How to watch what any Mac app sends over the network

Every app on your Mac can talk to the internet. Most do it for good reasons — update checks, sync, licensing. But you don’t have to take any app’s word for what it sends. This guide shows you how to see the traffic for yourself, with free tools and plain steps. No security background needed. It works on any app, including ours.

Last updated: August 13, 2026 · ~8 min read

Why learn this

In January 2026, security researchers found Google ads targeting people who searched for a Mac cleaner. The ads led to a fake help guide that told readers to paste a scrambled command into Terminal. Running it handed attackers control of the Mac. (Reported by Macworld and Hackread.)

There are two calm lessons in that story. First: never run a command you can’t read. Second: it helps to know how to check what an app actually does on the network, instead of guessing. This guide teaches the second skill.

Method 1 — Activity Monitor: zero install, one number

Your Mac already ships a basic answer. It won’t tell you who an app talks to, but it tells you how much it has sent.

1. Open Activity Monitor (Applications → Utilities → Activity Monitor).
2. Click the Network tab.
3. Find the app in the list and read its Sent Bytes column.

Now use the app the way you normally would, and watch the number. A note-taking app that syncs will send a little. A backup app will send a lot, because sending your files is its job. An app that claims to work entirely on your Mac should send almost nothing — the number should stay roughly flat while it works.

Method 2 — One Terminal command that lists every connection

This is the fastest way to see who an app is talking to, right now. Open Terminal (Applications → Utilities → Terminal) and paste this, replacing AppName with the app’s process name:

Command — list an app’s open network connections, refreshed every two seconds

Here is what every part does, so you’re not pasting anything opaque:

• lsof means “list open files.” On a Mac, network connections count as open files, so this tool can list them.
• -i narrows the list to network connections only.
• -c AppName narrows it to processes whose name starts with AppName.
• -a means “and” — apply both filters at once.
• while true; do … ; sleep 2; done repeats the check every two seconds until you press Ctrl-C.
• || echo "…" prints a friendly message when there are no connections, instead of printing nothing.

Each line of output is one live connection. The useful part is at the end: an arrow like ->api.example.com:443, which reads as “this app is connected to that hostname, on that port.” Hostnames are the honest tell. You’ll recognize a vendor’s own domain; ad and analytics domains stand out just as clearly.

Method 3 — Byte counters with nettop

If you want a running total of what a specific app has sent and received, macOS includes nettop:

Command — total network bytes for one app

• pgrep -x AppName looks up the process ID for the app whose name is exactly AppName.
• -p tells nettop to watch just that process.
• -L 1 prints one sample and exits, instead of running forever.
• -J bytes_in,bytes_out limits the output to the two columns you care about.

Run it before and after the app does its work, and compare. The difference is what the app actually sent while you watched.

Method 4 — A per-app firewall: LuLu or Little Snitch

Terminal snapshots are honest but momentary. A per-app firewall watches continuously and shows you every outbound connection each app attempts, as it happens — and lets you block the ones you don’t like.

• LuLu is free and open source, from Objective-See.
• Little Snitch is a paid tool with a free demo mode; its Network Monitor gives the clearest live picture of who-talks-to-whom on your Mac.

Install one, open its monitor view, then launch the app you’re curious about and use it normally. Every hostname it contacts will appear under its name. Ten minutes of watching usually answers the question for good.

Method 5 — Wireshark: the deep view

Wireshark is the free tool security researchers use to capture raw network traffic. Most app traffic is encrypted, so you can’t read the contents — and you don’t need to. Encryption hides what is said. It cannot hide who is spoken to or how much is sent, and those two facts are usually the whole answer.

1. Install Wireshark and start a capture on your active interface (Wi-Fi or Ethernet).
2. Type this display filter into the filter bar and press Enter:

• dns shows every name lookup — the app asking “where is api.example.com?”
• tls.handshake.type == 1 shows the start of each encrypted connection, which includes the hostname it’s for.
• || means “or” — show either kind of packet.

3. Use the app while the capture runs, then stop it.
4. Read the hostname list. Then open Statistics → Conversations and sort by bytes sent from your machine.

That sort-by-bytes view is the strongest test on this page. An app that reads hundreds of gigabytes from your disk but only sends a few kilobytes cannot be uploading your files — there is nowhere for the volume to hide. Arithmetic doesn’t take anyone’s word for anything.

How to judge what you find

Seeing traffic isn’t the same as seeing a problem. Ask three questions about any app:

• Who does it talk to? The vendor’s own domains and an update server are normal. Advertising and analytics domains in a paid tool are worth questioning.
• When? A brief connection at launch is usually an update or license check. Steady traffic while the app handles your private data deserves a closer look.
• How much? This is the decisive one. Sent bytes should match the app’s story. If an app says your data stays local but its sent bytes grow with the amount of data it touches, the story and the wire disagree — trust the wire.

Try it on our app first

We make Vaulith, a disk cleaner that claims your files never leave your Mac. That claim is exactly the kind you should test with this guide — so we wrote down what you should see. Our verify-it-yourself page lists the complete expected traffic, hostname by hostname, for every one of these methods, and how your privacy works explains the few connections the app does make and why. If you can capture a shipped build (v1.0.54 or later) sending file names, paths, or contents, we fix it, disclose it publicly, and credit you — the terms are on our security page.

Keep going

• Does your Mac cleaner upload anything? How to check for yourself — this guide’s methods, aimed squarely at cleaners.
• What happens to files a Mac cleaner deletes? — the other half of trusting a cleanup tool: where your files go and how to get them back.
• Find the sensitive documents on your Mac — tax returns, medical records, and IDs pile up in Downloads; here’s how to find them without anything leaving your machine.
• Comparing cleaners? See the honest Vaulith vs CleanMyMac comparison, or see plans & pricing.

Frequently asked questions

Do I need to buy anything to monitor an app’s traffic?

No. Activity Monitor, lsof, and nettop are built into every Mac. LuLu and Wireshark are free downloads. Little Snitch is paid, but its demo mode is enough for the tests on this page.

Can an app hide its uploads inside encrypted traffic?

It can hide the contents, not the size or the destination. Encryption scrambles what is sent, but the number of bytes and the hostname they go to stay visible to every tool above. Large uploads cannot masquerade as small ones.

What does traffic to 127.0.0.1 mean?

That’s your Mac talking to itself — it’s called loopback. It never reaches the internet. Apps use it for local helpers, like a local AI model or database running on your own machine.

Is it okay to run these tools?

Yes. On your own Mac, these are standard administration tools — the same ones IT departments and researchers use every day. Watching your own machine’s traffic is your right.