iftraf sounds interesting. I was looking for just such a program the other day.
I was sitting there and noticed with my iStat monitor that I was uploading something at 250 KB/sec. I closed Chrome and eventually all running programs in the doc, yet it still continued.
I tried to find out WHAT was uploading that, but to no avail. Any suggestions for tools? I ended up trying iftop, lsof -i, and netstat to get a glimpse, but it stopped before I could get to the bottom of it.
Nethogs is great when you need to determine what processes are transferring data or how much they're transferring. I got curious how it works, so I ran it through strace and looked through the source. /proc/net/tcp lists all established TCP connections. It includes local and remote addresses and ports and the inode for the socket. Nethogs sniffs traffic and associates it with its entry in /proc/net/tcp. It takes the inode from there and scans through /proc//fd/ looking for the file descripter that has that inode to determine which process has the socket open. Once it finds the process it adds it to a table of inode to process id mappings so it doesn't have to scan through /proc again the second time a packet for that connection comes through.
Wireshark or some other packet sniffer can be used to sniff the packets. From the packets you'll get a pretty big clue what's going on. If it's a connection-oriented protocol, you'll be able to trace back to the source ports with lsof, but for this use case often just a glance at what's coming out will be enough to give it away.
I was sitting there and noticed with my iStat monitor that I was uploading something at 250 KB/sec. I closed Chrome and eventually all running programs in the doc, yet it still continued.
I tried to find out WHAT was uploading that, but to no avail. Any suggestions for tools? I ended up trying iftop, lsof -i, and netstat to get a glimpse, but it stopped before I could get to the bottom of it.