how to deduce connect/accept history from struct sock? (REPEAT)

["Joey Dewille" <joey1968@fastmail.co.uk>]

Say a module is inserted that intercepts all socket operations and
it happened in the middle of several established connections.
Please answer what fields in struct sock or elsewhere can be examined
to determine reliably if the current established connections had been
accepted (i.e. accept call) or initiated (i.e. connect) from the local
machine.
--Joey

P.S. By the way, it seems to me that many fundamental structs in the 
linux kernel such as sock, task_struct and others waste memory --
it would be preferable to pack some of their members in
bitfields. Everything and the kitchen sink can be found in those 
structs which is wrong. Booleans are often given an entire char field.
Other members do not fall on natural alignment boundaries and create
holes. Memory is cheap but smaller memory footprint implies better
locality of reference, implies greater cache induced performance overall.

-- 
http://www.fastmail.fm - Consolidate POP email and Hotmail in one place