A Better NetStat (Part 4)

by Jan 21, 2021

In the previous tip we introduced the Get-NetTCPConnection cmdlet as a better alternative to the netstat.exe network utility on Windows systems, but this command is restricted to Windows only, and it takes a lot of additional code to turn the raw information into useful resolved host and process names.

The most compatible alternative to netstat.exe is a solution based on .NET Core which is available cross-platform wherever PowerShell runs.

Simply get yourself the open-source GetNetStat module (https://github.com/TobiasPSP/GetNetStat) which uses .NET Core code to get the connection information:

 
PS> Install-Module -Name GetNetStat -Scope CurrentUser 
 

When the module is installed, there is a new command called Get-NetStat. Now it’s very simple to list open connections plus you can now resolve host and process names with parallel processing in Windows PowerShell and PowerShell 7.

This simple command lists all open connections to HTTPS (port 443) and resolves host names:

 
PS> Get-NetStat -RemotePort 443 -State Established -Resolve | Select-Object -Property RemoteIp, Pid, PidName 

RemoteIp                          PID PIDName 
--------                          --- ------- 
1drv.ms                          9432 WINWORD 
lb-140-82-113-26-iad.github.com 21588 chrome  
1drv.ms                          9432 WINWORD 
1drv.ms                          9432 WINWORD 
51.103.5.186                     5464 svchost 
51.103.5.186                    12752 OneDrive
52.113.206.137                  13736 Teams   
51.107.59.180                   14484 pwsh   
 


Twitter This Tip! ReTweet this Tip!