Overview can show aggregate supported network activity across the Mac. It does not identify or judge every application connection.
Common traffic
Cloud sync, browser downloads, streaming, video calls, backups, software updates, and system services can create sustained activity.
Sampling differences
Rates can differ from another tool because of sample interval, unit, interface selection, VPNs, virtual interfaces, sleep, or a switch between Wi‑Fi and Ethernet.
Investigate unexpected use
Use Activity Monitor or a trusted network diagnostic to identify processes. Pause known backups and downloads, then observe whether traffic changes.
Privacy interpretation
Aggregate activity does not reveal file contents or prove that traffic is malicious. Network rate is a diagnostic clue, not a safety verdict.
Online Information & Comments and update services are documented separately and run according to their own triggers.