Network Activity on Mac OSX Monterey not showing all processes

My network activity is showing that I’m downloading huge amounts of data that are not showing up in my activity monitor. Is there a program I can use that actually works?

I tried launchctl list but I didn’t know what to do after that.

I also tried ps -ax |more but couldn’t figure anything out.

I tried editing /private/etc/hosts and setting

0.0.0.0 compute-1.amazon.aws.com
0.0.0.0 sea.github.com
0.0.0.0 104.21.81.187
0.0.0.0 1e100.net
0.0.0.0 akamaitechnologies.com
0.0.0.0 chromecast.home
0.0.0.0 github.com
0.0.0.0 amazonaws.com
0.0.0.0 webnx.com
0.0.0.0 cloudflareresearch.com

but it did nothing

I also turned on my firewall and set it to block all incoming connections. Still no change. 9GB d/led now and counting.

I also tried looking at nettop but i don’t know which of these are doing the d/ling. See below the image for output from nettop.

IS IT NORMAL FOR ITEMS TO DISAPPEAR FROM NETTOP? I SEE CERTAIN ENTRIES SHOW UP FOR LIKE HALF A SECOND AND THEN VANISH.

enter image description here

NETTOP

Stats.31473
   tcp4 192.168.1.3:54080<->ec2-3-232-242-170.compute-1.amazonaws.com:443
   tcp4 192.168.1.3:54078<->ec2-54-91-59-199.compute-1.amazonaws.com:443
   udp4 *:*<->*:*
   udp4 192.168.1.3:60504<->172.67.163.100:443
   udp4 192.168.1.3:56984<->104.21.81.187:443
Stats.31513
   tcp4 192.168.1.3:54090<->cdn-185-199-109-133.github.com:443
   tcp4 192.168.1.3:54088<->lb-192-30-255-112-sea.github.com:443
   tcp4 192.168.1.3:54086<->108-171-202-195.static.webnx.com:443
   tcp4 192.168.1.3:54085<->lb-192-30-255-116-sea.github.com:443
   tcp4 192.168.1.3:54084<->ec2-3-232-242-170.compute-1.amazonaws.com:443
   udp4 *:*<->*:*
   udp4 192.168.1.3:50710<->104.21.81.187:443
Stats.31561
   tcp4 192.168.1.3:54096<->cdn-185-199-109-133.github.com:443
   tcp4 192.168.1.3:54095<->108-171-202-195.static.webnx.com:443
   tcp4 192.168.1.3:54093<->lb-140-82-112-3-iad.github.com:443
   tcp4 192.168.1.3:54092<->ec2-3-232-242-170.compute-1.amazonaws.com:443
   udp4 *:*<->*:*
   udp4 192.168.1.3:51787<->104.21.81.187:443
   

 ➜  ~ nettop                   
    
    
    kernel_task.0
    launchd.1
    systemstats.98
       udp4 *:*<->*:*
    configd.100
       udp4 *:*<->*:*
       udp4 *:*<->*:*
       udp4 *:*<->*:*
       udp4 *:*<->*:*
    syslogd.124
    apsd.129
       tcp4 192.168.1.3:50922<->17.57.144.121:5223
    PerfPowerServic.145
       udp4 *:*<->*:*
       udp4 *:*<->*:*
       udp4 *:*<->*:*
       udp4 *:*<->*:*
    bluetoothd.151
       udp4 *:*<->*:*
       udp4 *:*<->*:*
       udp4 *:*<->*:*
    AirPlayXPCHelpe.155
       udp4 *:*<->*:*

**launchctl list**


    Last login: Tue Jun 14 00:24:49 on console
    ➜  ~ launchctl bslist -j
    Unrecognized subcommand: bslist
    Usage: launchctl <subcommand> ... | help [subcommand]
    ➜  ~ launchctl list     
    PID Status  Label
    -   0   com.apple.SafariHistoryServiceAgent
    -   0   com.apple.progressd
    -   0   com.google.keystone.user.xpcservice
    -   0   com.apple.cloudphotod
    401 0   com.apple.Finder
    515 0   com.apple.homed
    557 0   com.apple.SafeEjectGPUAgent
    -   0   com.apple.quicklook
    -   0   com.apple.parentalcontrols.check
    519 0   com.apple.mediaremoteagent
    444 0   com.apple.FontWorker
    438 0   com.apple.bird
    -   0   com.apple.amp.mediasharingd
    -   0   com.apple.familycontrols.useragent
    -   0   com.apple.AssetCache.agent
    -   0   com.apple.GameController.gamecontrolleragentd
   

 -  0   com.apple.universalaccessAuthWarn
    -   0   com.apple.UserPictureSyncAgent
    447 0   com.apple.nsurlsessiond
    -   0   com.apple.devicecheckd
    -   0   com.apple.syncservices.uihandler
    441 0   com.apple.iconservices.iconservicesagent
    555 0   com.apple.diagnosticextensionsd
    791 0   com.apple.SafariBookmarksSyncAgent
    -   0   com.apple.LinkedNotesUIService
    1354    0   com.apple.ndoagent
    -   0   com.apple.bookassetd
    -   0   com.apple.ManagedClientAgent.agent
    -   0   com.apple.localizationswitcherd
    -   0   com.apple.screensharing.agent
    569 0   com.apple.commerce
    -   0   com.apple.AddressBook.SourceSync
    -   0   com.apple.installerauthagent
    -   0   com.apple.languageassetd
    -   0   com.apple.familynotificationd
    624 0   com.apple.photolibraryd
    -   0   com.apple.xpc.otherbsd
    -   0   com.apple.sysdiagnose_agent
    -   0   com.apple.tipsd
    -   0   com.apple.timezoneupdates.tznotify
    471 0   com.apple.TextInputMenuAgent
    -   0   com.apple.bluetoothUIServer
    -   0   com.apple.assistant_service
    -   0   com.apple.MRTa
    431 0   com.apple.CommCenter
    408 0   com.apple.trustd.agent
    -   0   com.apple.MailServiceAgent
    -   0   com.apple.mdworker.mail
    -   0   com.apple.appkit.xpc.ColorSampler
    391 0   com.apple.cfprefsd.xpc.agent
    -   0   com.apple.coreimportd
    -   0   com.apple.TrustedPeersHelper
    -   0   com.apple.cvmsCompAgent3600_arm64_1
    -   0   com.apple.DataDetectorsLocalSources
    -   0   com.apple.unmountassistant.useragent
    -   0   com.apple.keyboardservicesd
    488 0   com.apple.quicklook.ThumbnailsAgent
    1434    0   com.apple.Safari.PasswordBreachAgent
    -   0   com.apple.csuseragent
    454 0   com.apple.ContextStoreAgent
    -   0   com.apple.AOSPushRelay
    -   0   com.apple.accessibility.AXVisualSupportAgent
    -   0   com.apple.xpc.loginitemregisterd
    -   0   com.apple.applespell
    -   0   com.apple.coreservices.UASharedPasteboardProgressUI
    -   0   com.apple.screensharing.menuextra
    -   0   com.apple.warmd_agent
    -   0   com.apple.dt.xcodepreviewsapp
    481 0   application.com.google.Chrome.6765461.12886033462
    -   0   com.apple.universalaccesscontrol
    -   0   com.apple.Safari.SafeBrowsing.Service
    -   0   com.apple.findmymacmessenger
    -   0   com.apple.FilesystemUI
    -   0   com.apple.maps.destinationd
    500 0   com.apple.ScreenTimeAgent
    -   0   com.apple.pluginkit.pkreporter
    -   0   com.apple.systemprofiler
    425 0   com.apple.cloudd
    -   0   com.apple.noticeboard.agent
    -   0   com.apple.UserNotificationCenterAgent
    -   0   com.apple.cmfsyncagent
    -   0   com.apple.dt.CommandLineTools.installondemand
    -   0   com.apple.ATS.FontValidator
    470 0   com.apple.diagnostics_agent
    -   0   com.apple.appleseed.seedusaged
    -   0   com.apple.LocalAuthentication.UIAgent
    602 0   com.apple.ap.adprivacyd
    687 0   com.apple.ap.promotedcontentd
    -   0   com.apple.PhotoLibraryMigrationUtility.XPC
    445 0   com.apple.apfsuseragent
    483 0   com.apple.networkserviceproxy
    398 0   com.apple.controlcenter
    678 0   com.apple.AMPLibraryAgent
    -   0   com.openssh.ssh-agent
    -   0   com.apple.atsd
    -   0   com.apple.tonelibraryd
    -   0   com.apple.WeatherService
    1280    0   com.apple.CloudPhotosConfiguration
    -   0   com.apple.security.KeychainStasher
    497 0   com.apple.ctkd
    -   0   com.apple.package-script-service
    418 0   com.apple.secinitd
    568 0   com.apple.speech.speechsynthesisd.x86_64
    -   0   com.apple.contacts.donation-agent
    -   0   com.apple.ServicesUIAgent
    1644    0   com.apple.synapse.contentlinkingd
    -   0   com.apple.XprotectFramework.PluginService
    -   0   com.apple.ctkbind
    -   0   com.apple.mediastream.mstreamd
    -   0   com.apple.alf.useragent
    507 0   com.apple.triald
    405 0   com.apple.tccd
    -   0   com.apple.nexusd
    511 0   com.apple.StatusKitAgent
    593 0   com.apple.replayd
    492 0   com.apple.coreservices.uiagent
    -   0   com.apple.icloud.searchpartyuseragent
    -   0   com.apple.AccessibilityVisualsAgent
    -   0   com.apple.installd.user
    502 0   com.apple.akd
    1823    0   application.com.apple.Terminal.1152921500311988367.1152921500311988372
    499 0   com.apple.CallHistoryPluginHelper
    -   0   com.apple.storeaccountd
    -   0   com.apple.AddressBook.AssistantService
    -   0   com.apple.PIPAgent
    -   0   com.apple.mbfloagent
    -   0   com.apple.printtool.agent
    461 0   com.apple.askpermissiond
    -   0   com.apple.USBAgent
    -   0   com.apple.ssinvitationagent
    -   0   com.apple.webinspectord
    -   0   com.valvesoftware.steamclean
    -   0   com.apple.avatarsd
    -   0   com.apple.speech.synthesisserver
    -   0   com.apple.WebKit.PluginAgent
    -   0   com.apple.storeuid
    -   0   com.apple.rcd
    -   0   com.apple.printuitool.agent
    -   0   com.apple.NVMeAgent
    -   0   com.apple.speech.speechdatainstallerd
    -   0   com.apple.AOSHeartbeat
    475 0   com.apple.CryptoTokenKit.ahp.agent
    -   0   com.apple.SafariNotificationAgent
    -   0   com.apple.coredatad
    472 0   com.apple.remindd
    -   0   com.apple.appsleep
    -   0   org.macosforge.xquartz.startx
    451 0   com.apple.coreservices.useractivityd
    -   0   com.apple.screencaptureui.agent
    -   0   com.apple.cvmsCompAgent3600_x86_64_1
    -   0   com.apple.netauth.user.auth
    -   0   com.apple.siri-distributed-evaluation
    413 0   com.apple.ViewBridgeAuxiliary
    -   0   com.apple.mbbackgrounduseragent
    -   0   com.apple.cvmsCompAgent_x86_64
    400 0   com.apple.lsd
    676 0   com.apple.siri.context.service
    417 0   com.apple.pluginkit.pkd
    -   0   com.apple.security.XPCTimeStampingService
    572 0   com.apple.cache_delete
    -   0   com.apple.symptomsd-diag.agent
    437 0   com.apple.AMPDeviceDiscoveryAgent
    -   0   com.apple.accessibility.dfrhud
    -   0   com.apple.CallHistorySyncHelper
    1356    0   com.apple.colorsync.useragent
    903 0   com.apple.appleaccountd
    489 0   com.apple.parsecd
    -   0   com.apple.mlruntimed
    397 0   com.apple.Dock.agent
    512 0   application.com.divisiblebyzero.Spectacle.3683255.3683490
    -   0   com.apple.parsec-fbf
    432 0   com.apple.dmd
    -   0   com.apple.transparencyd
    490 0   com.apple.AppSSOAgent
    -   0   com.apple.mbuseragent
    409 0   com.apple.security.cloudkeychainproxy3
    392 0   com.apple.UserEventAgent-Aqua
    1227    0   com.apple.followupd
    516 0   application.OpenObject.fuspredownloader.9715076.9715084
    443 0   com.apple.identityservicesd
    449 0   com.apple.telephonyutilities.callservicesd
    -   0   com.apple.DwellControl
    653 0   com.apple.security.DiskUnmountWatcher
    527 0   com.apple.CoreLocationAgent
    1355    0   application.com.apple.ActivityMonitor.1152921500311961084.1152921500311961089
    595 0   com.apple.SecureBackupDaemon
    -   0   com.apple.security.agent
    -   0   com.apple.cfnetwork.AuthBrokerAgent
    -   0   com.apple.multimodalsearchd
    618 0   com.apple.storedownloadd
    -   0   com.apple.SpacesTouchBarAgent.app
    469 0   com.apple.BTServer.cloudpairing
    -   0   com.apple.coreparsec.silhouette
    434 0   com.apple.coreservices.sharedfilelistd
    411 0   com.apple.pboard
    -   0   com.apple.nowplayingtouchui
    -   0   com.apple.MobileAccessoryUpdater.fudHelperAgent
    -   0   com.apple.reversetemplated
    -   0   com.apple.SafariCloudHistoryPushAgent
    -   0   com.apple.BTServer.le.agent
    -   0   com.apple.AskPermissionUI
    -   0   com.apple.thermaltrap
    430 0   com.apple.rapportd
    610 0   com.apple.SoftwareUpdateNotificationManager
    -   0   com.apple.accounts.dom
    -   0   com.apple.metadata.mdflagwriter
    -   0   com.apple.DictionaryServiceHelper
    -   0   com.apple.mdworker.shared
    -   0   com.apple.mdworker.single.x86_64
    -   0   com.apple.usermanagerhelper
    -   0   com.apple.installandsetup.migrationhelper.user
    420 0   com.apple.containermanagerd
    558 0   com.apple.SafeEjectGPUService
    504 0   com.apple.imdpersistence.IMDPersistenceAgent
    -   0   com.apple.TrustEvaluationAgent
    -   0   com.apple.preference.displays.MirrorDisplays
    526 0   com.apple.neagent.878568F8-CCE5-4157-8315-22F20DC8FB0A
    424 0   com.apple.accountsd
    520 0   com.apple.cdpd
    439 0   com.apple.routined
    416 0   com.apple.siriactionsd
    -   0   com.apple.KeyboardAccessAgent
    446 0   com.apple.BiomeAgent
    -   0   com.apple.storelegacy
    -   0   com.apple.OSDUIHelper
    486 0   com.apple.audio.AudioComponentRegistrar
    667 0   com.apple.AssetCacheLocatorService
    -   0   com.apple.DiagnosticsReporter
    -   0   com.apple.lockoutagent
    -   0   com.apple.locationmenu
    -   0   com.apple.videosubscriptionsd
    498 0   com.apple.pbs
    429 0   com.apple.notificationcenterui.agent
    521 0   com.apple.protectedcloudstorage.protectedcloudkeysyncing
    458 0   com.apple.imklaunchagent
    -   0   com.apple.imcore.imtransferagent
    -   0   com.apple.btsa
    459 0   com.apple.icdd
    -   0   com.apple.ckdiscretionaryd
    -   0   com.apple.EscrowSecurityAlert
    -   0   com.apple.metadata.mdwrite
    -   0   com.apple.loginwindow.LWWeeklyMessageTracer
    -   0   com.apple.XprotectFramework.scan
    423 0   com.apple.CalendarAgent
    -   0   com.apple.securityuploadd
    -   0   com.apple.RapportUIAgent
    485 0   com.apple.siriknowledged
    -   0   com.apple.powerchime
    463 0   com.apple.sharingd
    -   0   com.apple.iCloudUserNotificationsd
    -   0   com.apple.metrickitd
    -   0   com.apple.storeassetd
    506 0   com.apple.familycircled
    -   0   com.apple.FontRegistryUIAgent
    -   0   com.apple.RemoteManagementAgent
    480 0   com.apple.TextInputSwitcher
    679 0   com.apple.AMPArtworkAgent
    468 0   com.apple.imagent
    -   0   com.apple.sidecar-relay
    1334    0   com.apple.photoanalysisd
    -   0   com.apple.syncservices.SyncServer
    -   0   com.apple.imautomatichistorydeletionagent
    399 0   com.apple.SystemUIServer.agent
    -   0   com.apple.PackageUIKit.InstallStatus
    -   0   com.apple.ATS.FontValidatorConduit
    396 0   com.apple.talagent
    623 0   com.apple.suggestd
    -   0   com.apple.navd
    -   0   com.apple.RemoteDesktop.agent
    544 0   com.apple.iCloudNotificationAgent
    473 0   com.apple.amsaccountsd
    -   0   com.apple.VoiceOver
    -   0   com.apple.AssistiveControl
    530 0   com.apple.icloud.fmfd
    -   0   com.apple.mdworker.single.arm64
    448 0   com.apple.FileProvider
    402 0   com.apple.secd
    477 0   com.apple.hiservices-xpcservice
    1289    0   com.apple.BKAgentService
    -   0   com.apple.cvmsCompAgent_x86_64_1
    482 0   com.apple.assistantd
    -   0   com.apple.studentd
    -   0   com.apple.FollowUpUI
    450 0   com.apple.videoconference.camera
    -   0   com.apple.corespotlightservice
    -   0   com.apple.uikitsystemapp
    -   0   com.apple.controlstrip
    1335    0   com.apple.mediaanalysisd
    -   0   com.apple.DiskArbitrationAgent
    -   0   com.apple.assessmentagent
    -   0   com.apple.exchange.exchangesyncd
    -   0   com.apple.testmanagerd
    -   0   com.apple.dt.AutomationModeUI
    1274    0   com.apple.scopedbookmarksagent.xpc
    -   0   com.apple.ensemble
    -   0   com.apple.ReportCrash
    1060    0   com.apple.biomesyncd
    554 0   com.apple.UsageTrackingAgent
    -   0   com.apple.email.maild
    428 0   com.apple.donotdisturbd
    -   0   com.apple.menuextra.battery.helper
    -   0   com.apple.appleseed.seedusaged.postinstall
    -   0   com.apple.Maps.mapspushd
    -   0   com.apple.voicememod
    -   0   com.apple.gamed
    -   0   com.apple.STMUIHelper
    -   1   homebrew.mxcl.postgresql
    467 0   com.apple.knowledge-agent
    -   0   com.apple.midiserver
    421 0   com.apple.backgroundtaskmanagementagent
    -   0   com.apple.mobiledeviceupdater
    1125    0   com.apple.helpd
    -   0   com.apple.quicklook.ui.helper
    493 0   com.apple.wifi.WiFiAgent
    -   0   com.apple.screensharing.MessagesAgent
    -   0   com.apple.diskspaced
    -   0   com.apple.passd
    -   0   com.apple.DictationIM
    -   0   com.apple.sociallayerd
    -   0   com.apple.mdmclient.agent
    -   0   com.apple.iCloudHelper
    -   0   com.apple.CharacterPicker.FileService
    2307    0   com.apple.mdworker.shared.04000000-0700-0000-0000-000000000000
    -   0   com.apple.cvmsCompAgent3425AMD_x86_64
    -   0   com.apple.security.XPCKeychainSandboxCheck
    501 0   com.apple.CoreAuthentication.agent
    410 0   com.apple.syncdefaultsd
    -   0   com.apple.sidecar-display-agent
    -   0   com.apple.accessibility.heard
    453 0   com.apple.corespeechd
    -   0   com.apple.AMPSystemPlayerAgent
    406 0   com.apple.itunescloudd
    -   0   com.apple.scrod
    542 0   com.apple.spindump_agent
    -   0   com.apple.AquaAppearanceHelper
    -   0   
    
        com.apple.AuthenticationServicesCore.AuthenticationServicesAgent
        -   0   com.apple.cvmsCompAgent_arm64
        -   0   com.apple.bookdatastored
        522 0   com.apple.security.keychain-circle-notification
        -   0   com.apple.appstorecomponentsd
        -   0   com.apple.icloud.findmydeviced.findmydevice-user-agent
        -   0   com.google.keystone.user.agent
        605 0   com.apple.amsengagementd
        -   0   com.apple.AirPortBaseStationAgent
        1059    0   com.apple.proactiveeventtrackerd
        -   0   com.apple.proactived
        395 0   com.apple.universalaccessd
        -   0   com.apple.accessibility.MotionTrackingAgent
        -   0   com.apple.neagent
        559 0   com.apple.SafariLaunchAgent
        -   0   com.apple.idsfoundation.IDSRemoteURLConnectionAgent
        -   0   com.apple.recentsd
        508 0   com.apple.WiFiVelocityAgent
        422 0   com.apple.usernoted
        616 0   com.apple.geodMachServiceBridge
        -   0   com.apple.translationd
        -   0   com.apple.AddressBook.abd
        -   0   eu.exelban.Stats.LaunchAtLogin
        -   0   com.apple.ScreenReaderUIServer
        -   0   com.apple.newsd
        426 0   com.apple.contactsd
        484 0   com.apple.swcd
        466 0   com.apple.AirPlayUIAgent
        -   0   com.apple.cvmsCompAgent_arm64_1
        -   0   com.apple.dt.previewsd
        -   0   com.apple.shazamd
        576 0   com.apple.corespotlightd
        -   0   com.apple.netauth.user.gui
        -   0   com.apple.watchlistd
        442 0   com.apple.xtyped
        -   0   com.apple.TMHelperAgent
        479 0   com.apple.Spotlight


  664   0   com.apple.appstoreagent
    -   0   com.apple.AMPDevicesAgent
    -   0   com.apple.accessibility.mediaaccessibilityd
    -   0   com.apple.cvmsCompAgent3425AMD_x86_64_1
    1670    0   com.apple.mdworker.sizing
    -   0   com.apple.SpeechRecognitionCore.brokerd
    549 0   com.apple.metadata.mdbulkimport
    -   0   com.apple.iokit.IOServiceAuthorizeAgent
    -   0   com.apple.cvmsCompAgent3600_arm64
    -   0   com.apple.Safari.History
    407 0   com.apple.carboncore.csnameddata
    -   0   com.apple.cvmsCompAgent3600_x86_64
    -   0   com.apple.speech.speechsynthesisd.arm64
    -   0   com.apple.CoreRoutine.helperservice
    389 0   com.apple.distnoted.xpc.agent
    570 0   com.apple.geod
Asked By: Brian Patterson

||

So by closing all open programs and just watching nettop, I began adding any domains that showed up on nettop to my /private/etc/hosts file with the following entries..

0.0.0.0 compute-1.amazon.aws.com
0.0.0.0 sea.github.com
0.0.0.0 104.21.81.187
0.0.0.0 1e100.net
0.0.0.0 akamaitechnologies.com
0.0.0.0 chromecast.home
0.0.0.0 github.com
0.0.0.0 amazonaws.com
0.0.0.0 webnx.com
0.0.0.0 cloudflareresearch.com

Then using sudo dscacheutil -flushcache after editing etc/hosts to make the changes take effect.

Eventually, the network activity dropped to ~0 so I new one of the entries was the culprit.

Then just a matter of removing them 1 by 1 to figure out which one is the problem, and then make sure that one stays routed to 0.0.0.0.

Answered By: Brian Patterson
Categories: Answers Tags: , ,
Answers are sorted by their score. The answer accepted by the question owner as the best is marked with
at the top-right corner.