You may have heard of a tool called Port Reporter that logs TCP and UDP activity on a Windows 2000, XP or 2003 machine. On XP and 2003 it also captures more data about the user and process that opened the port. (Data that is also available with the -o flag on netstat). You can get the tool here. Well there is now a nice little gui tool called Port Reporter Parser to help you sort through the data.