Transmission root nethogs

Support Software & Applications
1

Recently installed nethogs 0.8.6-1 from the Official Repositories

I see some disturbing activity that appears to be related to
transmission-gtk 3.00-2 from the Official Repositories

I start-up nethogs
Things appear “normal”
I start transmission
I see network activity for transmission-gtk running as me
Shortly thereafter I see lots of processes with network activity running as root

$sudo nethogs

NetHogs version 0.8.6

PID USER     PROGRAM                                             DEV         SENT      RECEIVED

72345 drew transmission-gtk eno1 0.413 0.279 KB/sec
1392 drew /usr/lib/chromium/chromium --type=utility --util… eno1 0.095 0.069 KB/sec
? root 192.168.4.213:57735-79.13.141.93:13180 0.025 0.013 KB/sec
2338 drew rclone eno1 0.013 0.013 KB/sec
? root 192.168.4.213:58213-84.81.43.195:56849 0.014 0.000 KB/sec
? root 192.168.4.213:49655-177.73.5.127:52795 0.014 0.000 KB/sec
? root 192.168.4.213:41363-165.73.248.93:62187 0.014 0.000 KB/sec
? root unknown TCP 0.000 0.000 KB/sec

TOTAL 0.589 0.374 KB/sec

I have some downloaded torrents that are seeding to other users.
This is scary!!!

2

When nethogs doesnt know exactly what its looking at you get the PID of ? or 0, and the owner as root. The data is definitively untrustworthy.
You will often see this quirk with things that have a lot of quick/short-lived connections … like bittorrent clients.

You could maybe check with something like:

sudo netstat -np4