If your Mac seems to be using the network unexpectedly, Terminal can show which processes currently have network connections. The most useful built-in command is lsof, which lists open files—including network sockets.
Open Terminal from Applications > Utilities, then run:
lsof -nP -i
Look at the COMMAND and PID columns to identify the app or process. The NAME column shows the local and remote address, port, and connection state.
Quick Answer
To list apps and processes using network connections:
lsof -nP -i
To show only TCP connections:
lsof -nP -iTCP
To show only connections that are currently established:
lsof -nP -iTCP -sTCP:ESTABLISHED
Terminal may ask for your administrator password. This command only reads connection information; it does not close apps or change network settings.
What the Terminal Results Mean
Before filtering the results, it helps to understand the main columns:
- COMMAND: The process name. This may be the app name or a shorter executable name.
- PID: The process ID, a unique number assigned to the running process.
- USER: The account running the process.
- FD: The file descriptor used by the process.
- TYPE: The network type, such as IPv4 (
IPv4) or IPv6 (IPv6). - DEVICE: The network protocol or device information.
- SIZE/OFF: The size or offset field. It is often not important when reviewing network connections.
- NODE: The network protocol, such as
TCPorUDP. - NAME: The local address, remote address, port numbers, and connection state.
The -n option prevents hostname lookups, so Terminal displays numeric addresses instead of trying to turn them into domain names. The -P option displays numeric port numbers instead of service names. These options usually make the command return results more quickly and consistently.
A row may look similar to this format:
process pid user ... TCP local-address:port->remote-address:port (ESTABLISHED)
Do not assume every listed process is an ordinary third-party app. macOS services, background agents, browsers, cloud-sync tools, security software, and system processes can all use the network.
List All Current Network Connections
The basic command is useful when you want a broad view of network activity.
lsof -nP -i
This lists open Internet network files for processes that your account can inspect. It does not continuously monitor activity; it displays a snapshot taken when you run the command.
If Terminal reports that some information is unavailable, run the same command with administrator privileges:
sudo lsof -nP -i
After you enter your Mac login password, the results may include processes that require elevated permission to inspect. When you type a password at a Terminal prompt, macOS does not display dots or other characters. Press Return when finished.
This command does not change system state. To stop viewing its output, simply wait for it to finish or press Control-C if it is still running.
Show Only Active TCP Connections
Most web browsing, software updates, file transfers, and app-to-server communication use TCP. To narrow the list:
lsof -nP -iTCP
To show only TCP connections that are currently established:
lsof -nP -iTCP -sTCP:ESTABLISHED
ESTABLISHED means that a TCP connection is currently open between the Mac and another endpoint. It does not necessarily mean data is actively moving at that exact moment. An app may keep a connection open while idle.
To include processes that require administrator access, use:
sudo lsof -nP -iTCP -sTCP:ESTABLISHED
This is still a read-only inspection command.
Include UDP Activity
UDP is another network protocol. It is commonly used for short exchanges, discovery, calls, streaming-related services, and other traffic that does not use a persistent TCP connection in the same way.
To list UDP sockets:
lsof -nP -iUDP
UDP output may not include a connection state such as ESTABLISHED. That is normal because UDP does not establish connections in the same way TCP does.
To inspect both TCP and UDP activity, use:
lsof -nP -iTCP -iUDP
For a complete view, including processes that require elevated access:
sudo lsof -nP -iTCP -iUDP
Filter the Results for a Specific App
If you know the process name, pipe the output to grep:
lsof -nP -i | grep -i safari
Replace safari with a distinctive part of the process name. The -i option makes the search case-insensitive, so it can match uppercase and lowercase letters.
You can also search for a process ID:
lsof -nP -i | grep ' 1234 '
Replace 1234 with the PID shown in your results. The spaces help reduce accidental matches inside another number.
Because process names do not always match the name shown in the Applications folder, filtering may require a little experimentation. For example, a browser may appear under a helper process rather than its main app name.
A command such as this only filters displayed text. It does not stop the app or alter its connections.
Identify the App Behind a PID
If the COMMAND column is unclear, use the PID to inspect the full command path:
ps -p 1234 -o pid=,ppid=,user=,command=
Replace 1234 with the actual PID. The command displays the process ID, parent process ID, user, and command used to start the process.
You can also ask macOS for details about the process:
ps -ww -p 1234 -o pid,ppid,user,command
The -ww option prevents ps from unnecessarily shortening a long command line. These commands only read process information.
If the process belongs to an app, its command path may help you distinguish the main app from a helper, updater, or background agent. Do not end a process solely because its name is unfamiliar. System processes are often not obvious from their short names.
Watch Network Connections as They Change
To refresh the list repeatedly, use watch only if it is already installed on your Mac. watch is not included with every macOS installation, so the more portable option is a shell loop:
while true; do
clear
date
lsof -nP -iTCP -sTCP:ESTABLISHED
sleep 2
done
This clears the Terminal window, prints the current date and time, displays established TCP connections, waits two seconds, and repeats.
Press Control-C to stop the loop. It does not change network settings or terminate the listed processes.
To monitor both TCP and UDP sockets instead:
while true; do
clear
date
lsof -nP -iTCP -iUDP
sleep 2
done
The output is still a series of snapshots, not a byte-by-byte traffic meter. A connection can open and close between refreshes, so this method may miss very brief activity.
Find the Process Using a Particular Port
If you are investigating a specific local port, include the port number in the lsof filter:
lsof -nP -i :8080
Replace 8080 with the port you want to check. This can show which process has that port open and whether the socket uses TCP or UDP.
For a complete result:
sudo lsof -nP -i :8080
If you are troubleshooting a local service, this can be more direct than reviewing every network connection. For a broader port-investigation workflow, see How to Find Which Process Is Using a Port on a Mac Using Terminal.
Understand Local and Remote Addresses
A network row can contain two endpoints:
- The local address and port identify the Mac’s side of the connection.
- The remote address and port identify the other endpoint.
- A state such as
ESTABLISHED,LISTEN, orCLOSE_WAITdescribes the TCP socket’s current condition.
A LISTEN entry means a process is waiting for incoming connections on a local port. It does not prove that another computer is connected.
Addresses such as 127.0.0.1 or ::1 refer to the Mac itself. These loopback addresses are used for communication between local processes and do not identify an outside server.
An address such as 0.0.0.0 generally means a service is bound to all available IPv4 interfaces. IPv6 may use :: for a similar all-interface binding. The meaning can depend on the socket and process, so treat the address as one clue rather than a security conclusion.
Troubleshooting
The command says “command not found”
lsof is a standard macOS command, so verify that it was entered exactly:
which lsof
If the command returns a path, such as a system location, lsof is available. If it returns nothing, check for typing errors or an unusual shell environment.
Some processes are missing
Run the command with sudo:
sudo lsof -nP -i
macOS can restrict information about processes owned by other users or protected system services. Even with administrator privileges, some details may remain unavailable because of system protections.
The output is difficult to read
Send the results through less so you can move through them:
sudo lsof -nP -i | less
Use the arrow keys or Page Up and Page Down to scroll. Press q to exit less.
You can also search within the output:
/keyword
Replace keyword with the text you want to find, then press Return.
An app appears to use the network after you quit it
The listed process may be a helper, updater, login item, or background service rather than the visible app itself. Use the PID with ps to identify its full command:
ps -p 1234 -o pid=,ppid=,user=,command=
Also remember that a connection can remain briefly while a process finishes closing.
You want to stop a process
Do not terminate a process unless you know what it does and have saved your work. Ending an app or service can close windows, interrupt transfers, or cause unsaved data to be lost.
If you intentionally need to stop a process, first try a normal app quit or stop the related service through its own controls. Avoid using kill as a first response. If a process is clearly identified and safe to stop, macOS may allow:
kill 1234
Replace 1234 with the correct PID. This requests a normal termination and changes system state. If the process is important or uncertain, do not run the command. A process may also restart automatically if it is managed by macOS or another app.
Limitations of lsof
lsof shows open sockets, not a complete history of network traffic. It cannot tell you everything that happened before the command ran, and it may not show brief connections that close quickly.
It also does not automatically translate every remote address into an organization or explain why an app is connecting. A remote address may belong to a content-delivery network, cloud provider, privacy relay, or shared service used by many products.
For this reason, use the process name, PID, address, port, and connection state together. If you need to investigate a storage-related app that is transferring files, Terminal can also help you review local disk usage with How to Check Disk Space and Storage Usage in Terminal on a Mac.
Frequently Asked Questions
Can I see exactly how much data each app is using?
Not with lsof alone. It identifies open connections and their owning processes, but it is not a per-app data-usage meter.
Does running lsof disconnect anything?
No. The commands in this guide inspect open files, sockets, and process details. They do not disconnect network sessions.
Why do I see several entries for one app?
An app may use multiple connections, helper processes, IPv4 and IPv6, or separate sockets for different services. Multiple rows are normal.
What does sudo do here?
sudo runs the following command with administrator privileges. It may reveal additional process information. It does not make the command more accurate in every situation, and you should use it only for commands you understand.
Can I use this to block an app from accessing the Internet?
No. These commands help you identify network activity, but they do not create firewall rules or block connections. Closing a process is also not a reliable long-term blocking method.
Final Thoughts
Start with lsof -nP -i for a broad snapshot, then narrow the results with TCP, UDP, connection-state, app-name, or port filters. Use the PID with ps when a process name is unclear, and remember that Terminal shows open connections—not a complete history of every byte transferred.