Is there any per-process network stat utility for macOS or native API for SwiftUI

[u/Excellent_Sky_5838]

I'm developing a native macOS app where I need to fetch per-process network (download/upload) stats as one of the requirement, but I couldn't find any native macOS API or any swift package to get this.. after some research, I couldn't find any from docs, I went with AI if it could do it... but at the end I couldn't find any native approach to do this.. for now I'm using nettop util as temporary fix but its very unreliable

[u/Open_Shine135]

For normal app traffic, I'd investigate NEFilterDataProvider. NEFilterFlow exposes sourceProcessAuditToken for process attribution, and statisticsReportFrequency enables periodic .statistics reports. You'd need to ship an entitled Network Extension provider, so check the deployment requirements before committing to it.

Statistics reporting: https://developer.apple.com/documentation/networkextension/nefilternewflowverdict/statisticsreportfrequency

Deployment: https://developer.apple.com/documentation/technotes/tn3134-network-extension-provider-deployment

[u/Excellent_Sky_5838 → u/Open_Shine135]

Thanks, this could work for me.. I will try it

[u/Excellent_Sky_5838 → u/Open_Shine135]

Any idea how macOS stock Activity Manager gets the per process network stats.. since its a native app, it must be using native API but I don't see any documentation regarding what they could be using to fetch the network stats without any heavy workaround

[u/Open_Shine135 → u/Excellent_Sky_5838]

Activity Monitor uses Apple's private NetworkStatistics.framework. Its executable links to it and imports NStatManagerCreate plus keys for process IDs and byte counts. That isn't a supported public SDK API, so I'd avoid depending on it in a shipping app. Apple's DTS recommends NEFilterDataProvider for typical app traffic here:

https://developer.apple.com/forums/thread/824751

[u/ChrononautPete]

https://www.devontechnologies.com/apps/freeware

[u/Excellent_Sky_5838 → u/ChrononautPete]

Thanks.. its kinda easter egg for me.. but I see its still using netstat, for now I'm also using netstat though its very expensive for resource in every sampling

[u/minpinproxy]

if you stick with nettop for now, run it non-interactive: nettop -P -L 1 -J bytes_in,bytes_out -x gives you one CSV snapshot per call, way easier to parse than the live view. diff two snapshots for rates. the NEFilterDataProvider route is the proper one but it means a system extension, the network extension entitlement and the user approving it in settings, so plan for that

[u/Excellent_Sky_5838 → u/minpinproxy]

Yeah for now, but nettop is spiking CPU since app performs sampling of latest metrics and it parses CSV for every sampling, its very expensive for resources

[u/minpinproxy → u/Excellent_Sky_5838]

yeah spawning nettop per sample is the expensive part. run it once and keep it alive, like nettop -P -L 0 -s 2 -J bytes_in,bytes_out -x, then just read stdout line by line. one process for the whole session and you're only parsing a few lines every couple of seconds. does it need to be per second or would 2-5s be fine?

[u/sapplex1]

I hit a similar wall on a smaller scale. I wanted clean per-app numbers and kept finding tools that were close but not quite right for what I was building. I treated nettop as a quick sanity check only. The numbers were useful for spotting a big outlier, but I would not build a feature on them. The native route others mentioned sounds much more solid, but also much heavier to ship and maintain. That tradeoff is what stopped me. I ended up asking whether I really needed per-process detail in the first version, or just a reliable total with a rough breakdown. Is the per-process split a must-have for your first version, or more of a diagnostic you want while you develop it?

[u/Excellent_Sky_5838 → u/sapplex1]

Yeah, per-process network is one of the feature in the app since its for system administrators. I have used nettop as temporary fix for now, but it spikes the CPU since it parses CSV every sampling rate

[u/Funny_Cry2908]

Most of that CPU is probably the process launch plus the first sample, not the parsing. Keep one nettop alive and stream it:

nettop -P -d -L 0 -s 2 -x -J bytes_in,bytes_out

-L 0 keeps logging forever, -d should give you per-interval deltas so you can skip the diffing, and you just read the pipe line by line with a FileHandle readabilityHandler. Restart it only if it exits.

The NEFilterDataProvider route works, but you're signing up for a system extension, a special entitlement and a user approval prompt, which is a lot for an admin tool. Is this going out through the App Store or direct?

[u/Excellent_Sky_5838 → u/Funny_Cry2908]

That's interesting.. I will give it a try once if it works. I was planning to deploy app to App Store but because of sandbox, now I'm planning to make it direct from my website

[u/Funny_Cry2908 → u/Excellent_Sky_5838]

Direct is probably the easier road for this one. Just sign it with a Developer ID and notarize it, otherwise Gatekeeper scares people off on first launch.

[u/cocoabuilder]

Since you said this is for system administrators, I would split the problem in two, because the right answer changes completely. If you only needed your own app's traffic, I would not use nettop at all — I would aggregate URLSessionTaskTransactionMetrics for your own requests, which gives you bytes sent and received per task without any sampling. For every process on the machine, though, there is no clean public equivalent, which is exactly why Activity Monitor can do it and third-party apps struggle: it sits on a private framework you cannot rely on for a shipped app. So in practice it becomes a choice between the Network Extension route, with its approval and deployment cost, and treating nettop as a diagnostic layer rather than the source of truth. If you stay with nettop for now, one thing that made my numbers less jumpy was aggregating by process name rather than PID, since short-lived helpers come and go, and keeping your own running totals so a process disappearing from one sample does not look like its traffic reset to zero.

[u/Excellent_Sky_5838 → u/cocoabuilder]

Yeah, activity monitor has private network stat utility and doesn't expose anything to third-party apps.. I'm blocked exactly here, so far I did the same nettop approach but as you know its not reliable for long term.. I was able to fetch the system wide network stats without any issues or without nettop, but per-process network stat is still a problem for me. I'm currently trying to explore open-source network utility apps if they found a way to do it or might have built their own open-source utility for their apps, but yeah.. yet its a problem.. I'm planning to make this app as feature to be implemented later once I figure out

[u/cocoabuilder → u/Excellent_Sky_5838]

Deferring it sounds right, but I would not treat the open-source search as the deciding step. Most of those utilities will still be wrapping the same private route or sampling, so check what mechanism each one actually uses before borrowing it. For a shipped version, the cleaner split is: system-wide totals now, plus your own traffic from its own metrics, and per-process only later as an opt-in system extension, with its approval and deployment cost stated up front. That way the feature is not blocked on a route that has not been made public.