How to See What Apps Are Connecting to the Internet on Your Mac

Last updated 28 August 2026

macOS gives you three built-in ways to look, and each one shows a different slice. Activity Monitor tells you how much data an app has moved but not where it went. The Terminal shows connections open right now but not what happened five minutes ago. A firewall app keeps the record over time, which is the only view that answers “what has this thing been doing”.

Here is each one, what it tells you, and where it stops.

Activity Monitor: how much, but not where

Open Activity Monitor from Applications, Utilities, then click the Network tab. Sort by Sent Bytes. You will see every running program and how much data it has pushed out since it started.

This is genuinely useful for one question: is something moving an unexpected amount of data? An app sitting at the top of that list when it should be idle is worth investigating.

What it cannot tell you is where any of it went. There is no destination column, because Activity Monitor is a resource monitor rather than a network tool. It also only covers programs running right now, and the counter resets when a program restarts.

The Terminal: exactly what is open, right now

Open Terminal and run:

lsof -i -P -n

That lists every open network connection with the program that owns it and the address at the other end. Adding | grep ESTABLISHED narrows it to connections that are actually live.

This is the most precise view macOS gives you for free. It is also a snapshot. Run it now and you see this instant; the connection an app made thirty seconds ago has gone and left nothing behind. Since most of the connections worth knowing about are brief, the odds of catching one by typing a command at the right moment are poor.

You will also find a lot of it unreadable at first. Programs called trustd, nsurlsessiond, cloudd and mDNSResponder are all normal parts of macOS, and telling those apart from something worth worrying about is the actual skill.

Your router or your DNS provider

If your router has a logging feature, or you use a DNS service that keeps a query log, you get a list of the names your whole network looked up. That catches things a Mac-side tool might miss and covers every device in the house.

The limit is attribution. The log knows a name was looked up; it does not know which app on which machine wanted it. When the question is “which app is doing this”, a network-level log usually cannot say.

A firewall app: the record over time, with the app attached

This is the category built for the question. A firewall app sits in the path of every connection using an official macOS service, so it sees each one as it happens, along with which app asked for it.

That gives you the thing none of the others do: history, with attribution. Not what is happening this second, but what has been happening, which app was responsible, and how often.

MiniFirewall presents that as one list, grouped so that an app which contacted the same website four hundred times is one row with a count rather than four hundred rows. That grouping is the difference between a list you can read and a wall of text. It also means you can act on what you find without leaving the window: press Block on the row and the connection stops.

What should I actually be looking for?

Three things are worth your attention, and the rest is usually noise:

A program you do not recognise, connecting repeatedly. Search its name before assuming the worst; a great deal of it is macOS. But an unfamiliar name contacting a server steadily is the single most useful signal on the list.

An app talking to somewhere unrelated to its job. A note-taking app contacting an analytics company, a media player checking in with an advertising network. This is the most common real finding and it is why most people go looking.

Activity when nothing should be happening. Your Mac at three in the morning should be quiet apart from Apple’s own services. Anything else is worth a look.

What is not worth alarm: constant traffic to apple.com addresses, icloud.com, and the various Apple services. That is your Mac working normally.

Can I stop what I find?

Yes, and how bluntly is your choice. Blocking a whole app stops it reaching anything at all, which is effective and also stops it working for its legitimate purposes. Blocking a single website leaves the app functioning and stops the one thing you objected to, which is usually the better trade.

The built-in macOS firewall cannot do either, because it only covers connections coming in to your Mac. That distinction is worth understanding before you go looking for a setting that does not exist.

Sources

• Apple, Activity Monitor User Guide, on the Network tab
• Apple, Block connections to your Mac with a firewall, on what the built-in firewall covers