If they replace your version of netstat with their own modified version they can keep you from seeing any connections that they don't want you to see.
try running a "netstat -an" , that'll list all protocols along with the ports they're listening on.
l8r,
