I am looking for a tool that will log network traffic, preferably in an easily understandable way like, say, nethogs.

What I want is to start network logging at boot time, then look at it some time later to get a comprehensive overview about which applications did what.

Unfortunately nethogs does not provide logging.
I also looked at ntopng, but it seems way too complicated for my needs, and seems to focus on real-time overview in a browser.
I also looked at various solutions on stackoverflow etc., with e.g. netstat, but again this does not seem to address logging.

In a word, the application's output would need to be simplistic enough for me to understand.

A network monitoring tool that was made with logging in mind, maybe?

iptraf can log. It only shows traffic per address and port, not application (I think). You would have to derive the application from address:port.

Wireshark might be something to look at. It won't be able to translate network to socket/application.

I guess there is some way to view by program that I don't know about. I'd be tempted to use some sort of vm or jail to capture an applications traffic.
Last link has many tools.

https://www.slashroot.in/find-networ...-process-linux
https://www.cyberciti.biz/faq/linux-...ing-bandwidth/
https://www.tecmint.com/linux-networ...itoring-tools/

I would suggest wireshark too. Just wanted to note: to analyze network traffic you need to be familiar with it. It cannot be really simple, because it is relatively complex (by its nature). WireShark organizes the captured data in a "user friendly" way and there are a lot of possibilities to filter out unnecessary traffic/info.

Thanks for all your help and sorry for the late reply.

I understand that network traffic is very complex - way too complex for me.
That's why I like the way e.g. nethogs works: it shows you which application accesses which address/IP.

I'm not so interested in bandwidth or how much data is transmitted, just who (i.e. which application) connects to who - especially unbidden!

I would like to have something as simple as that, but with logging - which nethogs does not mention at all in its documentation.

Netstat? For example, netstat -pant will show TCP connections...

I also really like iftop for bandwidth and overall connections, but that doesn't seem to apply in your case.

Edit: I just realized you mentioned netstat in your post. Duh.

Maybe auditctl? You can try auditctl -A exit,always -S connect
This writes logs at /var/log/audit/audit.log

i use darkstat.
here is example pic of it.

https://i.imgur.com/jgsHDGw.png

https://www.ctrl.blog/entry/fedora-darkstat.html