How to know which program is accessing the Internet.
 

I start my ppp connection as follows:

pppd call provider demand idle 300

The purpose is to allow users to connect on demand, and for the system to then drop the connection after 5 minutes of inactivity. The problem is that something is periodically initiating a connection when no users are logged in. How can I find out what is doing this?

I'm using debian sarge.

Try running:
netstat -anp

This is likely to give you a lot of results but you can narrow it down a lot by running a tcpdump to see which ports are being accessed. You can then grep the netstat output for the port/ip address given by tcpdump.

Thanks, the 'netstat -anp' command looks like what I need. However, the
output of this command is the same before and after the rogue ppp
connection has been established.

If I 'ping' some site and then run 'netstat -anp' I do see the 'ping'
program listed in the netstat output. So, it looks like the netstat
command is the right thing to do. Why, then, would the program
responsible for the unwanted ppp connection not show itself?

The item probably is showing. That's why I suggested using tcpdump to find out which ports and ip addresses are being connected to. You can then cross reference that with the netstat output.
In the case of me connecting to LQ:
I can see the remote IP is "64.179.4.149". I then check with netstat:
Voila, you can see that firefox is indeed making the connection. The local client port should be the same if it is a persistent connection but because I ran the commands a little appart and had to refresh the page you will notice that in tcpdump the local post was "33498" and in netstat it was "33508".

Hmm... I definitely don't see 'netstat -anp' showing me anything different
before, during, or after establishing of the unwanted connection. I
redirected the netstat output to files and 'diff'ed the files. They were
all identical. tcpdump definitely shows activity, but I can't see how to
get the program name from that.

Maybe part of the problem is that the machine with the modem hooked
to it is a gateway on a LAN and maybe another machine on the LAN is
requesting the connection.

I'll keep poking around...

I'm not sure you are understanding what I am saying - the netstat output may not change. That is the reason for using tcpdump.

Okay, thanks for being patient. I was stuck on the idea that tcpdump
was just for filtering my netstat output. Since my netstat output is small
I figured I didn't need tcpdump.

When I run tcpdump I see activity stir as the rogue connection initiates,
but I don't see that output pointing me to any particular line in my netstat
output.

Here is a 'script' of tcpdump as the connection starts and for a few seconds
afterward:

Now here's a netstat script generated at the same time. I just kept re-executing the netstat
command, once before the connection started and a few times after. I'm not seeing any useful
foreign address info.

There doesn't seem to be anything in the netstat output although the tcpdump shows several dns requests. My guess is that something is requesting dns queries. Check what services you have running, some of them may be trying to lookup dns addresses for connecting clients. Some things that do this are mail servers, web servers and possible even samba.