Use PowerShell to Determine What Your System is Talking to

Recently, while troubleshooting a problem with a newly installed application, I wanted to see what it was communicating with. My only requirement was that I wanted to use PowerShell if at all possible. I couldn't remember if there was a PowerShell command for accomplishing this task or not, but I remembered seeing something about it in Patrick Gruenauer's chapter (PowerShell as an Enterprise Network Tool) in The PowerShell Conference Book.

Note: This blog article is written using Windows 10 version 1803 and Windows PowerShell version 5.1. Your mileage may vary with different operating systems and/or different versions of PowerShell.

A quick look at his chapter and I found what I was looking for. The Get-NetTCPConnection function. The code in Patrick's chapter that I remembered seeing is similar to the following.

1Get-NetTCPConnection |
2Select-Object -Property LocalPort, State, OwningProcess

tcpconnection1a.png

I decided to take it a step further from what I read in Patrick's chapter and grab the actual name of the owning process along with a few other properties.

1Get-NetTCPConnection -State Established |
2Select-Object -Property LocalAddress, LocalPort, RemoteAddress, RemotePort, State,
3                        @{name='Process';expression={(Get-Process -Id $_.OwningProcess).Name}}, CreationTime |
4Format-Table -AutoSize

tcpconnection2a.png

That was too easy. I can see what my test VM that's used in this scenario is communicating with along with the names of the processes and the creation times. You could write a powerful tool using this command as the basis to scan remote servers to make sure they aren't communicating with anything out of the ordinary.

Reading seems to be a dying art in our society, but it's well worth your time to read. To be completely honest, you'll never master PowerShell without reading. After all, it's a text based scripting language with no graphics or pictures to point and click and all of the help for it is text-based which means you have to read. While something you've read may not solve the exact problem you're experiencing, it can spark ideas to create those light-bulb moments. Never underestimate the power of reading. Now, go forth and read!

µ