Look at server machine.
First, If you don't know which server tcp port connection is happening, then get diff of "netstat -ap" before and after connection.
So, now I know the server port number, then execute "netstat -ap | grep https" (assume https port-443 is used).
$ netstat -ap | grep https
tcp 0 0 *:https *:* LISTEN 32167/abcd
Here 32167 is Process ID.
$ ps ax | grep 32167
32167 pts/6 S 0:00 abcd
http://www.thegeekstuff.com/2010/03/netstat-command-examples/