# encoding: ascii
# api: powershell
# title: Get-Netstat 1,1
# description: This will perform a basic netstat.exe command and “objectize” its output.
# version: 0.1
# author: glnsize
# license: CC0
# x-poshcode-id: 560
# x-archived: 2017-05-22T02:27:21
# x-published: 2009-08-29T00:12:00
#
# v0.9 Initial Build – Hal
# V1.0 Added support for UDP, and processname -Glenn
# v1.1 Expanded [regex] statements to encompass IPV4/IPV6/ports. -Glenn
#
$null, $null, $null, $null, $netstat = netstat -a -n -o
[regex]$regexTCP = '(?<Protocol>\S+)\s+((?<LAddress>(2[0-4]\d|25[0-5]|[01]?\d\d?)\.(2[0-4]\d|25[0-5]|[01]?\d\d?)\.(2[0-4]\d|25[0-5]|[01]?\d\d?)\.(2[0-4]\d|25[0-5]|[01]?\d\d?))|(?<LAddress>\[?[0-9a-fA-f]{0,4}(\:([0-9a-fA-f]{0,4})){1,7}\%?\d?\]))\:(?<Lport>\d+)\s+((?<Raddress>(2[0-4]\d|25[0-5]|[01]?\d\d?)\.(2[0-4]\d|25[0-5]|[01]?\d\d?)\.(2[0-4]\d|25[0-5]|[01]?\d\d?)\.(2[0-4]\d|25[0-5]|[01]?\d\d?))|(?<RAddress>\[?[0-9a-fA-f]{0,4}(\:([0-9a-fA-f]{0,4})){1,7}\%?\d?\]))\:(?<RPort>\d+)\s+(?<State>\w+)\s+(?<PID>\d+$)'
[regex]$regexUDP = '(?<Protocol>\S+)\s+((?<LAddress>(2[0-4]\d|25[0-5]|[01]?\d\d?)\.(2[0-4]\d|25[0-5]|[01]?\d\d?)\.(2[0-4]\d|25[0-5]|[01]?\d\d?)\.(2[0-4]\d|25[0-5]|[01]?\d\d?))|(?<LAddress>\[?[0-9a-fA-f]{0,4}(\:([0-9a-fA-f]{0,4})){1,7}\%?\d?\]))\:(?<Lport>\d+)\s+(?<RAddress>\*)\:(?<RPort>\*)\s+(?<PID>\d+)'
[psobject]$process = "" | Select-Object Protocol, LocalAddress, Localport, RemoteAddress, Remoteport, State, PID, ProcessName
foreach ($net in $netstat)
{
switch -regex ($net.Trim())
{
$regexTCP
{
$process.Protocol = $matches.Protocol
$process.LocalAddress = $matches.LAddress
$process.Localport = $matches.LPort
$process.RemoteAddress = $matches.RAddress
$process.Remoteport = $matches.RPort
$process.State = $matches.State
$process.PID = $matches.PID
$process.ProcessName = ( Get-Process -Id $matches.PID ).ProcessName
}
$regexUDP
{
$process.Protocol = $matches.Protocol
$process.LocalAddress = $matches.LAddress
$process.Localport = $matches.LPort
$process.RemoteAddress = $matches.RAddress
$process.Remoteport = $matches.RPort
$process.State = $matches.State
$process.PID = $matches.PID
$process.ProcessName = ( Get-Process -Id $matches.PID ).ProcessName
}
}
$process
}