Usage and data saving

Bandwidth per app

Each app's row shows its last minute of traffic, upload above the line and download below. Click it for the app's echo: a sentence on what it moved, then a waveform of the last five minutes live, and with Pro its history by hour, day, week or month. Markers show when the Mac joined another network or an agent run used the app, and tiles show which networks carried the traffic, how it compares with the app's last four periods and its share of all traffic. Below the chart are the app's open connections with the data each has moved and its country, and the connections the app's developer declares in an Internet Access Policy, if it ships one.

Comparing with your router or provider

When your router, ISP or carrier shows a different total from Kilobat, open History › Compare with your router or provider, or run kilobat report compare. Enter the figure as they show it, its unit and whether it counts download, upload or both, then the same period and the network it covers. Kilobat shows its own total in the same unit and the difference, and reads the figure in the other unit system too, since many providers write GB for 1,073,741,824 bytes (GiB) rather than 1,000,000,000.

A strip shows the hours Kilobat actually recorded and its gaps: time the Mac was asleep (recorded from Kilobat 1.3 on), time it was off or offline or Kilobat wasn’t running, time on other networks, and time before its history starts. Below it are the likely reasons for the difference, most likely first. Kilobat sees only this Mac, not the phones, TVs and other computers a router or provider counts. It leaves out local network and AirDrop traffic, which never reaches the Internet, and it counts packet headers no app accounts for as unattributed. Providers may count days in another time zone or post usage late. Kilobat doesn’t say which figure is right. Export the comparison as CSV or JSON, with the period, networks, recorded hours and every gap, to share with your provider.

Hotspot throttling

Many carriers give hotspot use its own allowance and slow it to a set speed once it’s used, such as 600 kbps, or cap hotspot speed on some plans all the time. On a phone hotspot (an iPhone’s 172.20.10.1, an older Android’s 192.168.43.1, or any network macOS or you mark metered), Kilobat looks at what it already measures there: speed tests, your own downloads of 5 MB or more with whatever else downloaded at the same time, and Health’s background pings. When every one of them stops near the same speed, one of the limits carriers publish (128, 512 or 600 kbps, 1, 1.5, 3, 4, 5, 6, 10 or 15 Mbps), Health says “Looks like your carrier’s hotspot cap: every download on this hotspot topped out near 3 Mbps.”

It holds back until the pattern is clear: at least four measurements from at least two sources, such as a speed test and downloads from two services, on two occasions at least two hours apart, all within about 8% of each other, none faster, while the idle ping stays normal (150 ms or less, little jitter, no loss). A weak signal or a busy cell wanders and raises the ping, so it never counts; Bluetooth tethering is slow on its own, so it’s left out. Video gets its own check, timed passively and only on a hotspot: when YouTube, Netflix, Twitch, Disney+ or Prime Video never fetched faster than about 1.5 Mbps in three sessions while other downloads ran at least 2.5 times as fast, Health says it looks like the carrier’s video limit. It never claims certainty: a plan that caps all data looks the same from the Mac.

The finding says what to check: the hotspot data left in the carrier’s app, plans that cap hotspot all the time, a speed test in the phone’s own browser with the Mac disconnected, and another plan or a travel router if you rely on it. It links your carrier’s page in hotspot limits by carrier. Pick the carrier, or press Detect, which asks Cloudflare for your public address and RIPE NCC which network it belongs to. The finding is free; the measurements behind it are part of Kilobat Pro. In the terminal, kilobat hotspot shows the verdict and the evidence (--carrier <id>, --detect, hotspot carriers, --json); agents read get_hotspot_throttling.

Weekly digest

On Monday at 9:00, Kilobat sends one quiet notification about the week before: “2 outages on your provider’s side (41 min), 3 of 12 calls froze, 2 because of Dropbox, and 4.2 GB on Rita’s iPhone, a metered network.” It picks the three or four most notable things in seven days, in the order they matter: outages beyond your router, calls and remote sessions that froze, your router slowing down, a Starlink dish blocked, malware, phishing and agent-guard blocks (an AI agent’s first), anything an agent sent somewhere worth a look, data on metered networks, an outage that may qualify for a credit, and speed tests well under your plan. Nothing that didn’t happen is listed. A week with nothing wrong gets one sentence: “A calm week: no outages, every call clean and 38 GB at home.” When the week before was recorded too, a fact says how it compares when the change means something: “half last week’s”, “up from 2 last week”.

Click the notification, or choose Last week in the command palette (⌘K), for the week in the workspace: each fact with a line a day where Kilobat keeps one, and a button into the tab with the details. The arrows step back up to twelve weeks. Without Pro, the digest shows the counts, such as “2 outages” or “3 of 12 calls froze”, and when a Pro feature would have explained one of them that week, one line says what Pro adds; Pro shows whose side each outage was on, what froze each call and that it was the router that slowed down. Change the day and time, or turn it off, in Settings › Monitoring › Weekly digest. If the Mac is asleep at that time, the digest comes at the first wake after it, in the daytime and within three days; a week the Mac slept through entirely is skipped rather than sent late, and two digests never come within four days of each other. The first week after installing is skipped, since there isn’t a full week to tell. The digest only goes out when you already allow Kilobat’s notifications, never during a call, and is made on your Mac from what Kilobat keeps there. In the terminal, kilobat week shows the same (--weeks-ago 1 for the week before, --json for scripts), and agents get it through get_weekly_digest.

Share cards

Share & Export in the menu bar's right-click menu makes a square image to post: the Weekly Echo (the data you moved, your busiest day and your hungriest app), your last speed test, or This place, a Wi-Fi report for the café, coworking space, hotel or library you're working from. This place shows the place's name, which you type or pick from Apple Maps search, then download, upload and ping from the newest speed test on this network, whether it's good enough for video calls, how it holds up under load, and the Wi-Fi band. Pick the place from the search and the card gets a small map of its neighbourhood with a dot on it; turn off Show map to leave it out. Add tags such as Power outlets, Quiet or Open late, and a one-line note. Kilobat remembers them for that network, on this Mac. Copy the card, save it or share it to Nomad List, a Google Maps review or a coworking chat. No card shows a network name or an address. The map shows the place you picked, never where you are, unless you choose Use my location, the only time This place asks for Location.

Your year in Kilobat sums up the year on one card: the data you moved with a bar for each month, your hungriest app, how many networks you used, your busiest month, your best café Wi-Fi and your longest streak of video calls without a freeze. The best café is the fastest speed test at a place you named on a This place card, shown with the name you typed; if you never named one, the card shows your top speed and says only “on my fastest network”. A stat with nothing to show is left out. When Kilobat's history starts after the first week of January, the card says “since August” rather than claiming the whole year, and in January it still shows the year that just ended. It is always in Share & Export. In December it moves to the top of that menu and the Share sheet, and once, early in the month, Kilobat sends one notification that it's ready, only if you already allow Kilobat's notifications.

Other apps can open Kilobat at the right place with a kilobat:// link (from 1.3.4): kilobat://open/speed opens a tab (overview, connections, health, radar, speed, history, tools or settings), and kilobat://share/speed, kilobat://share/week, kilobat://share/place or kilobat://share/wrapped (your year in Kilobat) opens a share card, and kilobat://speedtest runs a speed test. Run one from Terminal with open kilobat://open/history, or bind it to a key in a launcher. The Raycast extension uses these links for its Open in Kilobat actions, and Kilobat’s Shortcuts actions run checks, speed tests, keep awake and reports from the Shortcuts app.

Hotspots and data cost

macOS flags some connections as metered, such as an iPhone hotspot, but not every Android hotspot and not a phone tethered over USB or Ethernet. Each network has a data cost: Automatic follows macOS, and Metered or Unmetered is your call. Set it in the Wi-Fi menu, the budget menu, the Health tab or Settings, or with kilobat networks cost metered. On a metered network Kilobat switches to Travel, unless you chose a profile for that network, brings your previous profile back when you leave, and skips scheduled speed tests. kilobat conditions --json and the MCP server report both metered and what macOS says (osMetered). Kilobat needs to tell a network apart before you can set its cost, so for Wi-Fi it needs Location access to see the network’s name.

Pausing updaters on metered networks

On a metered network, the network filter also pauses the helpers that download updates on their own: Google Updater (and the older Keystone agent), Microsoft AutoUpdate, macOS Software Update (softwareupdated), App Store downloads (appstored, appstoreagent, storedownloadd), Sparkle’s download service, and Sparkle’s and Squirrel’s installers (Autoupdate, Updater.app, ShipIt). They are blocked with an ordinary filter rule, the blocked-connection journal says “Updater paused on a metered network”, and the apps themselves keep working. Once the network isn’t metered, updates carry on. Nothing in other apps, their staging folders or System Settings is changed, so there is nothing to restore. It is on by default; turn it off in Settings or with kilobat updaters off. Rules that already apply to a connection, such as a destination rule or a temporary allow, come first, so “allow for 30 minutes” lets one update through. Unrestricted pauses nothing.

The Health tab, kilobat updaters and the MCP tool get_updaters show which updaters are covered, which update bytes still got through on this network (an updater’s own bytes, and System downloads such as nsurlsessiond that connected for one, whose bytes include other downloads), and which installed apps update from inside their own process. Most apps built on Sparkle or Electron download the update inside the app and leave only the install to a helper, so they can’t be paused without blocking the app. The filter stops new connections, so a download already running when the network became metered can finish. Kilobat’s own scheduled update check waits for an unmetered network too; Check for Updates still works by hand.

Big uploads: send later

When an app keeps uploading a lot, such as Dropbox syncing a folder, a video going up or a git push of large files, the menu shows a row for it: “Dropbox uploading · 4.2 MB/s · 1.3 GB so far”. An upload counts as big at 1 MB/s or more for 20 seconds, or, on a slow link, half the upload your last speed test measured on that network. Traffic to your own network, such as a NAS or AirDrop, doesn’t count. The row says how long is left only when the total is known: for curl -T sending one file, from the file’s size and what curl has sent. Dropbox, Google Drive, OneDrive, iCloud, git push and browsers don’t say how much is left, so Kilobat shows the rate and what they sent so far rather than guess.

Click Send later to hold the upload. On a metered network it waits for an unmetered one; otherwise it waits for a faster network, one whose speed test measured 20 Mbps up or more. The arrow beside it holds it for an hour, three hours, or until you send it. When the network is right, the upload goes again and Kilobat notifies you, such as “Dropbox’s upload resumed on Home Wi-Fi”. A held upload waiting for a faster network has This Network Is Fast Enough, which sends it now and remembers the network. How an app is held depends on the app:

• Sync and backup apps (Dropbox, Google Drive, OneDrive, Box, Backblaze, Arq, Creative Cloud, Synology Drive, pCloud, MEGA, Transmission, qBittorrent): paused, as Call mode pauses them, so an upload already running stops at once and carries on where it stopped. With the network filter on, their new connections wait too.
• Other apps: the network filter refuses their new connections while they’re held, which needs the filter on and a profile other than Unrestricted. A transfer already running may finish.
• Never held: browsers (every tab would freeze), macOS services such as iCloud and Photos, game launchers, VPNs and proxies, and command-line tools such as git, curl and rsync, whose servers stop waiting and whose terminal would show a stopped job. Their uploads are shown with the time left where it’s known. Kilobat never pauses the app in front, and switching to a held app lets it go.

A held upload always goes again when what it waits for comes, when you click Send now, after 8 hours at most, and when Kilobat quits. Paused apps are written down before they stop, so after a crash they resume at the next launch, and a call or a Focus that holds the same app keeps it held until it ends too. In the terminal, kilobat uploads lists big and held uploads, kilobat uploads hold Dropbox --until unmetered holds one (also fast, fast:50, 2h or manual), and kilobat uploads resume Dropbox lets it go; agents use get_uploads and hold_upload, which asks the user first. Seeing big uploads is free; holding them is part of Kilobat Pro.

Data budgets and app quotas

Each network has its own budget. By default it counts until you reset it. Set it to start over daily, weekly on a weekday you choose, or monthly on the day your plan renews; a plan that renews on the 31st starts on the last day of shorter months. A budget with a cycle counts the usage history of that network, so it carries on after a restart. Kilobat notifies once per cycle at 80% and 100% by default, and at 50% if you add it.

An app can have its own quota: a limit per cycle on everything it moves or only its uploads, on one network or on all of them. Set one from the app’s bandwidth panel or with kilobat quota com.getdropbox.dropbox 2 --upload. With filtering on, a used-up budget stops new connections, and a used-up quota stops that app’s new connections. A temporary allow or a connection rule still gets through. Kilobat samples traffic every second, so budgets and quotas are approximate: an app can go a little over before it stops.

Data packs and travel eSIMs

A data pack is prepaid data with an end, such as a travel eSIM of 10 GB for 30 days. Unlike a budget, it doesn’t start over. Add one in Settings › Data packs: its size, how many days it lasts or its last day, when it started, and the networks that use it. Pick the phone’s hotspot or the travel router, or enter text their names contain, such as iPhone, to count every hotspot and USB connection of that phone. Each network has one pack at a time: a new pack on the same networks ends the old one when it starts, and finished packs stay in the history.

While the Mac is on a pack’s network, the menu shows what’s left and the day it runs out at the pace of the last three days, such as “6.2 GB left · runs out around 14 Nov, 5 days before the pack ends”, or that it lasts the whole pack. A pack that started less than a day ago counts as a day, so its first forecast can be late. Health shows the same line. The pack’s networks count as metered unless you marked them Unmetered, so Travel, the updater pause and Send later treat them as a hotspot. Kilobat notifies at 50, 80 and 95% and when the pace says the pack runs out early, at most once a day and only again when the date moves at least a day sooner. Turn on Hold big uploads until Wi-Fi for a pack, or click it in the notification, and Send later holds sync and backup uploads until an unmetered network.

Kilobat counts this Mac only. If your phone or another device uses the same pack, less is left than Kilobat says. Click Correct and enter what your carrier’s app shows; Kilobat starts from that figure and adds the Mac’s use from then on. In the terminal: kilobat pack add 10 30 --name "Japan eSIM", kilobat pack, kilobat pack correct 5.1 and kilobat pack end; agents read packs with get_data_pack. Data packs in the app are part of Kilobat Pro, like budgets. More in the guide Working from anywhere with a Mac.

What counts: Internet, local network and VPNs

Budgets, quotas and data used count Internet traffic only. Traffic to your local network (printers, NAS, other computers, a router's admin page), AirDrop and other nearby-device links (AWDL) is shown apart, as “Local network: 2.1 GB, not counted”, when you hold the pointer over the budget card's used figure, and in each app's bandwidth panel. The Mac's total comes from the Wi-Fi and Ethernet counters, so it includes what no app accounts for: packet headers and acknowledgments, which apps' byte counts leave out (usually 5–10% more), a process that started and finished between two samples, Internet Sharing, or a VPN that macOS runs itself. The same tooltip shows that part as “Not tied to an app”; it is never assigned to an app.

With a VPN, an app's traffic goes through the tunnel and the VPN carries it out over Wi-Fi or Ethernet. Kilobat counts it once, where it leaves the Mac, as your carrier does, and labels the app's share “Through a VPN”. With a proxy (a system proxy, HTTPS_PROXY, or a local proxy app), apps talk to the proxy on this Mac and the proxy makes the Internet connections, so the bytes show under the proxy; Kilobat can't tell which app was behind it. A proxy in TUN mode is a VPN to Kilobat: each app's own connection is labelled “Through a VPN”, and the proxy's outbound traffic shows under the proxy. A company proxy on a private address counts as local network.

System downloads

Apps hand some downloads to macOS: nsurlsessiond (background transfers for apps such as Music and Podcasts), mobileassetd (Apple Intelligence and Siri models, voices, fonts), softwareupdated, appstored and appstoreagent, cloudd and bird (iCloud), fileproviderd and Content Caching. The app list groups them as System downloads, with what each does. With filtering on, the filter sees which app each connection was for, so the list says “For Music” and a block reads “com.apple.Music via nsurlsessiond”. Without filtering, nettop sees only the service, so Kilobat can't say which app a download was for.

A process that is neither an app nor part of macOS, such as node, python, deno, bun or a Go binary in your home folder or Homebrew, shows its executable path when you expand its row, so an unfamiliar agent or tool stands out.

Turn on Unusual uploads in Settings to hear when an app uploads five times its usual in an hour, and at least 50 MB, at most once a day per app. It only notifies. Temporary rules and expiring connection rules are listed under Profiles with the time left, so you can end one early.