NetScope
A Chrome DevTools-style network monitor for your whole Mac.
$19.99 one-time
Learn morePractical ways to see, understand and control the network traffic of every app on your Mac.
| Tool | Shows | Limits |
|---|---|---|
| Activity Monitor › Network | Bytes sent and received per process | No hosts, no history after restart |
nettop | Live connections and throughput per process | Terminal only, hard to read |
lsof -i | Open sockets and remote addresses | Snapshot, no traffic content |
tcpdump | Raw packets | No app names, needs expertise |
| NetScope | Every HTTP, HTTPS, DNS, QUIC, TCP and UDP connection with app, host, timing | Cannot decrypt HTTPS bodies (shows host via SNI) |
HTTPS encrypts the URL path, headers and body, so nobody on the network can read them. The server name is still visible in the TLS handshake (SNI) unless the site uses Encrypted Client Hello, and DNS lookups are visible unless you use encrypted DNS. That is why a monitor can tell you that an app talked to api.example.com even though it cannot read what was sent.
Learn
Clear answers to common Mac questions about sound, networking and automation.
A Chrome DevTools-style network monitor for your whole Mac.
$19.99 one-time
Learn moreYes. Activity Monitor's Network tab shows data per process, and NetScope shows every connection with the app, host and timing in real time.
No. The built-in firewall only controls incoming connections. Blocking an app from going online needs a third-party outbound firewall.
Not without installing a trusted certificate to intercept it. NetScope does not do that; it shows the host name, timing and size of HTTPS connections, and full content only for plain HTTP.
Short, tested Mac tips, new guides and early-bird prices for new apps. About two emails a month.