Capture internet traffic on single interface

What kind of software are you trying to update? From what information you provided, it probably only uses HTTP(S) (TCP ports 80 or 443), but you'll need tools that know about HTTP(S) to be of much use.

HTTP URLs operate at the application layer (OSI layer 7): netstat operates at the network/transport layers (OSI layers 3/4), so you won't be able to get the information from it because it's not designed to do that. It's like trying to get the name of the people who live in a house based only from a street address.

Can you use any other tools, like Wireshark or a proxy server? If you had a proxy server, you could log the requests through that (and get a rough idea of the bandwidth too!) If your program uses more exotic protocols, Wireshark may be able to help.

I am giving an answer, though not exactly what you are asking.

For necessary ports for connections to install packages/do security updates are usually 80/TCP and 443/TCP; the addresses depend on the repos you are using.

If using a proxy, however, instead of monitoring/selecting addresses, it would be wiser to whitelist in the proxy APT or YUM connections (e.g. per app).

As for monitoring, you can use tcpdump while doing security updates and installing packages as in:

sudo tcpdump port 80 or port 443

However, beware that depending on the name of repos you are using, some repo names might translate to more than one IP address.

As for network usage, it is not significant if only a single system, however it varies in whatever updates are installed. I would monitor it over time with SNMP and cacti. You can also try to use iftop, but then again such measures will be worthless.

Getting to the point, the traffic data should be either estimated/guessed or measured over months.