>>10220If you want to inspect anything you have to close down your browsers, torrents, the usual and wait for existing connections to close so you have a clean slate. Modern websites for example are constantly connecting in the background via JS, browsers themselves make connections in the background, and torrent peers can take a while to figure out you're not participating anymore.
Then use netstat + wireshark to see which processes are still connecting to the Internet and to where.
- netstat will tell you which process is connected to what IP(s)
- wireshark will tell you about the packets being sent to and from that IP, you can also inspect DNS requests to figure out what domain it's connecting to, if any