Doesn't something like `lsof -i TCP -s TCP:LISTEN` quickly show what's monopolizing 5000?