MacOS – What causes network data use besides automatic updates

The Activity Monitor provides individual app network usage for the current, but it also provides the Cumulative usage for all app using Network.

There is only one set of network interfaces on any Mac. But they have two different interfaces to manage them with different level of functions:

• a CLI (Command Line Interface),
• a GUI (Graphical User Interface).

Moreover, all the network interfaces are named differently through the 2 managment interfaces. Ex.: en0 / CLI = Ethernet / GUI

The GUI is for all users, from beginners to advanced GUI users. The GUI achieve a correct locking mechanism when you use different interfaces or other System Preferences which have to interact with any netwok interface (for ex.: Internet Sharing). This is an interface with a simplified set of "clickdrome windows". This GUI doesn't give you access to all the interfaces functions. This GUI maintains its own database (a set of plist files). This GUI doesn't manage correctly every change you can do at the CLI level. The CLI will make direct use of system calls provided by the underlying operating system (which is a Unix) but won't make any update to the GUI database.

On the other hand, the CLI is for network engineers or system admins who are at ease with pfctl, ifconfig, netstat, traceroute….

My personnal experience is: be cautious when you use CLI that can modify details which are not visible within the GUI but are maintained within the GUI database.