monline

To cut it short, use the nethogs utility. You'll see an output like this:
Nethogs is not the perfect tool despite of its ease of use. Read more for some further tips.

Nethogs is a bit too simple. It lacks any sort of control. The version I saw in Ubuntu Hardy had fixed sorting: the top processes were selected based on incoming traffic. On an LTSP server the top network usage will come from the sshd processes that forward the X protocol to the thin clients. This is an outgoing traffic (at least from the perspective of the LTSP server), thus nethogs might not even show our top sshd process (if there're many processes using high incoming bandwidth). You might think that running nethogs on the loopback interface (lo) might still give you the expected result, but you're wrong. Unfortunately nethogs shows zero incoming traffic for all processes in this case.

A more suitable approach is to use a combination of tools. You can use tcptrack to find the real bandwidth-killer. Unfortunately tcptrack has no ascii output (only curses), so it'd be a pain in the ass to get the top dog out of it. But your eyes are just made for this kind of a job. So start tcptrack, get the IP+port of the top bandwidth user connection and search for it in netstat's output. Eg.

This tells you that the sshd (with PID=31777) of user3 is the problem, so probably you should ask him to do something about it.

If you're interested in the specific application that sends that much data to the client, then start tcptrack for the loopback interface (tcptrack -i lo) and look for that IP+port combo in netstat's output.

You can use iftop too (instead of tcptrack) and this one gets you a more precise answer since tcptrack shows only TCP connections, while iftop's output is based on all IP packets (at least by default). Try this:
Hit the "t" key 3 times to switch the display to the output-only mode. Now you can see the IP-connections generating the most (outgoing) traffic. Looking up the process with netstat gives you the user and the app. A simple ps uwwp <pid> will tell you the full command line that was used to invoke the given process.