I landed on iftop, installed it, and ran it. I have a dsl service from Earthlink served to LAN via Linksys wired/wireless capabilities. There is my desktop, Mandriva loaded atm, the thin client running Puppy Linux for the salon webserver, the PS3, powered down atm, and DirecTV satellite tuner all wired into the router.
I found a communication with google by doing 'whois' on an ip in the iftop display, possibly because of the open search pages, some directv hosts, understandable, then a lot of connections to a mysterious 'xp-pro' host. That had me worried about a hack to the wireless or some malware. I disconnected the PS3 and the tv, killed the bitcoin daemon, which I've just started to play with, closed Seamonkey but there was always something going on with 'xp-pro'.
Finally, I logged into the Tomato firmware on the router and found my desktop nic was called xp-pro. I've found that Windows can have effects on hardware that persist through a reboot into Linux and wonder if this is why.
p.s. how to do thumbnails, linked to full-size image, iirc?