JSI Tip 9180. What processes are using what connections on my Windows Server 2003 or Windows XP computer?

Using only built-in commands and utilities, I have scripted WhatConnections.bat to display the Protocol, Local Address, Foreign Address, State, PID, Image Name, Session Name, and Session number for each connection on a computer.

The syntax for using WhatConnections.bat is WhatConnections.

The output is displayed on the console in the following CSV (Comma Separated Value) format:

"Proto","Local Address","Foreign Address","State","PID","Image Name","Session Name","Session Number"

You can easily write the output to a file using:

whatconnections>FileName

You can process the output using:

for /f "Tokens=1-8 Delims=," %%a in ('whatconnections') do (
 set proto=%%a
 set lclA=%%b
 set frnA=%%c
 set state=%%d
 set pid=%%e
 set img=%%f
 set sname=%%g
 set snumb=%%h
 call :DoSomeThing
)

WhatConnections.bat contains:

@echo off
setlocal ENABLEDELAYEDEXPANSION
set fnd1=FIND /I /V "Active Connections"
set fnd2=FIND /I /V "Proto  Local Address"
for /f "Tokens=1-5" %%a in ('netstat -aon^|%fnd1%^|%fnd2%') do (
 set state=%%d
 set pid=%%e
 if "!pid!" EQU "" set pid=%%d&set state=NONE 
 for /f "Tokens=1-4 Delims=," %%i in ('TASKLIST  /NH /FO CSV /FI "PID eq !pid!"') do (
  @echo "%%a","%%b","%%c","!state!","!pid!",%%i,%%k,%%l 
 )
)
endlocal

Comments

Plain text