App that tells me what app is using data (Big Sur)

Question

We just installed Eero and it has the ability to report which devices are using how much data. I was surprised to see one of our family's laptops uploading a ton of data. Nearly twice as much as downloaded.

Odd thing is that the laptop does not seem to be running anything thing that should be uploading that much. Most of its cloud backup services are synched and when you look at the activity monitor I can't get a complete enough picture to see what is driving the usage.

Is there an application out there that people trust that can monitor and log what apps and/or processes are using data and when? It would be nice to get a picture over a couple of days to see what is going on.

I fear there is some sort of malware or another process that has been installed that is acting as a bit of a resource vampire that has hidden well enough from the usual activity monitor filters I have been using.

I have TripMode installed but it struggles with the history look, I also have explored LittleSnitch, but could not tell if it gave the full picture. Happy to go that path if you think it will sort me out.

Thanks!!

I am running 2019 MacBook Pro 16" Big Sur 11.1

Answer 1

Little Snitch pretty much shows you everything about the network, it's more or less the equivalent of GlassWire on Windows, it has the best UI as far as I'm concerned but might be overwhelming (too many features) and it can take some time to get the hang of it but you try that path!

Otherwise there is Radio Silence, much simpler than Little Snitch and the UI is as intuitive as it gets. I don't remember the bandwidth feature or the lack thereof but they do state "Save on bandwidth and data charges" but it does monitor the network and serves as a firewall, since you are worried about malware it also has a free trial.

Answer 2

Activity Monitor gives a lot of info, including:

If you have the battery icon in your menu bar, you can see this: Now, that says energy rather than I/O, but what's interesting is that it always says Photos.app even though the app is not running. My guess is that even though it is supposedly not running, it is maintaining the sync between local and iCloud, i.e., network.

In an admin account in Terminal, you can use tcpdump to see details on what packets are being sent and where to/from

About a decade ago, my son used to play a game called RuneScape until I discovered that the Mac he used was exchanging huge amounts of data with the RuneScape servers when no one was logged in on that computer! (And so I blocked all five servers.)