I tried looping with
netstat and but the packets are small and not frequent so do not get caught (can still see them with
tcpdump). Need to know which process sends those packets.
Look for the
This assumes that the sending process is leaving its socket open between sends, which is what any normal program would do. If you are dealing a program that is deliberately trying to hide itself, that's whole different story.
I guess it should be possible with