I'm watching a server right now and find that I really can't make much of a correspondence between what iptstate shows and what a netstat -anp does. The problem is the iptstate shows many, many more connections to port 80 than the netstat. Large numbers are showing as ESTABLISHED on the iptstate. Only a handful show on the netstat. Any idea why?