Trace process with high outgoing traffic

[admin at 3dr.org]

Hello, I'm looking for a way to trace a PHP-FPM forked proces which has high outgoing traffic (user attacking some remote servers). Any ideas? 

Thank you
Luke