How to use the Terminal to see what Mac processes are accessing the internet

If you’ve ever wondered about which programs are using your internet connection at any point in time, here’s one way to find out using Terminal. Open Terminal, in Applications > Utilities, and run this command:

lsof -P -i -n | cut -f 1 -d ' ' | uniq

When you press return, you’ll see a list of processes that are using the internet connection. At the time I wrote this, my output looked like this:

COMMAND
AppleVNCS
PTHPasteb
SystemUIS
aosnotify
iTunes
GrowlHelp
Transmit
iChatAgen
firefox-b
VPNClient
Mail

The first row, COMMAND, is just the column header. Below that are the processes that are using the internet connection. Most of the time, they are self-explanatory, or can be figured out with relative ease. On my list, most of the entries are pretty clear, but perhaps not aosnotify. A bit of work with Google, though, determines that that process is related to MobileMe syncing.

If you just want to use this command, you know all you need to know now. If you’re curious how it works, though, then keep reading.

While the command may look complex, it’s actually three relatively simple commands strung together with the pipe (|) symbol. The first one, lsof -P -i -n, runs lsof to list open files, with options set to focus only on those connections using the Internet connection (-i), and to not try to convert port and host numbers into names (-P and -n).

The output from this command is then sent to cut, which cuts out everything except the first field (-f 1), based on using spaces to delimit fields (-d ' '). Finally, that output is sent to uniq, which strips out duplicate entries from the list—without this last bit, you’d see a lot of repetition in the list, because every open app will have multiple open files.

That’s all there is to it. Thanks to commandlinefu.com for posting this useful tidbit.