Separate volume from speed.
A traffic total tells you how much data has been transferred over a reporting period. A current rate tells you how quickly data is moving now. An app with a large total may be idle today; a brief burst may show a high rate without a large overall volume.
Use the main panel to compare app totals. Open Live Monitor for current downloads, uploads and leading active apps. Detach it when you want the graph beside your work. These live readings observe traffic already passing through your Mac; they do not load the connection to find its maximum speed.
Look at the apps and their destinations.
Expand an app to understand its traffic history and, when destination-name recording is enabled, the servers it contacted. Records stay on your Mac. History remains available for removed apps, so uninstalling a program does not erase its earlier usage.
Choose retention and clearing controls in NetGate. Private Mode hides figures in the interface; it is a different setting from recording destination names. You can clear names while keeping usage totals. A listed destination helps explain a connection, but does not show the contents of encrypted traffic.
Use the right test for the question.
Connection checks contact reference services at Apple, Google and Yandex. A failed request can identify a service or route problem; it does not prove that every internet connection has failed.
The separate speed test transfers data through Cloudflare: up to 100 MB downloaded and 25 MB uploaded, about 125 MB of payload plus network overhead. On a limited connection, start with the live readings. You can stop a running test. Results describe that route at that moment, rather than guaranteeing future speed.