Activity Monitor’s Network Tab: Hidden Tricks

Most people open Activity Monitor, click the Network tab, see five columns, sort by "Sent Bytes," and close it. That's about 20% of what's there. Activity Monitor's Network tab has hidden columns, a dock icon graph, an energy-impact integration, and right-click menus that can answer questions you'd otherwise reach for nettop to solve. Here's a tour of activity monitor network mac tricks that take it from a glance tool to something genuinely useful.

I'll also be honest about where it stops being enough — because it does, and that's where a dedicated bandwidth monitor earns its keep.

Where the activity monitor network mac view lives

Open Activity Monitor (Spotlight: "Activity Monitor"), click the Network tab. Default columns:

• Process Name
• PID
• Bytes Sent
• Bytes Received
• Sent Packets
• Rcvd Packets
• User

That's the surface view. Sort by Bytes Sent to see who's uploading, Bytes Received for downloads. The values are cumulative since the process started — same gotcha as nettop. A long-lived cloudd will look enormous even when idle.

The bottom of the window has a graph and totals. The graph shows packets-per-second by default; switch the dropdown to Data for the more useful bytes-per-second view.

Hidden columns worth enabling

Right-click any column header to see the available columns. Or use the menu: View → Columns. Beyond the defaults, the ones I find genuinely useful:

Data Sent/sec and Data Received/sec

Bytes per second, computed live. This gives you a rate instead of a total — much more useful for "what's pulling bandwidth right now." Sort by Data Received/sec when you suspect a download is happening.

Sent Bytes (Cumulative) and Rcvd Bytes (Cumulative)

These are slightly different from the defaults — they include all the lifetime accounting Apple has for that process. Often the same number, occasionally not, depending on how the process registers with the kernel.

TCP RTT and RTT Variance

Round-trip time on the process's TCP connections. Useful when investigating why a specific app feels laggy. A Slack process showing 240 ms RTT to its sync endpoint is a different problem from a Slack process showing 18 ms RTT and still being slow.

Architecture

Apple Silicon vs Intel translation. Not strictly a network column, but visible here — useful when you suspect a Rosetta 2 process is misbehaving on the network because of an old binary.

Inspect, dock icon, energy, and other tricks

The defaults barely scratch what's available. A handful of tricks turn the Network tab into something genuinely useful.

The right-click menu

Right-click any process row to see:

• Inspect — opens a window with three tabs: Memory, Statistics, Open Files and Ports
• Sample Process — captures a stack trace, useful for diagnosing what the process is doing while it's chatting
• Quit / Force Quit — handy when you spot a runaway

The Open Files and Ports tab in Inspect is the underused one. It lists every file descriptor the process has open, including sockets — with remote address and port. This is essentially lsof for that one PID, in a window you can scroll. Good for "what is this process talking to?"

The dock icon graph

Activity Monitor itself can show its dock icon as a live network graph. View → Dock Icon → Show Network Usage. Now Activity Monitor's dock icon turns into a small histogram of your aggregate network traffic. Combined with Keep in Dock, you've got a free, always-visible bandwidth indicator — as long as you're okay with Activity Monitor running all the time.

It eats more memory than a purpose-built menu bar app and the graph is small and not per-app, but it's there if you don't want a third-party tool.

Energy Impact integration

The Energy tab has a column called Avg Energy Impact that incorporates network activity, especially on battery. A high energy-impact process that's also high in the Network tab is usually doing something inefficient — long-poll loops, no batching, no compression.

Cross-referencing the Energy and Network tabs is one of those tricks that pays off on laptops. If your battery is melting and the energy-impact list is led by cloudd, Mail, Music, or any sync-heavy process, the Network tab tells you whether they're actually moving bytes or just CPU-busy.

Sort, then click "i"

Sort the Network tab by Data Received/sec. Identify the offender. Click the "i" (info) button in the toolbar — same as the Inspect menu — and switch to the Open Files and Ports tab. You're now looking at every socket that process has open, with remote IPs and ports. From cause (which app) to detail (which endpoints) in two clicks. This is the closest Activity Monitor gets to being a real network debugging tool.

Filtering by user

If your Mac has multiple user accounts, the User column lets you sort to see what each user's processes are doing. Useful in family Macs ("did the kids' Minecraft client cause this?") and shared dev machines.

See ova in action

A glance-able menu bar bandwidth monitor — local, signed, ~3 MB.

Download for macOS

Where activity monitor network mac stops being enough

It's a generalist tool, and you can feel the edges fast.

No history

Same gap as nettop. The Network tab shows now and totals-since-start. If you didn't have it open during the spike, you didn't see the spike. There's no rolling window, no minute-by-minute view of yesterday afternoon.

No helper folding

You'll see Google Chrome Helper (Renderer) and (GPU) and (Plugin) as separate rows, just like nettop. The Bytes Received column for "Chrome" is split across a dozen rows. Do the math yourself.

Cumulative-since-start is misleading

A process that's been running for three days will dwarf one that started this morning even if the new one is currently using 100x more bandwidth. The Data Received/sec column helps but isn't shown by default.

No menu bar presence

Activity Monitor wants a window. Even the dock icon graph requires the app to be running and dock-visible. There's no glance-from-anywhere indicator.

Designed for "is something wrong" not "what's normal"

You open Activity Monitor when something feels off. You don't open it to check whether your traffic patterns this week look like last week. That's not a knock — it's just a different job.

When to use what

A simple decision tree:

1. "Is something using my network right now?" — Menu bar app. ova shows current rate in the menu bar; click for the per-app breakdown.
2. "Which process is hammering the upload right now?" — Activity Monitor Network tab, sort by Data Sent/sec.
3. "What is this process talking to?" — Activity Monitor → right-click → Inspect → Open Files and Ports. Or lsof -i -p <PID>.
4. "What was using my network at 3 PM yesterday?" — Need history. Activity Monitor can't. Use a tool that persists data.
5. "Is my fan up because of network activity?" — Activity Monitor Energy tab, then cross-reference Network tab.
6. "What's on the wire?" — tcpdump or Wireshark. Activity Monitor doesn't go that deep.

A few sneaky things to know

• Update Frequency in Settings affects all tabs. Set to "Often (1 sec)" for the most live data, "Less Often (5 secs)" if you find the constant repaints distracting.
• Show Inactive Processes under the View menu reveals processes that have been killed but whose accounting is still around. Sometimes useful for forensics.
• Save Default Filter under View saves whatever filter you've typed in the search box across launches.
• The CPU and Network tabs have a hidden integration: a process at 0% CPU but high Bytes Received is almost certainly a kernel-side I/O case (think file copy, AirDrop receive). A process at 100% CPU and zero network is a CPU bug, not a networking one.
• kill -SIGINFO sent to certain processes (like dd and some Apple daemons) makes them log their progress to the unified log. Activity Monitor won't tell you that, but it pairs with the Network tab when investigating long-running tasks.

Wrapping up

The activity monitor network mac view is more capable than its default columns suggest. Enable Data Sent/sec and Data Received/sec, learn the right-click Inspect path to Open Files and Ports, turn on the dock icon graph if you want a free always-on view, and you've got a serviceable network debugging surface without installing anything.

For history, helper folding, and a menu bar presence that doesn't require a window, install ova — about 3 MB, macOS 14 and later, Apple Silicon and Intel, samples at roughly 1 Hz, all data stays local. Use both: Activity Monitor for "what's happening right now in detail," ova for "what was happening, and what does normal look like."