definitly check into fport. netstat is a fine tool buts its often replaced during an attack with one that keeps the attacker hidden.