Finding Where Data is Coming From?

[Gordon Messmer]

Nick Wilson wrote:
> 
> Thanks, I'll try it. I did try 'netstat' but it just gives me unusable
> data...

The data isn't completely unusable.  It should (or can, based on its 
options) give you the inode of each socket.  You can look under 
/proc/<pid>/fd for a processes sockets and their inodes, then correlate 
the two data sets.

That's basically what lsof does for you automatically, but it's probably 
worth understanding the relationship of the two sets of data.