The Scripting Wife and I are heading to northern Kentucky where I will be teaching a Windows PowerShell class to a customer there. Teresa will be out and about visiting friends and going to outlet malls and finding cool places to eat. My good friend (and fellow Microsoftee), Robert from California, is flying in for the class, so we are looking forward to seeing him again. The Scripting Wife and I will be attending the first ever Cincinnati, Ohio Windows PowerShell User Group<\/a> while we are in the area. I will be speaking about using Windows PowerShell 3.0 to manage a remote Windows 8 workstation. It’s a cool presentation if I do say so myself.<\/p>\n This is the third time I have written a script to obtain information about network connections. The first time I wrote it, I used a WMI class from the root\/snmp namespace, and I wrote the script in VBScript. The second time, I used the NetStat command-line utility tool, I wrote it in Windows PowerShell 1.0, and I parsed the output by using regular expressions. In Windows PowerShell 3.0 in Windows 8, I use a simple cmdlet. This is a good thing, because gaining access to the SNMP namespace requires installing SNMP, and that requires evaluation and planning. I like things that are in the box as much as possible.<\/p>\n Using NetStat is easy (as long as you remember that it is netstat and not net statistics, and you remember what the switch –a –n –o accomplishes). The problem with netstat (it is not case sensitive) is that it returns string data instead of objects. Thus, the requirement for a bit of regular expression work. (I am not good enough with regular expressions to type very complicated patterns on the fly in front of a live audience without a lot of prior work—for example, say at Tech Mentor<\/a>.)<\/p>\n As long as I do not need to do any post processing, and as long as I can remember the netstat –ano command (yes, you can gang the switches for netstat), there is no problem with the command. The output is shown here.<\/p>\n The default view of the Get-NetTCPConnection cmdlet is pretty useful, and it displays a decent amount of information about local and remote ports. For me, the display does not scale properly in my default Windows PowerShell size, but that is due to my need to take screenshots. On a larger monitor, using the default sizing for Windows PowerShell, the output is just fine. The image that follows illustrates the default output.<\/p>\n The nice thing about using the Get-NetTCPConnection<\/b> cmdlet is that it returns objects, and it also has a number of useful switches. For example, if I am interested in only established connections, I use the state<\/b> <\/i>parameter, and I tell it to show established connections. The command is shown here.<\/p>\n Get-NetTCPConnection -State established<\/p>\n The command and the associated output are shown in the image that follows.<\/p>\n To view connections to the Internet, use the AppliedSetting<\/b> <\/i>parameter as shown here.<\/p>\n Get-NetTCPConnection -AppliedSetting internet<\/p>\n But keep in mind these are objects, and you can parse the information via Windows PowerShell. For example, I can quickly see the state of the connections on my computer by grouping by state. This command is shown here.<\/p>\n PS C:\\> Get-NetTCPConnection | group state -NoElement<\/p>\n <\/p>\n Count Name<\/p>\n —– —-<\/p>\n 21 Listen<\/p>\n 2 Established<\/p>\n I might be curious and want to see what ports are being utilized. I can easily see this by grouping by LocalPort<\/b> as shown here.<\/p>\n PS C:\\> Get-NetTCPConnection | group localport -NoElement | sort count -Descending<\/p>\n <\/p>\n Count Name<\/p>\n —– —-<\/p>\n 2 49199<\/p>\n 2 49177<\/p>\n 2 49155<\/p>\n 2 49154<\/p>\n 2 49153<\/p>\n 2 49152<\/p>\n 2 2179<\/p>\n 2 135<\/p>\n 1 47001<\/p>\n 1 5985<\/p>\n 1 445<\/p>\n 1 62723<\/p>\n 1 62613<\/p>\n 1 62369<\/p>\n 1 2559<\/p>\n 1 139<\/p>\n After I have done this, I decide to obtain more information. Because these are objects, it is a simple matter of choosing the properties that I want to see. To find which properties are available, I first use the Get-Member<\/b> cmdlet as shown here.<\/p>\n PS C:\\> Get-NetTCPConnection | Get-Member -MemberType property | Format-Table name, definition -AutoSize<\/p>\n <\/p>\n Name Definition<\/p>\n —- ———-<\/p>\n AggregationBehavior uint16 AggregationBehavior {get;set;}<\/p>\n AvailableRequestedStates uint16[] AvailableRequestedStates {get;set;}<\/p>\n Caption string Caption {get;set;}<\/p>\n CommunicationStatus uint16 CommunicationStatus {get;set;}<\/p>\n Description string Description {get;set;}<\/p>\n DetailedStatus uint16 DetailedStatus {get;set;}<\/p>\n Directionality uint16 Directionality {get;set;}<\/p>\n ElementName string ElementName {get;set;}<\/p>\n EnabledDefault uint16 EnabledDefault {get;set;}<\/p>\n EnabledState uint16 EnabledState {get;set;}<\/p>\n HealthState uint16 HealthState {get;set;}<\/p>\n InstallDate CimInstance#DateTime InstallDate {get;set;}<\/p>\n InstanceID string InstanceID {get;set;}<\/p>\n LocalAddress string LocalAddress {get;}<\/p>\n LocalPort uint16 LocalPort {get;}<\/p>\n Name string Name {get;set;}<\/p>\n OperatingStatus uint16 OperatingStatus {get;set;}<\/p>\n OperationalStatus uint16[] OperationalStatus {get;set;}<\/p>\n OtherEnabledState string OtherEnabledState {get;set;}<\/p>\n PrimaryStatus uint16 PrimaryStatus {get;set;}<\/p>\n PSComputerName string PSComputerName {get;}<\/p>\n RemoteAddress string RemoteAddress {get;}<\/p>\n RemotePort uint16 RemotePort {get;}<\/p>\n RequestedState uint16 RequestedState {get;set;}<\/p>\n Status string Status {get;set;}<\/p>\n StatusDescriptions string[] StatusDescriptions {get;set;}<\/p>\n TimeOfLastStateChange CimInstance#DateTime TimeOfLastStateChange {get;set;}<\/p>\n TransitioningToState uint16 TransitioningToState {get;set;}<\/p>\n I decide that I am interested in four specific properties, so I can write the command shown here.<\/p>\n Get-NetTCPConnection | ft state,localport, localaddress, remoteport, remoteaddress -AutoSize<\/p>\n The problem is that this is a lot of typing. I like to use wildcard characters in my Format-Table<\/b> commands when I can get away with doing so. Here is a perfect situation for using wildcards and not destroying the readability of the command. Here is my revised command.<\/p>\n Get-NetTCPConnection | ft state,l*port, l*address, r*port, r*address –Auto<\/p>\n The command and the output are shown in the following image.<\/p>\n There is not an alias predefined for the Get-NetTCPConnection<\/b> cmdlet. I found this by using the Get-Alias<\/b> cmdlet as shown here.<\/p>\n Get-Alias -Definition Get-NetTCPConnection<\/p>\n If the Get-NetTCPConnection<\/b> cmdlet is something that you intend to use a lot, you should create an alias for the cmdlet and store that alias in your profile. If you want to do so, you can even call it netstat. (I do not necessarily recommend this; I am simply showing you that you could do so. If you do something like that, and you want the real netstat, just call netstat.exe). This is shown here.<\/p>\n PS C:\\> New-Alias -Name netstat -Value Get-NetTCPConnection<\/p>\n PS C:\\> netstat -State established<\/p>\n <\/p>\n LocalAddress LocalPort RemoteAddress RemotePort<\/p>\n ———— ——— ————- —<\/p>\n 192.168.0.47 62613 157.56.98.134 44<\/p>\n 192.168.0.47 62369 157.56.98.129 44<\/p>\n Well, that is it for now. Join me tomorrow for more cool Windows PowerShell stuff.<\/p>\n I invite you to follow me on Twitter<\/a> and Facebook<\/a>. If you have any questions, send email to me at scripter@microsoft.com<\/a>, or post your questions on the Official Scripting Guys Forum<\/a>. See you tomorrow. Until then, peace.<\/p>\n Ed Wilson, Microsoft Scripting Guy<\/b> <\/p>\n","protected":false},"excerpt":{"rendered":" Summary: Microsoft Scripting Guy, Ed Wilson, shows how to use Windows PowerShell to identify port connections in Windows 8. Microsoft Scripting Guy, Ed Wilson, is here. There are only twenty-three days until Windows PowerShell Saturday in Charlotte, North Carolina. In fact, as far as I know, we have even had our last organizational meeting. The Scripting […]<\/p>\n","protected":false},"author":596,"featured_media":87096,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[1],"tags":[41,37,364,3,45],"class_list":["post-5094","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-scripting","tag-monitoring","tag-networking","tag-powershell-3-0","tag-scripting-guy","tag-windows-powershell"],"acf":[],"blog_post_summary":" Summary: Microsoft Scripting Guy, Ed Wilson, shows how to use Windows PowerShell to identify port connections in Windows 8. Microsoft Scripting Guy, Ed Wilson, is here. There are only twenty-three days until Windows PowerShell Saturday in Charlotte, North Carolina. In fact, as far as I know, we have even had our last organizational meeting. The Scripting […]<\/p>\n","_links":{"self":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/5094","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/users\/596"}],"replies":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/comments?post=5094"}],"version-history":[{"count":0,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/posts\/5094\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media\/87096"}],"wp:attachment":[{"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/media?parent=5094"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/categories?post=5094"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/devblogs.microsoft.com\/scripting\/wp-json\/wp\/v2\/tags?post=5094"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}Identifying port connections<\/h2>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/3652.HSG-8-22-12-01.png\" "\\"Image")
<\/a><\/p>\nUsing the Get-NetTCPConnection cmdlet<\/h2>\n
![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/2072.HSG-8-22-12-02.png\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/6366.HSG-8-22-12-03.png\" "\\"Image")
<\/a><\/p>\n![\"Image](\"https:\/\/devblogs.microsoft.com\/wp-content\/uploads\/sites\/29\/2019\/02\/8836.HSG-8-22-12-04.png\" "\\"Image")
<\/a><\/p>\n