dtrace script to monitor all network send activity

send.d

tcp:::send
/args[1]->dport == 80/
{
        printf(
            "Packet sent:  %s:%u -> %s:%u on behalf of %s (PID: %d, UID: %d)\n",
            args[1]->ip_saddr, args[1]->sport, args[1]->ip_daddr,
            args[1]->dport, execname, pid, uid);
}

snow_leopard.d

#!/usr/sbin/dtrace -C -q -s

#if Q_BIG_ENDIAN
#define ntohs(x) ((short)x)
#else
#define ntohs(x) ((short) (((((short)(x)) & 0x0FF) << 8) | ((((short)(x)) >> 8) & 0x0FF)))
#endif

inline int AF_INET = 2;

syscall::connect:entry,
syscall::connect_nocancel:entry
/
! self->trace
/
{
    self->connectFD = arg0;
    self->sock = ((struct socket *) (curproc->p_fd->fd_ofiles[self->connectFD]->f_fglob->fg_data));
    self->trace = 1;
}

syscall::connect:return,
syscall::connect_nocancel:return
/
self->trace
&& (self->sock->so_proto->pr_domain->dom_family == AF_INET)
/
{
    pcb = (struct inpcb *) self->sock->so_pcb;
    localPort = ntohs((uint16_t) pcb->inp_lport);
    remotePort = ntohs((uint16_t) pcb->inp_fport);

    printf("%u %u -> %u\n", uid, localPort, remotePort);
}

syscall::connect:return,
syscall::connect_nocancel:return
/
   self->trace
/
{
   self->connectFD = 0;
   self->sock = 0;
   self->trace = 0;
}

$ sudo dtrace -s send.d

Snow leopard appears to not support TCP dtrace provider, which is new in lion. Second script is for snow leopard.