I was thinking more of "netstat -pac". Netstat needs to be running when the connection is made. Halt the capture "ctl-c" right afterwards and scan up through the output or pipe it to a file.