NetstatModule retrieves active connections.
Details
It enumerates TCP, UDP, TCP6 and UDP6 sockets to discover listening endpoints, running applications (with PID and command line), and network flows between them. It must be run as root on Linux to retrieve PID/process information; without these data it is hard to build reliable links between open ports and programs.
This module is then able to create flows between applications according to the tuple (src, srcport, dst, dstport).
On Windows, the privileges are not checked. So the module is always run.