Speed limits
Cap one app's upload, download or both from its inspector, the menu bar or outboundctl limit: what a limit covers, what it leaves alone and how to remove it.
A speed limit caps how fast one app can upload, download, or both. Use it to keep a backup, a sync client or a large download from taking the whole connection. A limit only slows an app down: it never allows a connection your rules would block, and it never adds an allow rule.
Setting a limit
Section titled “Setting a limit”Select an app in the Network Monitor and open the inspector. The Speed Limit section sits next to Daily Data Limit.
- Choose Both, Upload or Download.
- Choose a speed: Off, 256 Kbit/s, 1 Mbit/s, 5 Mbit/s, 20 Mbit/s, or Custom….
- For Custom…, type a rate, pick Mbit/s or MB/s, and click Apply Speed Limit. The rate has to be greater than zero and at most 10 Gbit/s.
A preset applies as soon as you choose it. With Upload or Download chosen, the other direction keeps its own limit. While a limit is set, the section shows Limited, with the app’s current rate next to its cap, such as “Upload 0.8 Mbit/s of 1 Mbit/s”. When Outbound has no traffic figure yet, the rate shows a dash.
To remove a limit, choose Off.
What a limit covers
Section titled “What a limit covers”The inspector says it under the controls: “TCP internet traffic only. Other UDP traffic, including DNS and calls, stays unchanged.”
- Covered: the app’s new TCP connections to the internet. Browsers and other apps that use QUIC (UDP on port 443) are turned back to TCP while they have a limit, so their web traffic is covered too.
- Not covered: DNS lookups, calls and other UDP traffic, connections inside your local network, and incoming connections.
- Already open: a connection that was open before you set the limit keeps its speed until the app reconnects.
- VPN and tunnel apps can’t be limited: “VPN and tunnel apps can’t be limited because they carry other apps’ connections.” If Outbound can’t tell whether an app carries VPN traffic, it says so and asks you to try again while the app is running.
A connection Outbound can’t limit goes ahead at its normal speed, under your rules as usual.
Speed limits stay on while Outbound is paused. Pausing stops your rules applying; it doesn’t lift limits.
From the menu bar
Section titled “From the menu bar”While at least one app has a limit, the menu bar panel shows Speed Limits with the number of limited apps. The menu lists each app with its current rate and cap. Choose an app to open it in the inspector, or choose Remove All Speed Limits.
From Terminal
Section titled “From Terminal”outboundctl limit sets and removes limits:
outboundctl limit <app> <rate>sets both directions. Rates use Kbit/s, Mbit/s or MB/s. Add--upor--downto change one direction and keep the other.outboundctl limit clear <app>removes one app’s limit;outboundctl limit clear --allremoves every limit.outboundctl limit listlists the limits in bytes per second. With--json, a direction with no limit isnull.
Setting and clearing limits are changes, so they follow the Command line setting in Settings › Security, like other changes made from Terminal. See the outboundctl overview.
How it works
Section titled “How it works”Outbound’s network filter decides which connections may go ahead. To slow an app down, the same system extension also runs a transparent proxy, only for apps you give a limit. It forwards those apps’ TCP traffic at the rate you set, without reading, logging or keeping what it carries. Nothing extra runs until you set the first limit, and the proxy configuration is removed when you clear the last one.