This is quite a shock to me. I thought Netstat was infallible. With all the different syntax i have always been able to find what I need or suspected.

I thought Netstat simply checked all TCP/UDP Ports and displayed the connection. How does it do this? Does it use ICMP? And beyond that, how can a program hide its connection?