I logged the traffic with wireshark, http://stashbox.org/1440698/wireshark
and simultaneously the output of lsof http://stashbox.org/1440699/lsof and the output of netstat-anp http://stashbox.org/1440700/netstat I had nothing running (eg browsers or other clients). What could it be?