How to Find Which App Is Using the Most Internet on Mac

Your laptop fan spins up. The Wi-Fi indicator flickers. Something on your Mac is hammering the network and you have no idea what. Maybe it's a hung Dropbox sync trying to push a 12 GB folder over hotel Wi-Fi. Maybe it's a Slack helper process stuck in a reconnect loop. Either way, you need to find which app is using the most internet on Mac, and you need to find it in the next thirty seconds.

This is a guide to doing that — first with the tools Apple ships, then with the tools that actually answer the question well.

Start with Activity Monitor (and its limits)

Activity Monitor is the obvious first stop. Open Spotlight, type "Activity Monitor", and click the Network tab.

You'll see columns for Sent Bytes, Rcvd Bytes, Sent Packets, Rcvd Packets. Click "Rcvd Bytes" to sort by what's been pulling data down.

Two things to know before you trust what you see:

1. The numbers are cumulative since the process started. If Chrome has been open for two days, its 8 GB total tells you nothing about what's happening right now.
2. Helper processes are listed separately. Chrome alone shows up as Google Chrome, Google Chrome Helper, Google Chrome Helper (Renderer), Google Chrome Helper (GPU), and a long tail of helper PIDs. You have to mentally add them up.

For the runaway-Dropbox case, this might be enough — Dropbox's main process tends to be the one moving data, and you'll see it ranked first. For Chrome, Slack, or Discord, Activity Monitor will mislead you because the bandwidth is fragmented across helpers.

Drop down to nettop for live rate

If you want bytes-per-second instead of cumulative totals, open Terminal and run:

nettop -P -t wifi

nettop is a built-in command-line tool that shows a live, refreshing view of network activity per process. Flags worth knowing:

• -P — show process names per line (otherwise it groups by PID and gets noisy)
• -t wifi — limit to the Wi-Fi interface; swap to wired for ethernet
• -x — disable human-readable units (raw bytes if you want to pipe it)
• -d — show per-second deltas, which is what you actually want

Press q to quit. nettop -P -t wifi -d gives you a live scoreboard of which process is currently sending and receiving the most data, refreshed once per second.

The downside: it's a terminal UI. You can't keep it visible while you work. The columns wrap on narrow windows. There's no history — close nettop and the last 30 seconds of data are gone.

Why the menu bar is the right place for this

The honest answer to "which app is using the most internet right now" lives at the top of your screen, not in a tab you have to remember to open. A small indicator that shows the current up/down rate, with a click-through dropdown of per-app traffic, costs almost nothing in screen space and tells you the answer the moment you wonder.

This is what ova does. It samples network traffic about once a second, folds helper processes back under their parent app (so Chrome's seven helpers show up as one row called "Google Chrome"), and shows the live rate in your menu bar. Click it and you see every app sorted by current bandwidth.

A worked example: catching a runaway Dropbox upload

Here's a real scenario. You drop a folder into your Dropbox sync directory and walk away. An hour later you notice your Mac is warm and the rest of your network is sluggish. You want to confirm Dropbox is the culprit, see how much it has uploaded, and decide whether to pause it.

The slow path:

1. Open Activity Monitor.
2. Switch to Network tab.
3. Sort by Sent Bytes. Notice Dropbox at top (good) but the number is total since launch (bad).
4. Watch the column for 10–15 seconds to see if it's currently climbing.
5. Switch to Dropbox preferences to pause sync.

The fast path with a per-app monitor in the menu bar:

1. Glance at the menu bar — see "↑ 28 MB/s" with a small arrow indicating sustained outbound traffic.
2. Click. See "Dropbox: 27.8 MB/s up" at the top of the list.
3. Right-click Dropbox in its own menu bar icon and pause sync.

Total elapsed: maybe four seconds. The point isn't that Activity Monitor is unusable — it's that the question "which app is using the most internet right now" is a question you ask multiple times a day, and the tool you reach for should match that frequency.

Tracking it over time, not just right now

Knowing the current heaviest app is half the answer. The other half is knowing what's been heaviest in the last hour, day, or week. You might notice your Mac was sluggish at 3 PM yesterday and want to know what was running. You can't answer that with nettop or Activity Monitor — neither stores history.

A monitor that keeps a per-app time series locally lets you scrub backward and see exactly which process spiked. Real cases this catches:

• A backup app like Backblaze or Arq doing an unexpected full reupload after a config change
• An app you forgot you installed (an old Adobe Creative Cloud helper, a stale npm registry mirror) checking in repeatedly
• Browser tabs left open overnight that streamed a livestream until the morning

See ova in action

A glance-able menu bar bandwidth monitor — local, signed, ~3 MB.

Download for macOS

What about per-app data caps?

A frequent follow-up to "find which app is using the most internet on Mac" is "and now stop it from doing that." A monitor like ova tells you what is using bandwidth — it doesn't block traffic. For blocking, you want a firewall (Little Snitch is the obvious one).

The right pairing for most people:

• Monitor: a menu bar tool that shows you the live per-app rate and history.
• Firewall: an enforcement tool that blocks specific apps or destinations.

You can run both. They don't conflict. The monitor is the thing you look at multiple times a day; the firewall is the thing you configure once and forget.

Common culprits and how to confirm them

Before you spelunk through every running process, check the usual suspects. Most "my Mac is using too much internet" cases turn out to be one of these, and each has a fast confirmation path.

• Cloud sync clients (Dropbox, Google Drive, OneDrive, iCloud Drive). The menu bar icon for each one usually shows whether a transfer is in progress. Pause sync from the icon and watch the rate drop.
• Backup tools (Backblaze, Arq, Time Machine over network). These tend to run on schedules. If your Mac suddenly gets warm at 2 AM, this is the most likely cause.
• Browser tabs streaming video, especially ones backgrounded hours ago. Quit the tab, not just pause it. A paused YouTube tab can still chew bandwidth on auto-refresh.
• Communication apps (Slack, Discord, Teams). Active calls are obvious; what's less obvious is a Slack workspace with a busy GIF channel quietly pulling 50 MB an hour while you're not looking at it.
• macOS itself during a major update download. The OS update sits in /private/var/folders/... and you can spot it in Activity Monitor as softwareupdated or nsurlsessiond.

For each suspect, the question to answer is the same: is the live rate dropping when I quit or pause it? If yes, you found it. If no, keep looking.

A quick checklist to find which app is using the most internet on Mac

When you suspect an app is misbehaving, work through this in order:

1. Glance at the menu bar. If you have a per-app monitor, you have your answer in one second.
2. Open nettop -P -d. If you don't, this is the next-fastest way.
3. Activity Monitor → Network → sort by Rcvd Bytes. Watch the values for 10 seconds.
4. Check the app's own status menu. Dropbox, Slack, OneDrive, Backblaze all have their own menu bar items showing sync status.
5. Check your router admin page. If the answer isn't on the Mac, it might be another device on the network — your phone, an Apple TV doing an OS download, a roommate's console.

Wrapping up

macOS gives you the raw materials to find the heaviest network app — Activity Monitor for cumulative totals, nettop for live rates — but neither is fast enough to use casually. The practical answer is a small menu bar monitor that's already running and one click away.

If you want that without thinking about it, ova is about 3 MB, runs on macOS 14 and up on both Apple Silicon and Intel, samples at 1 Hz, and keeps everything on your Mac. No account, no telemetry, no cloud sync. Install it once and the next time you wonder which app is using the most internet on Mac, the answer is in the corner of your screen.