell which application is using the network?

Firewalls

You could use Little Snitch or HandsOff. They are great firewalls and both have a "Network Monitor" feature, that will do the job:

Little Snitch includes a Network Monitor, showing detailed information of all incoming and outgoing network traffic.
A status icon in the menu bar provides a summary of current network activity, and a monitor window with more comprehensive information pops up automatically in case of new traffic events.

Hands Off is an application to monitor and control the access of applications to your network and disks. Being able to monitor the normally unnoticeable activities enables you to make informed decisions regarding the transfer of your private information, hence avoiding confidential information leakage.

enter image description here enter image description here

The network monitors of: Little Snitch (left), HandsOff (right)

Nettop

A free and built-in cli solution (unfortunately it is not included in Snow Leopard) would be nettop. nettop groups traffic by program and port and measures various network statistics.

Other

There are few other programs, that capture and measure traffic (iftop, wireshark, tcpdump), but they don't know the originated pid. To make the connection you should use netstat.


You can try this dtrace one-liner:

sudo dtrace -n 'syscall::recvfrom:return { @[pid,execname] = sum(arg0); }'

Let it run for a while, then hit Control-C. It will print a summary of the number of bytes read from sockets, distributed among processes. For a more detailed view, replace sum by quantize. Or just to see a count of socket reads, replace sum by count.

Disclaimer: I have only tried this on Lion, but AFAIK no great changes in dtrace-ability have occured between SL and Lion.


sudo fs_usage -f network

will give you all network accesses by all applications (and processes). Usually the process creating a lot of traffic is the one which appears most often in the output.

Tags:

Network