Ubuntu - which service or which port generates how much traffic?

Question

linux

Good time,
there is a server based on Ubuntu 12.04.5 LTS.
The server has Apache and NodeJS installed.
Apache based API and NodeJS based websockets are used for the needs of the site. That is, both without authorization. There is nothing private there.
The problem is that the server generated 4TB in the last month.
I requested statistics from the provider, every day the server generates about 10GB-15GB of traffic.
My task is to figure out what kind of service it is and on which port it generates such huge traffic.
I do not believe in apache, it would just die from the load. NodeJS on web sockets to give so much data?! It's also hard to believe.
The result of IFTOP in one night:

Tell me please, how can I monitor which port generates how much traffic?
I tried to find a gluttonous port using the same IFTOP, but so far I have not succeeded.
iftop -f "dst port 3000"

Answer 1

Linux traffic monitoring - will it work?
and still here

Answer 2

nethogs will show what is happening right now

Answer 3

Thanks for the links.
iptraf -s eth0
does not show the ports on which NodeJS hangs, I can not understand why.
3003,3004 for example. Although they are active, iftop -f "dst port 3003" shows activity.
The problem is that iptraf and iftop show REALTIME, and I need to understand in total which port generates how much.

Answer 4

jnettop.kubs.info/wiki