Take the 2-minute tour ×

I've got a relatively limited broadband connection (I live miles from the nearest exchange) and from time to time net access (but nothing else) slows to a near crawl.

I know from a bit of monitoring software that the connection is being fairly heavily used which would explain it but I don't know what's using it. There are certainly plenty of things which might (these days there are dozens of apps that will either regularly or infrequently check data or download updates) but how can I find out?

I'm happy to pay (a small amount of) money if needed, though in that case I'd rather it were a recommendation that me just Googling for something.

share|improve this question
add comment

4 Answers

up vote 15 down vote accepted

Little Snitch lets you grant Internet access to programs selectively, so you can decide what port numbers and hostnames an app is allowed to talk to.

It is a very handy personal firewall, and one of the first thing I'd install on a new Mac. Preventing apps from phoning home or doing whatever on the Internet can be crucial for the privacy-minded.

share|improve this answer
Little Snitch is invaluable in handling what is going in/out from your computer on an application level. –  Chealion Jul 17 '09 at 15:46
Little Snitch also lets you display a monitoring panel that shows up/down traffic for each app accessing your network connection. It looks like this: obdev.at/Images/littlesnitch/network-monitor-zoomed.jpg –  chrish Nov 1 '11 at 13:52
add comment

iftop usage

Step 0: install iftop via MacPorts or Homebrew (this will also automatically install any dependencies)

sudo port install iftop
brew install iftop

Step 1: see list of network "interfaces" on your system (by default iftop uses en0, which on Cricket broadband gives you a blank screen)

ifconfig -l    # shows: lo0 gif0 stf0 en0 en1 wlt1 fw3 vnic0 vnic1 vboxnet0 ppp0

Step 2: run iftop with different network "interfaces" until iftop works (ppp0 on my system)

sudo iftop -i ppp0    # have to use sudo to avoid "pcap_open_live(ppp0): (no devices found) /dev/bpf0: Permission denied"

Step 3: exit iftop by pushing "q"

share|improve this answer
Where does one get iftop on OS X? sudo: iftop: command not found –  Daniel Beck Nov 1 '11 at 10:11
Run "sudo port install iftop" (if you have macports installed). This will install iftop and its dependencies. –  russian_spy Nov 1 '11 at 10:17
Thanks. It's also available on Homebrew. This information would be useful as part of the post though ;-) –  Daniel Beck Nov 1 '11 at 10:20
Nice, I had to use a different interface (en1), got the blank screen at first. Also, +1 for homebrew instead of macports. –  Noio Jun 13 '12 at 11:24
add comment

You can get part of the way there with the following command run from inside a terminal:

sudo lsof |grep TCP | grep ESTAB

This will list all the open TCP connections. The first column will list the applications that are making the connection, so you might be able to figure out which is the likely culprit. An example couple lines of output might look like:

ssh       10099            tim   21u     IPv4 0x1164766c        0t0       TCP>home:ssh (ESTABLISHED)
Mail      13216            tim   23u     IPv4 0x11660270        0t0       TCP>##.##.##.##:imaps (ESTABLISHED)

So I can see that both Mail and ssh are using connections. If the solution isn't obvious from this, you can use dtrace to get some more details. Specifically, check out DTrace Tools, some of which are already installed on your Mac under /usr/bin:

bitesize.d cpuwalk.d creatbyproc.d dappprof dapptrace diskhits dispqlen.d dtruss errinfo execsnoop fddist filebyproc.d hotspot.d httpdstat.d iodbctest iodbctestw iofile.d iofileb.d iopattern iopending iosnoop iotop kill.d lastwords loads.d newproc.d opensnoop otool pathopens.d pidpersec.d plockstat priclass.d pridist.d procsystime runocc.d rwbypid.d rwbytype.d rwsnoop sampleproc seeksize.d setuids.d sigdist.d syscallbypid.d syscallbyproc.d syscallbysysc.d topsyscall topsysproc weblatency.d

I think the one you want for your situation is probably either tcpsnoop or tcptop, which do not seem to be available on the Mac by default, which makes me wonder if there were some porting issues.

share|improve this answer
Is sudo required here? –  Richard Hoskins Jul 18 '09 at 21:56
It is to capture connections from other users which may be making network connections. Even if you are the only user, it is possible that some system accounts may be making network connections. –  Tim Jul 20 '09 at 15:46
add comment

Your Answer


