A quick article that lets you know what's using your badwidth.
For immediate monitoring you can use iftop. This will show you the currently active connections and the bandwidth they are using. Once you've identified a high traffic connection, find the local port number and use netstat to find which process the connection belongs to.
sudo netstat -tpn | grep 12345
For longer term monitoring I would suggest something like darkstat. This can give you a breakdown per host and port which might allow you to figure out what the traffic is related to.
In my case whoopsie was using my badwidth so to stop it I ran
sudo vi /etc/defaults/whoopsie sudo service whoopsie stop