What is lsof -i | grep -E "(LISTEN|ESTABLISHED)" composed of? I got advice to check if an iTunes app sends data to the cloud using this command line

lsof -i | grep -E "(LISTEN|ESTABLISHED)"


Can someone please explain how this works? How does the pipeline work here?
First lsof is executed:

lsof - list open files


with the option -i:


  -i [i]   selects  the  listing  of  files any of whose Internet address
                  matches the address specified in i.  If no address  is  speci-
                  fied, this option selects the listing of all Internet and x.25
                  (HP-UX) network files.


So you get a list similar to this:

Safari      252 pfitz   33u  IPv4 0x1052718d4b4f54ef      0t0  TCP localhost:49289-&gt;localhost:6263 (ESTABLISHED)
Safari      252 pfitz   36u  IPv4 0x1052718d4b4f54ef      0t0  TCP localhost:49289-&gt;localhost:6263 (ESTABLISHED)
iTunes      254 pfitz   28u  IPv4 0x1052718d460f9d07      0t0  TCP *:49196 (LISTEN)
iTunes      254 pfitz   30u  IPv4 0x1052718d460fb4ef      0t0  TCP *:daap (LISTEN)
iTunes      254 pfitz   31u  IPv6 0x1052718d37b6b627      0t0  TCP *:daap (LISTEN)


with a lot more entries. To filter the entries one uses grep:


  The grep utility searches any given input files, selecting lines that
  match one or more patterns.  By default, a pattern matches an input
  line if
       the regular expression (RE) in the pattern matches the input line without its trailing newline.  An empty expression matches every line.
  Each
       input line that matches at least one of the patterns is written to the standard output.
  
  grep is used for simple patterns and basic regular expressions (BREs); egrep can handle extended regular expressions (EREs).  See
  re_format(7) for
       more information on regular expressions.  fgrep is quicker than both grep and egrep, but can only handle fixed patterns (i.e. it does
  not interpret
       regular expressions).  Patterns may consist of one or more lines, allowing any of the pattern lines to match a portion of the input.


and the option -E does the following:


  -E, --extended-regexp
  
  Interpret pattern as an extended regular expression (i.e. force grep to behave as 
  egrep).


The regex in this case is "(LISTEN|ESTABLISHED)" which means just print the lines with listen or established.

Conclusion


lsof builds a list with all Internet connections. 
To be useful it needs to be filtered with grep
So it gets filtered with the regular expression which is looking for either LISTEN or ESTABLISHED