I don't know if it would be possible, but it would be Really Nice if netstat
had an option to show which PID had a particular connection open.  I could
not find such an option, and a sysadmin friend agrees that this would be
very helpful if you have a suspicious connection open and want to track
it down.  I imagine the kernel must store this info somewhere since it has
to deliver packets to said process - I guess via the descriptor table[s].