What Is My Mac Connecting To?

Why Activity Monitor isn't enough

Open Activity Monitor, click the Network tab, and you get bytes sent and received per process, sorted by volume. That's useful for finding what's hogging bandwidth. It says nothing about destination IP addresses, so it can't answer "what's this talking to."

The built-in way: lsof

Terminal's lsof lists open files, and on Unix everything including a network socket counts as a file. Run:

lsof -i -P

Each row is one connection: process name, PID, protocol, and the local and remote address with port. ESTABLISHED means an active two-way connection right now. LISTEN means the process is waiting for something to connect to it, covered separately in checking open ports.

To watch it update live rather than a single snapshot, use nettop instead:

nettop -m tcp

It refreshes continuously and groups by process, which is closer to what a dedicated monitor gives you, minus any context on what the remote address is.

The gap: no context on the other end

Both commands print raw IP addresses. Neither tells you the address belongs to Apple, a CDN, an ad-tracking network, or something you've never heard of. Working that out means pasting every unfamiliar IP into a WHOIS lookup one at a time, which is exactly the tedious part a network monitor is built to skip: matching each connection to a company name, country and process automatically.

If you want something closer to a firewall

lsof and nettop are read-only: they show you what's happening, they don't let you block it. Little Snitch is the long-standing paid option for outbound connection control, prompting per-app the first time it tries to phone home. It's a strong tool, and it's also its own thing to learn, at $59.

macOS's own firewall (System Settings, Network, Firewall) only controls inbound connections, refusing unsolicited traffic reaching your Mac. It does nothing about outbound traffic your own apps initiate, which is the gap Little Snitch and connection monitors both exist to fill.