A good question popped up on Ask TUAW today:
I have recently noticed that I have a fairly constant upload of 14-16 KB/s going on in the background (I'm using iSlayer's iStat menus), even though I haven't initiated any upload. I'm not now running any online backup apps. I've checked in Activity Monitor, and can't see anything very out of the ordinary there, although evidently I've missed something. Is there an easy way to see which applications/processes are using the network connection? Or should I get Little Snitch? It's quite annoying to see that the network connection is being used, and being unsure about what is using it. It's potentially disastrous when I'm using metered connections!
Here's the answer TUAW gave:
Little Snitch ($29.95) is probably the easiest way to go. There's also another recently released net monitoring application called ProteMac Meter ($29.95) which might be worth checking out. I don't recommend Glowworm FW as I've had serious problems with it under Leopard and have found others reporting similar difficulties. It may be that the demos of one of these application will be enough to find the source of your unknown network traffic.
Ummm, let me save you 30 bucks and a download, dude, OS X has everything you need built in:
Lists open sockets. Output looks like this, presto!
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
Quicksilv 784 jpdaigle 253u IPv4 0x4baba68 0t0 TCP 192.168.1.121:64139->host44.hrwebservices.net:http (CLOSE_WAIT)
SystemUIS 13716 jpdaigle 10u IPv4 0x431a880 0t0 UDP *:*
Mail 23859 jpdaigle 17u IPv4 0x51cb270 0t0 TCP 192.168.1.31:55041->webaccess.hostedmail.net:imaps (ESTABLISHED)
Mail 23859 jpdaigle 18u IPv4 0x6d7d270 0t0 TCP 192.168.1.31:55043->webaccess.hostedmail.net:imaps (ESTABLISHED)
Mail 23859 jpdaigle 23u IPv4 0x8587e64 0t0 TCP 192.168.1.31:55049->webaccess.hostedmail.net:imaps (ESTABLISHED)
Mail 23859 jpdaigle 26u IPv4 0x58f8e64 0t0 TCP 192.168.1.31:55044->webaccess.hostedmail.net:imaps (ESTABLISHED)
firefox-b 25763 jpdaigle 31u IPv4 0x703266c 0t0 TCP 192.168.1.31:55088->220.127.116.11:http (ESTABLISHED)
firefox-b 25763 jpdaigle 36u IPv4 0x9779270 0t0 TCP 192.168.1.31:55089->18.104.22.168:http (ESTABLISHED)