diff --git a/audit b/audit
index 76e7859..dce58cf 100755
--- a/audit
+++ b/audit
@@ -56,6 +56,18 @@ known_field() { # <name> <field: 2=ports 3=why>
   return 1
 }
 
+# The running known service that uses <proto> <port>, for a socket whose
+# process only root can see
+known_port_owner() {
+  local entry unit
+  for entry in "${KNOWN[@]}"; do
+    unit="${entry%%|*}"
+    [[ ",$(cut -d'|' -f2 <<< "$entry")," == *",$2/$1,"* ]] || continue
+    systemctl is-active --quiet "$unit" 2> /dev/null && { echo "system $unit"; return 0; }
+  done
+  return 1
+}
+
 # Firewall rules that let connections in, as "proto port iface" ("any" for any
 # protocol, port or interface), from ufw's rule files
 load_firewall() {
@@ -151,7 +163,7 @@ load_ports() {
     pid="$(grep -o 'pid=[0-9]*' <<< "$process" | head -n 1 | cut -d= -f2)"
     comm="$(sed -nE 's/^users:\(\("([^"]*)".*/\1/p' <<< "$process")"
     if [ -z "$pid" ]; then
-      owner="none ?"
+      owner="$(known_port_owner "$netid" "$port")" || owner="none ?"
     elif [ "$comm" = systemd ] && unit="$(socket_unit "$port")" && [ -n "$unit" ]; then
       owner="system $unit"
     elif [ "$comm" = docker-proxy ]; then
@@ -234,7 +246,7 @@ is_active() { # <scope> <unit>
 }
 
 # Services that can be stopped or started here, as "scope unit": those with
-# open ports, then known ones that are installed but stopped
+# open ports, then the known ones that are installed
 load_services() {
   local key owner entry unit
   SERVICES_LIST=()
@@ -249,8 +261,9 @@ load_services() {
     [[ "$unit" == *.service || "$unit" == *.socket ]] || continue
     [ -n "$(known_field "$unit" 2)" ] || continue
     [[ " ${SERVICES_LIST[*]} " == *" system $unit "* ]] && continue
+    # Listed even while running without its port open yet, as right after
+    # starting, so it doesn't seem to vanish
     systemctl cat "$unit" &> /dev/null || continue
-    is_active system "$unit" && continue
     # cups.socket and cups.service are one service to the user
     [[ "$unit" == *.socket && " ${SERVICES_LIST[*]} " == *" system ${unit%.socket}.service "* ]] && continue
     [[ "$unit" == *.service && " ${SERVICES_LIST[*]} " == *" system ${unit%.service}.socket "* ]] && continue
@@ -326,9 +339,25 @@ toggle() { # <scope> <unit>
     for unit in "${units[@]}"; do
       sed -i "\|^$scope $unit\$|d" "$OFF_FILE" 2> /dev/null
     done
+    wait_for_ports "$2"
   fi
 }
 
+# A service takes a moment to open its ports once started: wait up to 10
+# seconds for its known ones, so the table shows them
+wait_for_ports() { # <unit>
+  local ports port proto
+  ports="$(known_field "$1" 2)" || return 0
+  for port in ${ports//,/ }; do
+    proto="${port#*/}" port="${port%/*}"
+    echo "Waiting for $1 to open port $port..."
+    for _ in $(seq 40); do
+      [ -n "$(ss -lnH "--$proto" "sport = :$port" 2> /dev/null)" ] && break
+      sleep 0.25
+    done
+  done
+}
+
 confirm() {
   local answer
   read -rp "$1 [y/N] " answer