The nethogs command displayes programs attending network communication.
There is a permanent line:
PID USER PROGRAM DEV SENT RECEIVED
? root unknown TCP eth0 0.000 0.000 KB/sec
Why nethogs displays such a row and what does it mean?
You should not care about the unknown program it is a fake process , there is the answer of
the nethogs developer's
The 'unknown TCP' line is normal: it collects all TCP traffic that we were unable to relate to any actual process.