VaX#n8 writes:
> I don't know if it would be possible, but it would be Really Nice if netstat
> had an option to show which PID had a particular connection open.  I could
> not find such an option, and a sysadmin friend agrees that this would be
> very helpful if you have a suspicious connection open and want to track
> it down.  I imagine the kernel must store this info somewhere since it has
> to deliver packets to said process - I guess via the descriptor table[s].

As others have mentioned, use fstat (as shipped), or lsof (3rd party
freeware).

However, a long time ago I wrote patches to netstat (before I knew
about fstat) to do exactly this. And I submitted them as a PR.
Looking through the PR database on www.netbsd.org, I found the
(now closed) PR:
	bin/348: a hack to netstat(1) to show the owner of a connection

You can look at it at:
	http://www.NetBSD.org/cgi-bin/query-full-pr?348

Hope that's helpful.


--
Luke Mewburn <lukem@telstra.com.au>

"Think of it as Evolution in Action"      -- `Oath of Fealty', Niven & Pournelle