You're then given an output such as

+-------+----+--------+--------+----------+---------------+----------------+------------+-------------+------+-------------+--------------------------------+
| pid   | fd | socket | family | protocol | local_address | remote_address | local_port | remote_port | path | state       | community_id                   |
+-------+----+--------+--------+----------+---------------+----------------+------------+-------------+------+-------------+--------------------------------+
| 600   |    |        | 2      | 6        | 0.0.0.0       | 0.0.0.0        | 135        | 0           |      | LISTEN      | 1:O4gFUZb75kZJ+fqbwDVbSELexnw= |
| 4     |    |        | 2      | 6        | 0.0.0.0       | 0.0.0.0        | 445        | 0           |      | LISTEN      | 1:VKZCxbLg22hGq67qTgJxFakJpto= |
| 1060  |    |        | 2      | 6        | 0.0.0.0       | 0.0.0.0        | 3389       | 0           |      | LISTEN      | 1:TEeCMkagIzD8H03OsqJXyifU5q8= |
| 5860  |    |        | 2      | 6        | 0.0.0.0       | 0.0.0.0        | 5040       | 0           |      | LISTEN      | 1:QqC/kGV65ePBKi44IStzsz1M464= |
| 840   |    |        | 2      | 6        | 0.0.0.0       | 0.0.0.0        | 49664      | 0           |      | LISTEN      | 1:C1WxcZMGu6kQveDpboZLetfEm6o= |
| 688   |    |        | 2      | 6        | 0.0.0.0       | 0.0.0.0        | 49665      | 0           |      | LISTEN      | 1:Gfk6J5DVF1I9v5qjyGIvF9HIcKY= |
| 1380  |    |        | 2      | 6        | 0.0.0.0       | 0.0.0.0        | 49666      | 0           |      | LISTEN      | 1:rWwFhuSM8PrSGJxPU5sxzgxJdrY= |
| 1548  |    |        | 2      | 6        | 0.0.0.0       | 0.0.0.0        | 49667      | 0           |      | LISTEN      | 1:VRkyQHSKlFCsNELtEhj8hF8VhLw= |
| 2496  |    |        | 2      | 6        | 0.0.0.0       | 0.0.0.0        | 49668      | 0           |      | LISTEN      | 1:GahWudkQTUB6L1CKvsWPqfsCPb4= |
| 840   |    |        | 2      | 6        | 0.0.0.0       | 0.0.0.0        | 56460      | 0           |      | LISTEN      | 1:e2FrVU/Tb+mEoywCnh6jZZQh5Lw= |
| 2808  |    |        | 2      | 6        | 0.0.0.0       | 0.0.0.0        | 59711      | 0           |      | LISTEN      | 1:Q2/U+CebWoQXfwfFBxaGuYqBqVI= |
| 828   |    |        | 2      | 6        | 0.0.0.0       | 0.0.0.0        | 61697      | 0           |      | LISTEN      | 1:YSKxnrGv8WAVh20yS5V/B4C+HZc= |
| 4     |    |        | 2      | 6        | 10.91.0.127   | 0.0.0.0        | 139        | 0           |      | LISTEN      | 1:bKc9dB2Vwx9n7f+aFVlraj4qS2k= |
| 1060  |    |        | 2      | 6        | 10.91.0.127   | 10.89.84.151   | 3389       | 64844       |      | ESTABLISHED | 1:cj7GfyOIZYUjkAv1MeAwUh4n8Jg= |
| 4     |    |        | 2      | 6        | 10.91.0.127   | 54.67.33.233   | 57528      | 443         |      | ESTABLISHED | 1:znSe362z9q3LWsemdA8VPxDShjM= |
| 6204  |    |        | 2      | 6        | 10.91.0.127   | 172.144.0.22   | 63216      | 10123       |      | ESTABLISHED | 1:RTl/J/0CNhn1pVDexxLjYfOSpSw= |
| 1668  |    |        | 2      | 6        | 10.91.0.127   | 99.86.38.41    | 63896      | 443         |      | ESTABLISHED | 1:9tXXNSzlgIp0AE4lvryuv65YrVg= |
| 1668  |    |        | 2      | 6        | 10.91.0.127   | 52.84.184.91   | 63897      | 443         |      | ESTABLISHED | 1:yAVsrHeVw04UC2prR36souxzn4U= |
| 6424  |    |        | 2      | 6        | 10.91.0.127   | 72.21.91.29    | 63906      | 80          |      | CLOSE_WAIT  | 1:/o6sq9zo4FY+eZr1zZJEo1NOJu0= |
| 3312  |    |        | 2      | 6        | 10.91.0.127   | 13.64.180.106  | 64887      | 443         |      | ESTABLISHED | 1:qGAMPp90M60ilOvG7Oapt++7zrw= |

At the end of these lines is the community_id

1:qGAMPp90M60ilOvG7Oapt++7zrw=

. This is a basic md5 sum of local_address, remote_address, local_port, remote_port, protocol, and the same function can then be computed at a network sniffer like (Zeke, Arkime, etc). Shameless shoutout for Arkime (formerly Moloch), i'm a former Aol'er. Obviously the power of this is realized when you can take the community_id from osq logs and use it to pivot against IDS logs.