Como verificar qual processo está inundando conexões TCP SYN no Linux?

Question

Meu servidor está executando o Fedora Core 13. Um dia descobri que havia muito tráfego anormal que tentava iniciar conexões TCP com hosts externos. Eu tentei remover a rota padrão e as configurações do servidor DNS, no entanto, o tráfego mudou para de localhost para localhost. Abaixo estão alguns dados que eu coletei:

[root@svr /]# tshark -pni lo | grep '22 \[SYN' | head 
Running as user "root" and group "root". This could be dangerous.
Capturing on lo
  0.000226    127.0.0.1 -> 127.0.0.1    TCP 38805 > 22 [SYN] Seq=0 Win=32792 Len=0 MSS=16396 TSV=141307237 TSER=0 WS=6
  0.004381    127.0.0.1 -> 127.0.0.1    TCP 38806 > 22 [SYN] Seq=0 Win=32792 Len=0 MSS=16396 TSV=141307241 TSER=0 WS=6
  0.009740    127.0.0.1 -> 127.0.0.1    TCP 38811 > 22 [SYN] Seq=0 Win=32792 Len=0 MSS=16396 TSV=141307246 TSER=0 WS=6
  0.014950    127.0.0.1 -> 127.0.0.1    TCP 38812 > 22 [SYN] Seq=0 Win=32792 Len=0 MSS=16396 TSV=141307252 TSER=0 WS=6
  0.018930    127.0.0.1 -> 127.0.0.1    TCP 38817 > 22 [SYN] Seq=0 Win=32792 Len=0 MSS=16396 TSV=141307256 TSER=0 WS=6
  0.022737    127.0.0.1 -> 127.0.0.1    TCP 38818 > 22 [SYN] Seq=0 Win=32792 Len=0 MSS=16396 TSV=141307259 TSER=0 WS=6
  0.026949    127.0.0.1 -> 127.0.0.1    TCP 38823 > 22 [SYN] Seq=0 Win=32792 Len=0 MSS=16396 TSV=141307264 TSER=0 WS=6
  0.030749    127.0.0.1 -> 127.0.0.1    TCP 38824 > 22 [SYN] Seq=0 Win=32792 Len=0 MSS=16396 TSV=141307267 TSER=0 WS=6
  0.034732    127.0.0.1 -> 127.0.0.1    TCP 38829 > 22 [SYN] Seq=0 Win=32792 Len=0 MSS=16396 TSV=141307271 TSER=0 WS=6
  0.038591    127.0.0.1 -> 127.0.0.1    TCP 38830 > 22 [SYN] Seq=0 Win=32792 Len=0 MSS=16396 TSV=141307275 TSER=0 WS=6
[root@svr /]#
[root@svr /]# lsof -n -i :22
COMMAND  PID USER   FD   TYPE     DEVICE SIZE/OFF NODE NAME
sshd    1821 root    3u  IPv4      11689      0t0  TCP *:ssh (LISTEN)
sshd    1821 root    4u  IPv6      11693      0t0  TCP *:ssh (LISTEN)
ssh     2401 root    4u  IPv4 1010098785      0t0  TCP 172.17.2.128:56650->172.17.5.1:ssh (ESTABLISHED)
sshd    7126 root    3u  IPv4  998744449      0t0  TCP 10.10.91.220:ssh->10.10.91.250:46490 (ESTABLISHED)
[root@svr /]#
[root@svr /]# netstat -anpt | grep :22
tcp        0      0 0.0.0.0:22                  0.0.0.0:*                   LISTEN      1821/sshd           
tcp        0      0 127.0.0.1:48011             127.0.0.1:22                ESTABLISHED -                   
tcp      300      0 127.0.0.1:22                127.0.0.1:48011             ESTABLISHED -                   
tcp        0      0 10.10.91.220:22             10.10.91.250:46490          ESTABLISHED 7126/3              
tcp        0      0 172.17.2.128:56650          172.17.5.1:22               ESTABLISHED 2401/ssh            
tcp        0      0 :::22                       :::*                        LISTEN      1821/sshd      

Então, minhas perguntas são como posso descobrir qual processo está inundando conexões TCP?

TIA!