Mac Network Monitor: 4 Tools for 4 Different Questions
Activity Monitor, Portie, Little Snitch, and Wireshark each answer a different network question on Mac. Here's how to pick the right one for what you're trying to do.
“Monitor my Mac’s network” covers four completely different problems. Which process is eating bandwidth? What is listening on port 3000? Is an app phoning home somewhere unexpected? What is actually inside these packets? Each question has a different best tool. Reaching for the wrong one wastes time.
Activity Monitor: Bandwidth by Process
Activity Monitor is built into macOS and lives in Applications > Utilities. Open it, click the Network tab, and you see every process sorted by bytes sent and received. It is the right first stop when something is saturating your connection and you want to find the culprit without installing anything.
The byte counts are cumulative since each process started, not a live throughput measurement. A process that transferred a lot of data earlier will show a high count even if it is idle now. There are no port numbers, no connection destinations, and no per-process bandwidth graph. Good for identifying the heavy hitter. Stop there.
Portie: Which Process Owns Which Port
Portie shows every open port on your Mac alongside the process holding it. If your dev server refuses to start because port 3000 is already occupied, Portie shows you exactly what has it and lets you kill that process in one click.
Portie is not a bandwidth monitor. It does not track throughput or show connection destinations. It handles port assignment: what is listening on which port, which app owns it, and whether that port is actually reachable from outside your network. The remote scanner (included with purchase) answers the last question by checking from an external vantage point rather than just locally.
If your question involves a specific port number, Portie is the right tool.
Little Snitch and Lulu: Outbound Connection Control
Little Snitch intercepts every outgoing connection your apps attempt and prompts you to allow or block it. Over time it builds a detailed log of every server each app communicates with. It is the tool for anyone who wants visibility into what apps are calling home, cares about privacy, or needs to enforce egress rules on a machine.
Lulu is the free, open-source alternative from Objective-See. It covers the core use case (block or allow outbound connections per app) without the traffic statistics and rule-management interface of Little Snitch.
Neither tool helps with the “port already in use” problem. Both focus entirely on outbound destinations, not local port assignments.
Wireshark: Packet-Level Inspection
Wireshark captures every packet flowing through a network interface: TCP handshakes, HTTP headers, TLS records, DNS queries, raw payload bytes. It is the tool for debugging a protocol implementation, inspecting what an API call actually sends over the wire, or doing security research on a binary.
The learning curve is steep. You need to select the right capture interface, write display filter expressions, and know how to read what comes back. If you have not used Wireshark before, plan to spend time with it before it becomes productive rather than overwhelming.
Which Tool for Which Question
| Question | Tool |
|---|---|
| What process is using the most bandwidth? | Activity Monitor |
| What is listening on port 8080? | Portie |
| What servers is this app connecting to? | Little Snitch or Lulu |
| What is actually in these packets? | Wireshark |
Most macOS developers end up with two or three of these installed. Activity Monitor is already there. Portie handles the port questions that come up constantly during development. Little Snitch or Lulu covers connection monitoring. Wireshark stays in the toolbox for protocol debugging sessions.
If you are still typing lsof -i :PORT every time you need to check what is holding a port, download Portie and turn that into a one-click lookup.