Welcome › Forums › General PowerShell Q&A › Get-NetTCPConnection vs Netstat
- This topic has 3 replies, 2 voices, and was last updated 8 months, 2 weeks ago by
Participant.
-
AuthorPosts
-
-
May 8, 2020 at 2:07 pm #226689
Hey all, I am writing a script that I am planning on doing a blog about shortly. I have run into a potential issue and would like this group’s feedback on. So here’s the deal. As part of this script, I am getting all of the connections to the target server. Using NetStat I see the connections that I expect, i.e. the DB server connection. When I use Get-NetTCPConnection I don’t see this connection. Below is a snippet of code that I am using for the NetTCPConnection piece. Am I overlooking something that is causing this to drop off the report?
PowerShell1234567891011$targetserver = Read-Host "Enter Target Server Name"Get-NetTCPConnection -CimSession (New-CimSession -Name $targetserver) | Select-Object RemoteAddress | Sort-Object RemoteAddress | `Where-Object {($_.RemoteAddress -NotLike "0.0.0.0" -and $_.RemoteAddress -notlike "127.0.0.1" -and $_.RemoteAddress -notlike "::")} '| Get-Unique -AsString | ForEach-Object {$hostname = Resolve-DnsName $_.RemoteAddress -ErrorAction SilentlyContinue[PSCustomObject]@{IPAddress = $_.RemoteAddressHostname = $hostname.NameHost}} | Format-Table -AutoSizeGet-CimSession | Remove-CimSession -
May 8, 2020 at 8:30 pm #226791
The first thing would be to validate you are indeed looking at the remote system and not local with both commands. Do you get the same results if you run it locally on the system in question vs remote connections? Do you see the connection with no filters? Also, simplified code:
PowerShell12345Get-NetTCPConnection -CimSession (New-CimSession -Name $targetserver) |Where-Object {@('0.0.0.0','127.0.0.1', '::') -notcontains $_.RemoteAddress} |Sort-Object -Property {$_.RemoteAddress -as [Version]} -Unique |Select-Object -Property @{Name='IPAddress';Expression={$_.RemoteAddress}},@{Name='HostName';Expression={Resolve-DnsName $_.RemoteAddress}}IP addresses won’t sort right, so you can do a conversion to Version:
-
May 11, 2020 at 1:06 pm #227266
@Rob,
Yes. I am getting the same results locally on the server as I am remotely. Even just running get-nettcpconnection locally on the server, I am not seeing the DB server connection.
SN: I appreciate the reduced code. I am reviewing it now, Thank you.
-
May 11, 2020 at 4:59 pm #227350
There are some projects out there that specifically try to replace netstat:
https://gallery.technet.microsoft.com/Get-NetStat-872e0776
Assuming you are looking for a TCP, not UDP or different protocol it should show up, but you can try the above to see if it matches netstat output. I’ve used Get-NetTCPConnection to find SQL connections, something like:
PowerShell1Get-NetTCPConnection -RemotePort 1433 -State EstablishedIt’s difficult to provide any additional insight unless you post what you are actually seeing in NETSTAT vs Get-NetTcpConnection.
-
-
AuthorPosts
- The topic ‘Get-NetTCPConnection vs Netstat’ is closed to new replies.