NetFluss shows what is using your bandwidth, down to the application

A menubar app that answers which app is using the pipe

NetFluss is described in the repository as a native macOS menubar app showing real-time upload and download rates, router wide bandwidth, historical traffic statistics and built in speed testing, and the older description calls it a lightweight open source menubar app that shows current upload and download speed plus the top apps using bandwidth. That last phrase is the whole product in five words. Bandwidth meters are common; meters that attribute traffic to a process are not, and the attribution is what turns a number into a diagnosis. The application is written in C# and is packaged as a native app rather than an Electron wrapper, with a Swift package manifest and entitlement files for the macOS VPN integration in the tree, alongside a separate windows directory holding the Windows implementation and its build documentation. The project is released under GPL-3.0, and the company behind it, Rana GmbH, is a German business, which is visible in the German language support in the interface.

Network Slice breaks traffic into hosts, services and apps

The feature introduced in 2.5 is the one that makes the tool more than a speedometer. Network Slice is a dedicated live traffic window opened from the right click menu of the menu bar icon. At the top sits a rolling traffic rate chart, and below it three linked columns, for network hosts, for services and for apps, each ranked by volume with a relative usage bar. Remote hosts are reverse resolved to hostnames and tagged with a country flag, so a row reads as a named host with a country rather than a bare IP address, which is the difference between noticing that something is talking to a host in a particular country and not noticing it at all. Each column carries a toggle between a live view and an accumulated view, so you can watch what is happening now or see what has been happening over the session. The three columns being linked matters for interpretation, because the same host can be attributed to a service and to an application, and reading them side by side is how you work out which process is responsible.

The traffic timer and the VPN indicator are the 2.6 additions

Version 2.6 adds two things that address common questions. The traffic timer is an optional popover section that behaves like a stopwatch, so you can start it and watch how much a particular download, a backup or a video call actually moves, with the elapsed time, the running total, average download and upload rates and a split bar always visible, and controls to pause, resume and reset. The starting time is shown under the total, the counter keeps running while the popover is closed, and it survives a restart, coming back paused. The second addition is an optional VPN indicator in the menu bar, a dot or a shield next to the rates, which shows whether a tunnel is up. It works both with the VPN connections built into NetFluss and with external clients, and the README is specific that it detects any active tunnel regardless of which application started it, naming Tunnelblick, the WireGuard app, Mullvad, Tailscale and the macOS VPN settings among the examples. You can optionally add the flag of the country your public IP is in, which updates within seconds of a connection change. Both features are off by default and are enabled in Preferences, and the detection is described as lightweight and running only while an option is on.

Router integration turns the local view into a network view

Beyond the local machine, NetFluss talks to routers, and the repository topics list FritzBox, OpenWRT and UniFi alongside DNS switching and network analysis, which describes the intended environment: a home network with consumer or prosumer routing gear. The 2.6 release notes describe clearer router connection errors for OPNsense, OpenWRT and UniFi, where the app now says exactly what went wrong instead of a generic cannot reach message, distinguishing an HTTPS refusal with the URL or port to enter, a TLS failure, and a changed router certificate. There is a new button to trust the current certificate in the OPNsense credential test, addresses of the form host:port are accepted, and re-trusting a certificate now works for URL form addresses as well. That sounds like a small change, and it is the kind of change that decides whether a monitoring tool is usable or merely installed. A router wide bandwidth figure is one of the headline features, and it is the number that tells you whether the bottleneck is your laptop or the connection.

Updates are verified twice before they install

NetFluss 2.6 can keep itself up to date. Once a day it checks for a new version and shows what is new, and one click downloads, verifies and installs the update and relaunches the app, with options to skip it or to be reminded later. The check is also in the right click menu of the menu bar icon and in the About pane, and the daily check can be switched off in Preferences. The security detail is the part worth knowing: every update is verified with an EdDSA signature and with the Apple Developer ID before it is installed, so an update that has been tampered with does not reach your machine. There is one migration wrinkle, since coming from 2.5 or earlier means downloading 2.6 once by hand, after which the app updates itself. The Windows beta has an equivalent flow, where the installed version offers the newer beta by itself from the About menu, and the Top Apps feature asks once to update its helper, which needs administrator approval.

No telemetry, and a signing policy that is spelled out

The privacy statement is short and specific. NetFluss sends no telemetry, and the few online lookups it makes on its own, namely the daily update check and the public IP and country lookups, are listed in the privacy policy and each can be switched off in the installer and in Preferences. A network monitor is exactly the kind of application that could report what you are doing, so saying nothing is collected and then naming the three exceptions is the right way to say it. Code signing follows a similar pattern. The Windows builds are signed with free code signing provided by SignPath.io with a certificate from the SignPath Foundation, and the macOS app is signed and notarized with Rana GmbH's Apple Developer ID. The policy then names the single committer and reviewer, and the single approver, both the same person at Rana GmbH, and states that every release is built from the repository by GitHub Actions and signed only after a manual approval. That is a clear chain of custody for a binary that will sit in your menu bar and read your traffic.

The release list includes builds that are explicitly not for use

The releases tell you where the project actually is. The newest three are the Windows ones: a public beta 2, and two earlier tags named as signing tests, one of them marked do not use. The macOS side is at 2.6. The Windows beta is described as a native app for Windows 10 and 11 with the same feature set as the Mac version, including live rates on the taskbar, the popover, bandwidth statistics, speed test, network slice, router monitoring and the built in VPN client, and the installer needs no administrator rights and keeps itself up to date. It is not yet code signed for Windows, so SmartScreen asks you to confirm the first start. The beta notes are a good list of what changed, and they read like a bug report from early users, since Beta 1 shipped as many separate files and Windows Smart App Control could block one of them minutes after startup and end the app, which is why 2.6 is a single executable beside Microsoft's own signed libraries. There are also fixes for the app vanishing on sleep, crash reports that name the cause, a first launch that says where it is running, and clearer helper messages. The last push was on 2026-10-08.

Editorial conclusion

NetFluss suits someone who suspects a specific application is eating their connection and wants evidence rather than a guess, since the Network Slice view breaks traffic down by host, service and application with a live and accumulated toggle, and the router integration ties it to what the network itself reports. It is a poor choice if you need a signed, supported build today, because the Windows releases are in beta and the two most recent tags are signing tests that the release names themselves mark as not for use, and the macOS app is the only one that is signed and notarized. Verify three things before you install it: whether the traffic attribution on your platform needs the privileged helper, since Top Apps asks for an administrator approval to update it on Windows, that your router type is one of the supported models for the router monitoring feature, and that the daily update check and the public IP and country lookups, which are the only online calls the app makes, are ones you are willing to allow. The licence is GPL-3.0 and the last push was on 2026-10-08.

Frequently asked questions

Official sources

1. License: GPL-3.0
2. Project website
3. rana-gmbh/NetFluss on GitHub
4. README
5. Releases