Rewrite netstat and arp/net-neighbor collection method

[lhotlan64]

This rewrite changes the way information about active connections and the arp cache is collected from a live system.

Netstat

Originally, netstat -ano was invoked by the Netstat module. Now, information about the active connections (both TCP4/6 and UDP4/6) is obtained using the GetExtendedTcpTable and GetExtendedUdpTable API calls from iphlpapi.dll.

Arp

Originally, either arp -av or Get-NetNeighbor was invoked by the WinArpCache module, depending on the operating system version. Now, information about peers is obtained using GetIpNetTable(2). Additionally, information about the adapters is obtained.

Formatting

No changes were made in the way the information is stored within the resulting package, which remains "command output", as to not introduce any major changes. The output is shown in a similar manner to that of the originally invoked binaries. However, the ability to format the information as both JSON and CSV output is included, and exposed by the following functions:

• format_net_connections_csv
• format_net_connections_json

and

• format_net_neighbors_csv
• format_net_neighbors_json

These formats could later be used for more easy parsing of the information.

Collection using acquire was tested on both 32 and 64 bit.

[twiggler]

Dear @lhotlan64,

Thank you very much for your contribution to Dissect! We will assign someone to review your PR.

[Schamper]

I think something went wrong with the diff on acquire/acquire.py?

[lhotlan64]

Well, this is going terribly :^)