I have started monitoring, in a gross kind of way, my internet usage
starting by using the 24hr graph on my router software (opensource).
So I'm seeing traffic happening in the middle of the night that is
arriving to the mobile equipment, tablet and stupid phone. That
needless use of
bandwidth was curtailed by putting said items on airplane mode for overnight.

Now I am also seeing small spikes of incoming traffic about 3x every 2
hours and I'd like to find out where that traffic is coming from and ,
if I don't like who's doing the sending, to curtail it. If tried short
stints of using vnstat, nethogs and iftop but am not seeing anything
that I think will help me in my quest.

Any suggestions from those that have done or are doing this?