How to Use the nettop Command in macOS Terminal to Monitor Real-Time Network Bandwidth by App

When unexpected internet bandwidth consumption slows down your local network or drains mobile hotspot data, macOS Activity Monitor’s Network tab provides cumulative data transfer totals. However, it cannot reveal instantaneous transfer speeds, individual socket endpoints, or underlying TCP protocol health in real time. Built directly into macOS, the nettop command-line utility provides top-like interactive telemetry specifically tailored for network activity. It monitors active sockets, per-process bandwidth speeds, packet retransmissions, and interface routing across every running application on your Mac.

What nettop Measures in macOS

Unlike third-party GUI packet sniffers, nettop hooks directly into the Darwin kernel network stack:

• Per-Process Throughput: Displays live incoming and outgoing bytes per second for every application and background daemon.
• Socket-Level Inspection: Expands process trees to reveal destination IP addresses, port numbers, and protocol types (TCP/UDP).
• TCP Connection Health: Tracks round-trip times (RTT), socket state machines (ESTABLISHED, SYN_SENT, TIME_WAIT), and retransmitted packets.
• Interface Distinction: Separates traffic traversing local Wi-Fi (en0), cellular hotspots, virtual VPN tunnels (utun), and loopback interfaces.

Basic Execution and Terminal Navigation

To launch nettop in its default interactive full-screen mode:

1. Open Terminal on your Mac.
2. Type nettop and press Enter.
3. Terminal renders a dynamically updating table showing active processes, socket counts, and cumulative data metrics.

Interactive Keyboard Controls: While nettop is running in the terminal, interact with the display using single-key shortcuts:

Key	Operational Function	Visual Result
p	Collapse / Expand Process Tree	Expands individual socket connections beneath each parent process name.
d	Toggle Delta Mode	Switches display between cumulative byte totals and real-time instantaneous transfer rate (bytes per second).
c	Collapse Multi-Column Display	Toggles compact mode to fit within smaller terminal windows.
j / k	Scroll Rows Up / Down	Navigates the process list without breaking the active telemetry feed.
q	Quit	Exits nettop and restores your standard terminal prompt.

Filtering by Specific Protocols or Interfaces

In high-traffic environments, auditing raw global telemetry can produce visual noise. Use command-line arguments to focus specifically on what you are diagnosing:

• Monitor Only TCP Traffic: Exclude local mDNS and UDP broadcasts:

  nettop -t tcp

• Monitor Only UDP Traffic: Ideal for diagnosing VoIP calls, Zoom audio jitter, or streaming video:

  nettop -t udp

• Filter by Specific Interface: Restrict inspection to your primary Wi-Fi interface:

  nettop -t wifi

Spotting Bandwidth Hogs and Packet Loss

To catch runaway downloads or flaky network connections:

1. Launch nettop with real-time delta speeds enabled:

   nettop -d

2. Press p to expand process trees.
3. Locate processes showing high figures under the bytes_in and bytes_out columns.
4. Inspect the tc_rexmt (TCP Retransmit) column. High retransmission numbers indicate packets are being dropped between your Mac and the remote server, signifying Wi-Fi interference or ISP routing degradation.

Exporting nettop Snapshots for Diagnostic Audits

If you need to log network telemetry into automated scripts without interactive terminal displays, use non-interactive sample mode:

nettop -L 5 -J bytes_in,bytes_out -P > ~/Desktop/network_sample.txt

The -L 5 flag instructs nettop to capture exactly 5 samples at 1-second intervals and terminate, while -P collapses processes into summary rows, writing a clean tab-delimited report directly to disk.