extra open ports in rkhunter

[Carl Johnson]

I am running rkhunter and it keeps reporting a port inconsistency
between sockstat and netstat -a.  Netstat shows an extra 5 ports open,
but netstat doesn't show what is holding ports open, so I don't know
what they are.  Does anybody know how to determine what is holding open
a port?  I have been looking around but none of my ideas show anything.
This is a full desktop system with KDE4 and VirtualBox running, so it
has a lot of things running.  The following are the ports if anybody has
any ideas, but I would also like to know how to trace them down myself:
tcp4       0      0 *.876                  *.*                    LISTEN
tcp6       0      0 *.921                  *.*                    LISTEN
udp4       0      0 *.608                  *.*
udp6       0      0 *.952                  *.*
udp6       0      0 *.804                  *.*
-- 
Carl Johnson		carlj at peak.org