Netwatch will work like this: it executes tcpdump with a certain filter on it. Of course, you can also define this filter yourself in the code. On every line of output from tcpdump, it executes a netstat command and stores the output in a file. When it has a few dumps, you can examine the files and find out which program causes the traffic!