Why are all of the TCP sockets for my HTTP application owned by PID 4?

The "-o" option of netstat tells you the process ID associated with each of the network connections. If you look at the process owner for an HTTP client application, then you should see the PID of your client application. If you look at the process owner for an HTTP server application on Windows Vista, then you'll see PID 4.

PID 4 is the process identifier of the System process. When Windows 2003 came out, it introduced the http.sys driver that handles HTTP communication as a kernel-mode service. In this case, WCF is using http.sys to do the listening, so http.sys is the process owner that shows up for the connection. This is why everything appears to be coming from the System process.

Next time: A Bit More on Call Context Initializers