How to check which Mac apps are sending data (and where)

Most Mac apps connect to the internet. Some need to — a browser, a mail client — but many also send analytics, crash reports and “usage statistics” that you never explicitly agreed to. Here is how to see exactly what is leaving your Mac, from a quick glance to a per-connection view.

1. Quick check: Activity Monitor

Activity Monitor ships with every Mac and shows how much each app sends and receives.

1. Open Applications → Utilities → Activity Monitor.
2. Click the Network tab.
3. Click the Sent Bytes column to sort by what each process has uploaded since it launched.

An app you only use offline that has sent megabytes is worth a closer look. This view tells you how much, but not where to.

2. See every connection: nettop and lsof

Terminal can show the destination of every connection, live.

nettop -P -m tcp

-P groups by process, so each app shows as one row; expand it with the arrow keys to see individual connections and the remote addresses they talk to. Press q to quit.

For a one-off snapshot of every open network connection and the app that owns it:

sudo lsof -i -P -n | grep ESTABLISHED

The first column is the process name; the part after -> is the remote address and port. Look up an unfamiliar address with whois <address> or a reverse DNS lookup: host <address>.

3. Watch and block with a free firewall

The Terminal tools show traffic after it happens. An outbound firewall stops it first and asks you.

LuLu is free and open source, made by the Mac security non-profit Objective-See. After installing it:

1. Leave it in its default mode, which allows Apple’s own processes and asks about everything else.
2. Use your apps normally. Each time an app tries to connect somewhere new, LuLu shows the app, the destination and the port, and asks whether to allow or block it — once or permanently.
3. Review your rules later in LuLu’s rules window, where you can revoke anything.

Little Snitch is the paid alternative with a more detailed map of connections over time.

4. What the destinations usually mean

Blocking an analytics or crash-reporting domain almost never breaks an app. Blocking the developer’s own domain can stop licence checks or updates, so try it and see.

5. Ask the developer

A developer confident in their app can tell you every request it makes. If a privacy policy talks about “improving our services” without listing what is sent, that is your answer.

Every SecureMacApps app publishes its complete list: activation, monthly renewal and the price lookup, all to one domain. You can confirm it with the steps above in five minutes — see the security page.