Why does Activity Monitor show so much continuous network traffic?

Sorry, guess I wasn't specific enough: tcpdump ALSO does not show any traffic that would account for the 34 KB/sec (120 MB/hr) continuous activity. It shows nothing at all for tens of seconds at a time, while Activity Monitor, which updates every two seconds, shows a continuous stream of data during this time.

The switches at home and at work generally corroborate the activity shown by tcpdump / atMonitor / MenuMeters, not the continuous data flow shown by Activity Monitor. The MacBook Air I'm sitting at right now shows similar discrepancies, with traffic totals in Activity Monitor about 40x higher than those shown with the other tools and a steady and inexplicable (and by other means invisible) 29-34 KB/sec of both sent & received traffic. tcpdump shows periods of network silence between 2-15 seconds in length (in between DNS lookups; netbios syncs; ntp queries; ipp messages; http, pop, and imap messages; etc. happening in bursts as one would expect).

Changing Activity Monitor to refresh every half second shows the mystery traffic as a burst of 112 KB sent & received every two seconds--and no, that's not the same throughput as the 29-34 KB seen at 2-second refresh intervals. When I set refresh to every 5 seconds, the mystery throughput drops to 22 KB / sec. As the throughput varies depending on refresh interval, I wonder if I'm seeing internal loopback queries (or something of that sort) contributing to the totals. Is it possible that the mystery traffic is of AM's own creation, and only exists within the machine and is not actually sent on the network?

Lest we digress further into general network troubleshooting techniques, let me restate the question, perhaps a bit more clearly: has anyone else seen this traffic-volume discrepancy between the Activity Monitor's Network tab and other network monitoring tools, and does anyone have an explanation for it?

Update: It does indeed appear that Activity Monitor on 10.6.3 is showing traffic on the loopback interface "lo0". I disabled all external networking, and still got 29 KB/sec traffic. During a 30-second test, AM showed 504 packets/sec in and out; tcpdump captured 30248 packets from lo0, or 504.13 packets/sec. Hmmm.

AM in 10.5.8 (running on my Mac Pro) doesn't do this: when the network is disconnected, AM shows 0 bytes/sec in and out, just like MenuMeters and atMonitor.

My next step, since I now know what's going on with my machines, if not why, is to ignore Activity Monitor--I have work to do, and I now know what info to trust to do it with.

It might be amusing to go on a snipe hunt and suss out why it's occurring, but I have far too much other stuff I should be doing instead. I have a perfectly functional workaround (ignore AM in favor of 3rd party tools), and that's better than embarking on an open-ended investigation with no predictable endpoint!