What is localhost.pharos from Netstat?
pharos and krb524 are both just guesses about network services, based on the service &lt;-> port number listings in /etc/services; in this case I'm fairly sure they're both wrong guesses, so just think of them as identifiers for port numbers 4443 and 4444 respectively. To  find out what's really going on, you need to find out what programs are connecting via those ports. You can do this with the lsof commands, like this:

sudo lsof -i:pharos -i:krb524


(you'll need to enter your admin password for sudo to get root access.) In the output, the important bits are the first two columns, which list the program ("command") names and process IDs of the processes that are using these ports. If the program name doesn't tell you what's going on, you can use ps and/or Activity Monitor to investigate those processes in more detail.

EDIT: If I'm reconstructing the lsof output correctly, it looks like this:

COMMAND   PID          USER  FD   TYPE             DEVICE SIZE/OFF NODE NAME
collabd    237 _teamsserver  7u   IPv6 0x7da9dd76981ec947      0t0  TCP localhost:pharos-&gt;localhost:50603 (ESTABLISHED
ruby       323 _teamsserver  31u  IPv6 0x7da9dd76981eeb47      0t0  TCP localhost:50602-&gt;localhost:krb524 (CLOSE_WAIT)
xcsbuildd 6943 _teamsserver  8u   IPv6 0x7da9dd76981ecd87      0t0  TCP localhost:50603-&gt;localhost:pharos (ESTABLISHED)


Those all look like components of OS X Server -- I'm not very familiar with the details, but collabd is a background process relating to "collaborative services" parts of OS X server, and the _teamserver user ID is used for those services.  From comparing to my server, it looks like the ruby script handles notifications, and xcsbuildd is probably the Xcode build server. Apparently, they all talk to each other over ports 4443 and 4444.