So suppose there's a connection that shows up in netstat that looks like this: # netstat -tupan |grep 139768 Active Internet connections (servers and established) Proto Recv-Q Send-Q Local Address ...