Packet sniffing tools

Microsoft Network Monitor can display the process for each traffic "stream" captured.


Little Snitch can do this.

If the process doesn't change its ports too often, you can get a list of the process' ports with

$ lsof -i | grep <process name>

Then use tcpdump.

$ sudo tcpdump -i en1 port 80 > dump.txt

Where en1 is your interface.

$ ifconfig

to get a list.

$ man -t lsof | open -f -a /Applications/Preview.app
$ man -t tcpdump | open -f -a /Applications/Preview.app
$ man -t pcap-filter | open -f -a /Applications/Preview.app