Show What Apps & Processes Are Using an Internet Connection via Command Line
Here are two ways to do this, the first provides easy to read output and will print names of applications and processes that are connecting to the outside world:
lsof -nPi | cut -f 1 -d " "| uniq | tail -n +2
Running this command will give you something like:
Obviously these are just the application names and there isn’t much more data here, but if you’re just trying to track down a rogue bandwidth hogging app it’s sometimes adequate.
If you want more detailed information, we can revise the above command so that we get more raw data out of lsof by removing the pipes to other command line utilities, leaving us with unrefined details directly from lsof. You’ll also notice I cut out the -n flag because I want to see the host names this time around:
This will provide much more data, including the app name, PID, protocol, IP address, hostname, and the current status of the connection. All very helpful data.
If that is information overload, try piping the command through ‘more’ so it is easier to read in chunks, or use grep to sort data for a specific app or process, like so:
$ lsof -Pi |grep iChatAgen
iChatAgen 228 David 10u IPv4 0x0bfe44ec 0t0 UDP 127.0.0.1:5191->bos-d25v-r2d2.blue.aol.com:5191
iChatAgen 228 David 13u IPv4 0x1e148b1e 0t0 TCP 192.168.1.29:50051->220.127.116.11:5190 (ESTABLISHED)
lsof is a powerful utility with a myriad of uses. I covered using lsof to track down bandwidth issues quite some time ago, but it was using just the -i flag.