Kansa icon indicating copy to clipboard operation
Kansa copied to clipboard

Feature Request: Use WMI object to collect netstat information

Open mwilco03 opened this issue 4 years ago • 2 comments

Noticing that the get-netstat command uses the netstat.exe binary. Calling that binary not being a bad way and parsing what is on the screen, however if you use the Get-WmiObject win32_process it has most of the information we are trying to get to sans the username. That in conjunction with the Get-NetTcpConnection cmdlet provides the same information. I have made a sample out on my repo.

Some things I may have overlooked, I am not sure when get-net* was implemented so it may not be available in PS v2 It's not currently the prettiest code it was written to be a one line tool for rapid deployment

https://github.com/mwilco03/GPSBL/blob/master/Get-NetStatObject

If this is interesting I'd be happy to help contribute.

mwilco03 avatar Jul 17 '20 15:07 mwilco03

Agree the netstat screen scrapping is awful and doesn't work for non-English versions of Windows. A while back I wrote a version that would do this using PSReflect, but given that triggers lots of AV, I decided not to release it. I'd welcome your contribution, if you want to submit a PR or if you're granting permission, I can copy and paste your code and add a new collector.

davehull avatar Jul 17 '20 16:07 davehull

100% have permission to use, just in case I messed up the PR. Very happy to contribute to a great framework.

mwilco03 avatar Jul 18 '20 14:07 mwilco03