what does 'sockstat' give you?
[root@transmission_1 /]# sockstat
USER COMMAND PID FD PROTO LOCAL ADDRESS FOREIGN ADDRESS
root python2.7 16637 3 tcp4 192.168.10.4:12347 *:*
root cron 16397 4 dgram -> /var/run/logpriv
root openvpn 16371 4 dgram -> /var/run/logpriv
root openvpn 16371 5 udp4 *:27123 *:*
transmission transmissi16362 7 udp4 *:* *:*
transmission transmissi16362 8 udp4 *:* *:*
transmission transmissi16362 9 tcp4 *:9091 *:*
transmission transmissi16362 10 tcp4 *:51413 *:*
transmission transmissi16362 11 tcp6 *:51413 *:*
transmission transmissi16362 12 udp4 *:51413 *:*
transmission transmissi16362 13 udp4 192.168.10.4:46150 192.168.10.1:5351
transmission transmissi16362 15 dgram-> /var/run/log
transmission transmissi16362 16 tcp4 10.112.1.6:14260 94.23.51.83:34000
transmission transmissi16362 17 tcp4 10.112.1.6:58358 104.28.14.87:80
transmission transmissi16362 18 tcp4 10.112.1.6:31292 104.27.129.124:80
transmission transmissi16362 20 tcp4 192.168.10.4:9091 192.168.10.100:57008
transmission transmissi16362 22 tcp4 192.168.10.4:9091 192.168.10.100:57007
root syslogd 16327 4 dgram /var/run/log
root syslogd 16327 5 dgram /var/run/logpriv
root syslogd 16327 6 udp6 *:514 *:*
root syslogd 16327 7 udp4 *:514 *:*
? ? ? ? tcp4 10.112.1.6:26499 84.105.32.31:23877