Finder conceals network connections from lsof?

Question

If I use the Finder's Go->Connect to Server and connect to an smb/afs, I can see the connection in netstat. But I can't see it in lsof. I also use LittleSnitch, and it fails to detect outbound connections from the Finder.

Why is this? Is there some sort of "Apple rootkit" that i'm not aware of?

Answer 1

It's not the Finder making these connections—network filesystems are mounted within the kernel. lsof doesn't list ports opened by the kernel. There's nothing OS X specific here.