If I am using rtorrent listening on port 9000. I see many incoming connections assigned to root with no program that are obviously rtorrent.
Do you see those exact incoming connections in netstat?
I'm not entirely certain, but I believe bittorrent uses a lot of short-lived connections. It might be the connection disappeared from /proc/net/tcp before nethogs had a chance to take a look at it.
If you see the connections in netstat, something else is going on.
Not sure how to debug this. We should probably create a test tool that simulates traffic based on a wireshark dump you can create. Can you make a small test running 'nethogs -b' and capturing the output and the corresponding traffic in wireshark?
Can you try the latest CVS version? It should be more forgiving about short-lived connections like bittorrent uses.