A very cool piece that closely follows my line of thinking:
http://www.markshuttleworth.com/archives/28
View Comments
tcpdump
lsof
find
xargs