Take a look at 'netstat'. Pings are of the network type 'raw' rather tcp or udp.
This command may work for you (as root, to see all activity):
netstat --ip --raw -anp
You'll get output like this:
raw 0 0 0.0.0.0:1 192.168.1.10:* 7 3698/ping
The last column is the process ID of the program making the connection, and the name of the program after the slash.
Then you can use 'ps' to get full details on the process whose ID you found, like this:
ps -A u | grep '3698'
Which will show the full command as the last column:
hob 3698 0.0 0.0 2028 416 pts/1 S 23:53 0:00 ping 192.168.1.10
|