Well first, since this seems to be a timed thing... check cron. See what cron is up to. If that isn't much help, you could consider crufting up a quick script or app that uses sockets and binds to the given port numbers... then the program that is trying to connect to (ie open the ports) will crap on itself (Address already in use) and might help you to catch the output.... other than sniffing the packets, to catch the destination address, you're hands are pretty much tied.