How can I figure out what processes are consuming my upload bandwidth?

[laredo...@zipmail.com]

Hi,

I'm using Mac 10.7.5. I'm trying to figure out what processes/applications are consuming my available upload bandwidth and if possible, know what that is in kbps. Free tools are always preferred.

I have looked at the Activity Monitor, but seems to only give aggregate statistics.

Thanks, - Dave

[Alan Baker]

<http://www.ntop.org/>

[Jolly Roger]

The built-in 'nettop' command-line tool will show you what you want. Try
this:

1. Open /Applications/Utilities/Terminal.
2. Enter the command: nettop -m tcp
3. Press the up/down arrow keys to scroll up and down the listing.

The "bytes in/out" columns show how much data is being transferred
to/from each application in the list. Read the manual page for nettop
(command: man nettop) for more information about the tool.

For a more friendly / easy method, iStat Menus will show you the
applications currently using network bandwidth on your Mac. Here's a
screenshot showing a Safari tab that is displaying a network camera
video stream on my MacBook Pro, as an example:

<http://s14.postimg.org/b3hlvxm4x/istat.png>

Get iStat Menus here: <http://bjango.com/mac/istatmenus/>

--
E-mail sent to this address may be devoured by my ravenous SPAM filter.
I often ignore posts from Google. Use a real news client instead.

JR

[Patty Winter]

In article <28b0e489-8992-4e45...@googlegroups.com>,

What do you mean by "aggregate"? It shows each application separately,
and even plug-ins (for some reason, the Flash plug-in in Firefox is
at the top of the list right now, even though FF isn't on a page with
video). You can get details on any given process.

The free iStat widget also shows the top processes, but since Activity
Monitor comes with Macs, it seems like the easiest solution.


Patty

[laredo...@zipmail.com]

By "aggregate," I mean when I click on the "Network" tab at the bottom of activity monitor there are "packets out" and "packets out/sec" lines but they aren't particular to processes. The process list, at the top, only has "process Name", "User," "% CPU," "Threads," "REal Mem," and "Kind" columns. Maybe there's another way to configure activity monitor, but that's what I see.

Thanks for all the other answers, - Dave

[Ted Lee]

On 1/10/14, 12:42 PM, Michael Vilain wrote:
> Unless you can code and have a couple months to write your tool, you're
> stuck with command line tools.


Not entirely true. Activity monitor does (can) show the number of
bytes/packets sent/received for each process. True, it doesn't give the
rate (bytes/packets per second) but you ought to be able to eyeball
compute that. It looks like it starts counting from when a process is
created, so you'd have to logout/login to reset all the counters for all
user processes to zero. I suppose if you do a restart that will reset
the counters for any system processes that aren't associated with a user.

--
Ted

[J Burns]

I like that! So far I haven't had trouble with unidentified traffic, but
I'm looking forward to trying it.

[Alan Baker]

On 2014-01-12 00:47:55 +0000, Michael Vilain said:

> In article <laphn8$nqf$2...@dont-email.me>, Ted Lee <tmp...@gmail.com>

> wrote:
>
>> On 1/10/14, 12:42 PM, Michael Vilain wrote:
>>> Unless you can code and have a couple months to write your tool, you're
>>> stuck with command line tools.
>>
>>
>> Not entirely true. Activity monitor does (can) show the number of
>> bytes/packets sent/received for each process. True, it doesn't give the
>> rate (bytes/packets per second) but you ought to be able to eyeball
>> compute that. It looks like it starts counting from when a process is
>> created, so you'd have to logout/login to reset all the counters for all
>> user processes to zero. I suppose if you do a restart that will reset
>> the counters for any system processes that aren't associated with a user.
>

> Activity Monitor is probably using the same counters that netstat and
> nettop use. They aren't historical in that if you quit a process like
> Safari then restart it, the traffic counters for that connection will
> end. I don't even think sar accounting will track network traffic
> except on a per interface basis.
>
> I stand corrected. When I looked at Activity Monitor's per-process
> output, it didn't have per process network I/O.

Prior to Mavericks, I don't think that Activity Monitor had per process
network I/O data, but Mavericks most definitely has it.

You might want to check what columns you can add to the display on
prior versions of Mac OS X. Right-click on the column heading area and
you'll get a menu showing all the columns both currently selected and
available.

[MeV]

I just stumbled across the network monitor display of Little Snitch. I have that installed and use it as an application firewall but didn't really look much at the network display. It has the per-process metrics you're looking for. It will show what processes are using the bandwidth at any one moment so you can zoom in on who's being the bandwidth hog. It won't however do historical or store this information. It may be what you need in the short term to answer your question.