How to tell which application is using the network

Network

Very occasionally when using my Mac, I notice my internet connection slowing down. Using Activity Monitor I can see that it's because something is downloading data at the full rate my connection can support — but I don't know how to tell what's responsible for it. It can be caused by several different things (Dropbox syncing; some app doing an automatic update; most recently it was a video buffering in a browser tab that I'd forgotten about) so it'd be really handy to have a way to tell which app is responsible for the network use. Is such a thing possible in OS X? Ideally I'm looking for a free solution. (Command line is OK.) I'm on Snow Leopard if it makes a difference.

Best Answer

You can try this dtrace one-liner:

sudo dtrace -n 'syscall::recvfrom:return { @[pid,execname] = sum(arg0); }'

Let it run for a while, then hit Control-C. It will print a summary of the number of bytes read from sockets, distributed among processes. For a more detailed view, replace sum by quantize. Or just to see a count of socket reads, replace sum by count.

Disclaimer: I have only tried this on Lion, but AFAIK no great changes in dtrace-ability have occured between SL and Lion.