@David Fetter your best bet would be the _socket_events_ table. An alternative might be _process_open_sockets_ but exclude things from _listening_ports_. a pseudo query would be something like this: _select <things> from process_open_sockets where (local_port, protocol) not in (select port, protocol from listening_ports) ;_