in listening_ports, entries with protocol=0 and family=0 are coming up, and it's increasingly hard to pin it down without an fd from process_open_sockets.