If you are looking to find out the current TCP connections and their programs/PIDs, you can start by running
netstat -antp, where the
-p option shows the PID for each connection. If you have a very busy box, with lots of connection, pipe the output to a
more command, like this:
netstat -antp | more.
For completeness' sake, correlate the information with either the
top command or
I am not 100% sure on Macs, though; sorry. Feel free to play about with the
netstat on Mac OS. Also, you can refer to their online man page here.
If you feel the need to do a deeper inspection, once you have performed the aforementioned steps, try a packet sniffer, such as Wireshark.
Even if you do not manage to find out what it is - you should be able, but assuming you couldn't, you could still block the outgoing connection at the local machine, and/or blocking the IP from entering your network at the perimeter level by blocking incoming connections on your router.
For Macs you might try
lsof -i 4tcp, which would give you the output in the following order:
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME