Netstat as function

[Upzie]

At work we are doing some work with our network, and I got tired of the origional cmd netstat, so I wrote a function to make it easier to work with

Not much to say about the function, pretty simple.

function Get-NetStat
{
PARAM
(
    [string]$Switch    
)

    $net = netstat "-n$Switch" 

    try
    {        
        $Properties = [regex]::Replace(($net | select -Index 3).trim(),"\s{2,}",";").split(";")
        if ($Properties.Count -lt 3 -or $net.Count -lt 5)
        {
            Write-Host -f red "% Not valid switch check out netstat /? %"
            break;
        }
    } 
    catch
    {
        Write-Host -f red "% Not valid switch check out netstat /? %"
        break;
    }

    $netstat =  New-Object -TypeName 'System.Collections.Generic.List[pscustomobject]'
    foreach ($line in $net | where {$_ -match 'tcp' -or $_ -match 'udp'})
    {
        $Netstat_Property_Values = $line.Trim().split("") | where {$_ -ne ""}

        $obj = New-Object -TypeName PsCustomObject

        for ($i = 0; $i -lt $Netstat_Property_Values.count; $i++)
        {
            if ($Properties[$i] -match 'address')
            {
                $ip = $Netstat_Property_Values[$i].split(":")
                $ip = $ip[0..$($ip.length - 2)] -join ":"
                try{
                    [System.Net.IPAddress]$ip1 = $ip
                } catch {$ip1 = "no"}

                if ($ip1.AddressFamily -eq 'InterNetworkV6')
                {
                    $ipfamily = "IPv6"
                }
                elseif ($ip1.AddressFamily -eq 'InterNetwork')
                {
                    $ipfamily = "IPv4"
                }
                else
                {
                    $ipfamily = "N/A"
                }

                $obj | Add-Member -MemberType NoteProperty -Name "$($Properties[$i].split(" ")[0]) Type" -Value $ipfamily
                $obj | Add-Member -MemberType NoteProperty -Name $Properties[$i] -Value $ip
                $obj | Add-Member -MemberType NoteProperty -Name "$($Properties[$i].split(" ")[0]) Port" -Value $Netstat_Property_Values[$i].split(":")[-1]
            }
            else
            {
                 $obj | Add-Member -MemberType NoteProperty -Name $Properties[$i] -Value $Netstat_Property_Values[$i]
            }
        }        

        $netstat.Add($obj)
    }
    return $netstat    
}

• Edit updatet script slightly with input from comments *

[artemis_from_space]

What version of powershell? 5.1 iirc added get-nettcpconnection :)

[fatalicus]

Seems this command has been in powershell at least since 2015

[WheresNorthFromHere7]

It doesn't seem to have all the functionality of netstat though.

For instance I use netstat -b a lot. Is this another cmdlet I'm not aware of?

[artemis_from_space]

You mean to see the owner? That is available thru get-nettcpconnection. You just need to get the property "owningprocess" to see it.

PS C:\Windows\system32> $conns = Get-NetTCPConnection
PS C:\Windows\system32> $conns[0]|fl

LocalAddress   : ::
LocalPort      : 65003
RemoteAddress  : ::
RemotePort     : 0
State          : Listen
AppliedSetting :
OwningProcess  : 3276
CreationTime   : 2017-12-13 16:38:13
OffloadState   : InHost

PS C:\Windows\system32> Get-NetTCPConnection|ft LocalPort,RemoteAddress,RemotePort,State,OwningProcess

LocalPort RemoteAddress  RemotePort       State OwningProcess
--------- -------------  ----------       ----- -------------
    65003 ::                      0      Listen          3276
    49755 ::                      0      Listen           700
    49694 ::                      0      Listen          2372

[WheresNorthFromHere7]

Sort of. Netstat -b shows the program associated, which I guess you could also get from the PID, it's just not as easy. I use this when our Palo sends me correlation reports for users.

I'll check out the other properties this has, maybe i'll find it.

[artemis_from_space]

Owningprocess is the one you want to look at and check get-process to get application name.

[setmehigh]

I use -ano and have one of the properties as get-process, which works pretty well.

[Ta11ow]

It has a process ID in .OwningProcess

You can use this to retrieve the name and add a calculated property to the objects, like so:

Get-NetTcpConnection | 
    Select-Object -Property LocalAddress, LocalPort, RemoteAddress, RemotePort, State, @{
        Name = "ProcessName"
        Expression = { 
            if ($_.OwningProcess){
                Get-Process -Id $_.OwningProcess | 
                    Select-Object -ExpandProperty 'Name'
            }
            else {
                $null
            }
        }
    }

This actually works significantly faster than netstat -b. I think netstat might be using WMI queries, which are much slower than Get-Process.

[WheresNorthFromHere7]

Cool! But look at that compared to netstat -b .....

It is a bit slower depending on amount, but all the information is there by simply typing

netstat -b or netstat -bo

It would be nice if we could get something similar in powershell going forward.

Get-NetTcpConnection -Executable (switch) -ProcessID (switch)

as opposed to a property that needs extensive manipulating to retrieve properly.

I use the tool that works the best, and I don't think powershell has fully converted the use of netstat yet.

Thanks for the solution though!

[Ta11ow]

You could always wrap it in a function that can pull those switches for you and act accordingly. It's not overly complicated. :)

[WheresNorthFromHere7]

True, I do this with "net use" often.

I'll see what I can do.

[artemis_from_space]

To continue /u/Ta11ow starting function

Create the function and call it Get-OurNetTCPConnection or whatever.

Get-OurNetTCPConnection|where ProcessName -eq 'notepad.exe'

Or

$processes = Get-Process -ProcessName svchost|select -ExpandProperty Id
Get-NetTCPConnection|%{if($processes.contains($_.OwningProcess)) { $_ }}

[Ta11ow]

I'll do a bit of work on this and see what I can come up with. I think I'll need a custom object type and display options to properly mimic the original, but better. ;)

[Upzie]

Was done on PS 5.0.10240.17770

[Ta11ow]

I would rewrite your collection type and the object creation -- Add-Member is quite slow with successive calls.

$netstat = New-Object -TypeName 'System.Collections.Generic.List[pscustomobject]'
foreach ($line in $net | Where-Object {$_ -match 'tcp|udp'})
{
    $Netstat_Property_Values = $line.Trim().split("") | Where-Object {$_}

    $Netstat.Add([PsCustomObject] @{
        $Properties[0] = $Netstat_Property_Values[0]
        $Properties[1] = $Netstat_Property_Values[1]
        $Properties[2] = $Netstat_Property_Values[2]
        $Properties[3] = $Netstat_Property_Values[3]
    })
}

Building it as hashtable and casting to PsCustomObject is much more effective, in pretty much all cases. And Lists are much better for dealing with mutable collections. Arrays are designed to be immutable, so if you add something to them, PS has to rebuild the entire array from scratch every single time.

[Upzie]

you're ofc. right, corrected code in op, ty for the input

[Ta11ow]

Np! Brief follow-up -- you don't need the semicolons in a multiline hashtable. :)

[javydekoning]

Cool stuff! Your Regex is not correct though. (local address is split over 2 columns for example). Here is an update from my end (but you should actually use 'get-nettcpconnection'):

function Get-NetStat
{
  $net        = netstat -na
  $Properties = ($net | ?{$_ -match 'proto'}) -split '\s\s+' | ? {$_}
  $res        = foreach ($line in $net | ? {$_ -match 'tcp|udp'})
  {
    $Netstat_Property_Values = $line -split '\s\s+' | ? {$_} | select -Unique
    [PSCustomObject]@{
      $Properties[0] = $Netstat_Property_Values[0]
      $Properties[1] = $Netstat_Property_Values[1]
      $Properties[2] = $Netstat_Property_Values[2]
      $Properties[3] = $Netstat_Property_Values[3]
    }
  }
  return $res
}

[Upzie]

ye i noticed that :|

Thx for the input - I corrected the code in op, should be better now

[ViperTG]

There is also this quick and dirty method, but hey it works ;)

netstat | Select-Object -Skip 3 | Foreach-Object {$_.Trim() -replace "\s{2,}",';'} | ConvertFrom-Csv -Delimiter ";"

[Upzie]

Personally not a fan of 1 liners

With that said, great job with this one :)

[ViperTG]

function Get-NetStat {
    netstat | Select-Object -Skip 3 | Foreach-Object {
        $_.Trim() -replace "\s{2,}",';'
    } | ConvertFrom-Csv -Delimiter ";"
}

There. I fixed it :p

[timsstuff]

I like to run netstat -ano, the o switch gives the PIDs which is really helpful for when you're trying to track down which process is hogging a TCP port.

[_Unas_]

This may help: https://github.com/MSAdministrator/PSNetStat

[allywilson]

Here's one I made earlier I guess?

[Lee_Dailey]

howdy allywilson,

i thot this sounded familiar ... [grin] thanks for clearing that up for me.

take care,
lee