The daemon netatopd takes care that information is gathered about processes that are finished. For every finished process that has transferred network packets, a binary record is written to a dedicated logfile. The added records in the logfile are read by atop with every sample to show information about the network activity of finished processes as well.