Right now: Activity Monitor
Open the Network tab and sort by Rcvd Bytes or Sent Bytes. Add the Rcvd Packets rate via View › Columns for a live feel. Background services like cloudd (iCloud), nsurlsessiond (downloads for apps) and softwareupdated are common surprises.
Right now: Terminal
nettop -d shows the change since the last refresh, so the busiest process jumps out. lsof lists every open connection and the server it talks to.
nettop -P -d -k state,interfacelsof -i -n -P | grep ESTABLISHEDCommon background data users
cloudd,bird: iCloud Drive and Photos syncing.nsurlsessiond: downloads on behalf of apps, including App Store updates.softwareupdated: macOS updates, often several GB.mediaanalysisd,photolibraryd: Photos syncing originals.- Backup and sync tools: Dropbox, Google Drive, Backblaze.
Over time: Drippy
Activity Monitor forgets an app's usage when it quits. Drippy keeps it: see which app used the most today, this week or this month, separately for each network, so you know what drained the hotspot yesterday.
Questions
What is nsurlsessiond and why is it using so much data?
It's the macOS service that downloads files for apps in the background, such as App Store updates and iCloud content.
How do I stop an app from using the internet on Mac?
Quit it, pause its sync, or block it with an outgoing firewall such as Drippy's. The built-in firewall only filters incoming connections.
Can I see history of which apps used data?
Not with built-in tools. Drippy keeps per-app history by day, week and month.