Аналог команды netstat windows

Многие администраторы для отображения информации о сетевых подключениях TCP/IP, открытых TCP портах в Windows привыкли использовать консольную утилиту netstat или графическую TCPView. В PowerShell для замены утилиты netstat можно использовать командлет Get-NetTCPConnection, который можно довольно гибко использовать для получения информации об активных сетевых соединениях в Windows, открытых сетевых портах и запушенных процессах, которые используют TCP протокол. Благодаря тому, что PowerShell это объектно-ориентированный язык, вы можете довольно удобно делать сложные скрипты для получения информации и мониторинга открытых портов, процессах и установленных сетевым соединениях.

Попробуйте запустить командлет Get-NetTCPConnection без параметров.

Картинка с сайта: winitpro.ru

Команда по аналогии с netstat вывела список всех активных подключений с указанием локального и удаленного адреса, порта, состояния подключения (Listen, Established Internet, TimeWait, Bound, CloseWait, SynReceived, SynSent, TimeWait) и идентификатор процесса (PID), которые использует это TCP подключение.

Можно вывести список локальных портов, которые слушаются (открыты) на вашем компьютере:

Get-NetTCPConnection -State Listen | Select-Object -Property LocalAddress, LocalPort, RemoteAddress, RemotePort, State | Sort-Object LocalPort |ft

Картинка с сайта: winitpro.ru

Для получения информации об использовании протокола UDP, открытых портов используется командлет
Get-NetUDPEndpoint
.

Можно вывести только внешние (Интернет) подключения:

Get-NetTCPConnection -AppliedSetting Internet

Для всех сетевых TCP подключений можно вывести DNS имена удаленных хостов и имена процессов.

Get-NetTCPConnection -State Established |Select-Object -Property LocalAddress, LocalPort,@{name='RemoteHostName';expression={(Resolve-DnsName $_.RemoteAddress).NameHost}},RemoteAddress, RemotePort, State,@{name='ProcessName';expression={(Get-Process -Id $_.OwningProcess). Path}},OffloadState,CreationTime |ft

Данный PowerShell скрипт выполнил разрешение всех IP адресов хостов в DNS имена, и для каждого соединения указал имя процесса, который его использует.

Картинка с сайта: winitpro.ru

По имени PID родительского процесса можно вывести список связанных имен служб Windows, которые используют сеть:

Get-WmiObject Win32_Service | Where-Object -Property ProcessId -In (Get-NetTCPConnection).OwningProcess | Where-Object -Property State -eq Running | Format-Table ProcessId, Name, Caption, StartMode, State, Status, PathName

Можно вывести только сетевые подключения, которые инициированы определенным процессом. Для этого можно использовать такой PowerShell скрипт:

$TrackProcessName = “*firefox*”
$EstablishedConnections = Get-NetTCPConnection -State Established |Select-Object -Property LocalAddress, LocalPort,@{name='RemoteHostName';expression={(Resolve-DnsName $_.RemoteAddress).NameHost}},RemoteAddress, RemotePort, State,@{name='ProcessName';expression={(Get-Process -Id $_.OwningProcess). Path}}, OffloadState,CreationTime
Foreach ($Connection in $EstablishedConnections)
{
If ($Connection.ProcessName -like $TrackProcessName)
{
$Connection|ft
}
}

Ареал применения командлета Get-NetTCPConnection очень широкий. Например, вы можете создать простой PowerSHell скрипт, который должен отслеживать установку соединения с определенного IP адреса на указанный локальный порт и выводить всплывающее уведомление администратору.

В следующем примере PowerShell скрипт проверяет, когда появится соединение с указанного IP адреса по порту RDP порту 3389. Если такое подключение появится в списке, он выведет всплывающее уведомление и логирует дату и время подключения в текстовый файл:

$TrackingIP = “192.168.10.50”
$TrackingPort =”3389”
$log = "C:\ps\rdp_connection_log.txt"
$EstablishedConnections = Get-NetTCPConnection -State Established
Foreach ($Connection in $EstablishedConnections)
{


If (($Connection.RemoteAddress -eq $TrackingIP) -and ($Connection.LocalPort -eq $TrackingPort))
{
Add-Type -AssemblyName System.Windows.Forms
$global:balmsg = New-Object System.Windows.Forms.NotifyIcon
$path = (Get-Process -id $pid).Path
$balmsg.Icon = [System.Drawing.Icon]::ExtractAssociatedIcon($path)
$balmsg.BalloonTipIcon = [System.Windows.Forms.ToolTipIcon]::Warning
$balmsg.BalloonTipText = "К вашему компьютеру подключились по RDP c $($Connection.RemoteAddress)"
$balmsg.BalloonTipTitle = "Новое RDP подключение с $($Connection.RemoteAddress)"
$balmsg.Visible = $true
$balmsg.ShowBalloonTip(10000)
(Get-Date).ToString() + ' ' + $Connection.RemoteAddress + ' установлено RDP подключение ' >> $log
}
}

Картинка с сайта: winitpro.ru

Аналогичным образом можно отслеживать и логировать сетевые подключения по любому другому протоколу, например SSH, SMB, FTP, SMTP и т.д. Такой PowerShell скрипт можно оформить в виде службы Windows, которая будет запускаться автоматически.

С помощью PowerShell remoting командлетов (Enter-PSSession и Invoke-Command) вы можете получить список открытых TCP портов и подключений на удаленных компьютерах.

Invoke-Command -ComputerName host1 {Get-NetTCPConnection -State Established}

Командлет Get-NetTCPConnection (также как и Test-NetConnection) может быть крайне полезен для мониторинга и диагностики сетевых подключений в Windows.

The netstat (network statistics) is a really useful command-line tool for system admins when it comes to diagnosing network issues in a system. It shows the protocol-specific networking statistics for each network connection on your computer. People who have been using it for quite some time would surely understand its importance; no matter whether you work in Windows or Linux environment.

In this article, we will discuss the alternative of Netstat in Windows PowerShell. The NetTCPIP module of PowerShell includes Get-NetTCPConnection cmdlet that we can use to get the network statistics like netstat.

Картинка с сайта: www.techtutsonline.com

Now lets take a look how to use this command.

Get-NetTCPConnection

If you run Get-NetTCPConnection cmdlet without any parameter, it gives you the following information by default:

• LocalAddress
• LocalPort:
• RemoteAddress
• RemotePort
• State
• AppliedSettings
• OweningProcess

Картинка с сайта: www.techtutsonline.com

The output of this cmdlet is not exactly the same as that of netstat command but since PowerShell returns objects, we get a lot more control on its output. The above mentioned table headers are not just a text strings; these are the properties that you can use to filter and modify the output of cmdlet.

Filtering the results

By default, the Get-TCPConnection cmdlet returns the stats for all the connections and IP addresses. If you have multiple network interfaces and multiple IP addresses configured in a computer, it will give you too much information which could be overwhelming. To view the stats for a particular network connection in your computer, you could specify the IP address using -LocalAddress parameter as shown below:

Get-NetTCPConnection -LocalAddress 192.168.0.254

Картинка с сайта: www.techtutsonline.com

You can filter the results using the properties returned by Get-NetTCPConnection cmdlet. For instance, if you want to only view the connections that are in “Listen” state, you could modify the command as shown below:

Get-NetTCPConnection -State Listen

This command will filter the output and only show the connections that are in Listen state. Have a look at the following image:

Картинка с сайта: www.techtutsonline.com

You could use this idea to list the TCP ports on your local or remote computers. To do that, you can use the following command:

Get-NetTCPConnection -State Listen | Select Local*, State | sort LocalPort

Картинка с сайта: www.techtutsonline.com

This command shows all the TCP ports listening on your computer sorted based on local TCP port number. If you’re interested in getting the count of connections that are in ‘Listen’ state, you can use the Measure-Object cmdlet (or measure alias) as shown below:

Get-NetTCPConnection -State Listen | Measure-Object

Картинка с сайта: www.techtutsonline.com

Similarly, you could combine multiple properties to further narrow down the output and find out the connections that you are interested in particular.

The Out-GridView cmdlet

Instead of using parameters to filter the output of Get-NetTCPConnection cmdlet, you could combine it with Out-GridView cmdlet as shown in the following command:

Get-NetTCPConnection | Out-GridView

Картинка с сайта: www.techtutsonline.com

Here, we are getting all the connections with Get-NetTCPConnection cmdlet and passing them to Out-GridView to build a dynamic table. The best thing about this table is that you can add or remove filter criteria by clicking on Add Criteria button and the output will be dynamically filtered in real time as shown in the screenshot.

Check TCP ports on remote server

Suppose you’ve a remote web server and you want to find out it is listening on port 80, you won’t even have to login on webserver and launch a command prompt to interactively run netstat or Get-NetTCPConnection command. You could use the PowerShell remoting to run the command from your local computer itself.

Invoke-Command -ComputerName webserver -ScriptBlock {Get-NetTCPConnection -LocalPort 80 | Format-Table -Auto}

Картинка с сайта: www.techtutsonline.com

Taking it a little bit further, to check if someone is connected to webserver via remote desktop protocol (RDP), you can run the following command:

Invoke-Command -ComputerName webserver -ScriptBlock {Get-NetTCPConnection -LocalPort 3389 -State 'Established'}

Картинка с сайта: www.techtutsonline.com

This command shows that someone with IP address 192.168.0.254 is accessing the webserever via RDP.

Determine the name of owning process

Did you notice the OwningProcess column in the output? This property shows the process identifier (PID) of the process responsible for that particular connection. Now you might be thinking it will be a great idea if you could see the process name and executable path in two separate columns. Well, it is possible indeed with PowerShell. See the following command for reference:

Get-NetTCPConnection | select Local*, Remote*, State,`
@{n="ProcessName";e={(Get-Process -Id $_.OwningProcess).ProcessName}},`
@{n="ProcessPath";e={(Get-Process -Id $_.OwningProcess).Path}} | ft -Auto

Картинка с сайта: www.techtutsonline.com

Take a look at the ProcessName and ProcessPath columns that you just created. The new columns are showing the process name and executable path which is way more useful for admins than just the PID. The above command shows that you don’t have to stick with the default properties of Get-NetTCPConnection cmdlet. PowerShell allows you to build the custom properties (known as calculated properties) on the fly by using other cmdlets.

By the way, you could see the list of all the default properties and methods supported by Get-NetTCPConnection cmdlet using the following command:

Get-NetTCPConnection | Get-Member

Картинка с сайта: www.techtutsonline.com

This command shows that there are numerous properties and methods you could use to filter and format the output of cmdlet.

This is just the beginning. Once you start using Get-NetTCPConnection cmdlet, you will discover whole lot of new things that you couldn’t even do with netstat tool. The best thing is that you could even use the netstat (and other cmdline tools) directly in PowerShell so whenever you feel there is something you cannot find in Get-NetTCPConnection cmdlet, feel free to use your old buddy netstat in PowerShell command or script.