Firestarter will show you in real-time what applications are doing what, the closest thing I know of to a Linux equivalent of ZoneAlarm (Windows) or Little Snitch (Mac OS X) is this proof of concept.
Personally tend to use FireHOL, locking down everything to begin with, and then adding applications that require Internet access one by one. If you locked down port 80 and only permitted Firefox to send traffic to destination port 80 you'd have the equivalent of only permitting Firefox to access the Internet.
It's fairly straightforward with FireHOL to deny everything by default and only permit access on a per-application (or per-user) basis. You might want to allow the root user to access using any application, but individual users can only access the Internet using specified applications, or specified ports.
Update: FireFlier looks like it will do the trick. But it's no longer in development so YMMV.