You can use strace on a specific pid to figure out what a specific process is doing, e.g.:
strace -fp <pid>
You might see something like:
select(9, [3 5 8], [], [], {0, 999999}) = 0 (Timeout)
| ּ_בּ | |
| בּ_בּ | |
| טּ_טּ | |
| כּ‗כּ | |
| לּ_לּ | |
| מּ_מּ | |
| סּ_סּ | |
| תּ_תּ | |
| ٩(×̯×)۶ | |
| ٩(̾●̮̮̃̾•̃̾)۶ |
| #!/usr/bin/python | |
| """ | |
| dnsSquirrel.py: Simple DNS sniffer based on dnssnarf.py which outputs data in bind log | |
| format for further analysis with more advanced tools | |
| """ | |
| from datetime import datetime | |
| import logging | |
| from scapy.all import * |