Approach 1. Through LSOF
For example, to figure out which process emit DNS queries you can use below command:
sudo lsof -PniUDP:53 -r 1 | grep :53
Approach 2. Via ATOP / NETATOP
Seek and install the required kernel module and userspace utility (example for Arch Linux):
yaourt -Ssq netatop
I prefer to use a more flexible variant (if it possible) with DKMS support:
yaourt -S netatop-dkms
Load module:
sudo modprobe -v netatop
Let’s get started monitor network activity according to processes:
sudo atop -n