This network activity observation should be done via netstat. You'll need to continuously monitor the output of the netstat command. This must be automated/scripted. code example

netstat [-OPTION1] [-OPTION2] [-OPTION3] …mixed