possibly dumb q: how do you determine the direction a connection was initiated in from process_open_sockets?