I am trying out nethogs to monitor my network traffic. I am seeing some root processes that periodically send and receive data but I don’t know how to find out which processes they are. I would appreciate to get some help to understand the terminal output:
check the IPs … whois ipadress 
but i do not see traffic on the root processes you show
port 443 is https:// and port 80 http://
could be DNS requests?
You can view all network traffic info by process using bandwhich (AUR). I’ve only briefly played with this though, don’t know too much about it.
You could then use ps to identify more info about a process using network bandwidth.
Thanks @joekamprad for the reply and the suggestions! I will look into it with whois.
I use dnscrypt-proxy with their default public dns resolvers.
Thanks @otherbarry for the reply!
I’ll have a look at bandwhich. Thanks for pointing it out and the suggestion to use ps!
independent from that i see the same root outputs on surfing the net i would bet on DNS resolution process
@otherbarry @pebcak I might be a bit late to the party and out of the loop, but bandwhich is in the official community Arch repos btw. The bandwhich-git package is the one currently in the AUR. Hope this map help
Edit: just installed bandwhich and I like it!
Thanks @Scotty_Trees!
I also installed the version from the community repo. I had to postpone coming back to the forum and report. It looks like a nice and useful tool. Thanks again to @otherbarry for pointing it out!