Socket and Process Accounting

Hello, Anyone know of a good way to account for tcp or udp sockets and their
corresponding process id/process image name?

For example, when I open internet explorer and browse to 1.2.3.4:80, have an
event written among the lines such as "c:\progra~1\intern~1\iexplore.exe was
used to connect to 1.2.3.4:80"

I am having some strange network activity, and often the whole socket is
shut down before i can find its appropriate process id with netstat -oa!