How do I know what processes are using the network?
Solution 1:
netstat --inet -ap will show you what processes are using the internet and what host/port each process is using. If you want IP addresses and not hostnames, use -n. (--inet shows only internet sockets, -a shows both listening and connection sockets, -p shows process name/ID information). You'll probably want to run it with sudo so that it can give you information about all processes.
nethogs will show you how much bandwidth each process is using, but it doesn't tell you what host each process is connecting to.
ntop is a bit heavy, but gives you an overview of network traffic in general.
(netstat is installed by default and nethogs and ntop are available in Ubuntu's repos)
As far I know there's no single utility that puts 1, 2, and 3 together.
Solution 2:
Nethogs can handle your first two requests. Iftop can handle the third. You may need to press p in iftop to show the port number.
NetHogs is a small 'net top' tool. Instead of breaking the traffic down per protocol or per subnet, like most tools do, it groups bandwidth by process. NetHogs does not rely on a special kernel module to be loaded. If there's suddenly a lot of network traffic, you can fire up NetHogs and immediately see which PID is causing this. This makes it easy to indentify programs that have gone wild and are suddenly taking up your bandwidth.
iftop does for network usage what top(1) does for CPU usage. It listens to network traffic on a named interface and displays a table of current bandwidth usage by pairs of hosts.
Solution 3:
For lsof use lsof -i.
You can also query active connections for each process using netstat -punta run as root to show process names or without to show only PIDs. To get a dynamic real-time view you can easily trick your way around using watch -> watch -n1 netstat -punta(same goes for iftop).
As for alternatives you can use ntop + iftop.
Solution 4:
iftop is equivalent to top for processes, which shows everything, you can press p to toggle to show port.