A while ago I mentioned about monitoring your Internet connections with Little Snitch. Little Snitch is quite a complex application which allows you to block and allow certain connections, it also allows you to see which applications are connection to the Internet. Since the application does cost money after the demo you may be looking for a “free” version. Today I am going to explain a cool Terminal command which you can use to see which applications have connected to the Internet or your local connection in the last few minutes.
The first step is to open up Terminal. This is found in Applications > Utilities. When the app is open, copy and paste the following and hit enter.
lsof -P -i -n | cut -f 1 -d " " | uniq
When the code runs it will display a list of all of the applications which have connected to the Internet, i’m not sure how long it looks back but you can be pretty sure which apps have accessed the Internet or your network within the last 5 minutes. This is quite useful if you can see your connection saturated (for example using iStat) and you want to narrow down which application is using it.
The line above is split into three different commands, all which run at the same time. The first command, lsof, lists open files, if your run it on its own the command will list all of the open files which you make is using. The first modifying options, -P, will convert port numbers it is combined with -i, -i is used to list all open files on your network. Together they make it easy to see which apps are using your Internet. The final option, -n, is used to inhibits the conversion of network numbers to host names for network files. Both -P and -n allow the lsof program to run faster. If you run lsof on its own it generates a huge amount of output, so any time saving is appreciated.
The middle part of the code, cut, is used to trim down the result. The option, -f 1 makes sure the input from lsof is being used to cut the data, the -d option sets the delimiter, to choose which parts of the field to cut down. In the brackets the spaces are chosen as the delimiter, as a result anything after the first space will be cut from the result, you can enter values in between the speech marks to change the outputted result . If you run both lsof and cut on its own there will be a repeated list of applications, we now need to reduce this list further.
The final option, uniq, goes through the list, line by line and removes any duplicate bits of data. This cleans up the results and makes them slightly more readable.
Hopefully you understand how this little scripts works. The results aren’t prefect but they are pretty useful. Have a play around with the options and see what you can do. If you want more information on each section, in Terminal type “man …” replace … with either lsof, cut or uniq to give you more information. If you have a question or comment please leave one below.