A quick article that lets you know what's using your badwidth.

For immediate monitoring you can use iftop. This will show you the currently active connections and the bandwidth they are using. Once you've identified a high traffic connection, find the local port number and use netstat to find which process the connection belongs to.

sudo netstat -tpn | grep 12345

For longer term monitoring I would suggest something like darkstat. This can give you a breakdown per host and port which might allow you to figure out what the traffic is related to.

Whoopsie

In my case whoopsie was using my badwidth so to stop it I ran

sudo vi /etc/defaults/whoopsie
sudo service whoopsie stop