Analizar información de red (protocolo TCP) | Operating systems, scripting, PowerShell and security

#Relación entre IP, puertos y procesos
Get-NetTCPConnection | %{Write-Host $_.LocalAddress,$_.LocalPort,$_.RemoteAddress,$_.RemotePort,$_.OwningProcess,(Get-Process -id $_.OwningProcess).Name}

#Agrupar IP
((Get-NetTCPConnection | Select-Object RemoteAddress).RemoteAddress | Group-Object).Name

#Agrupar IP y quitar las que no son necesarias
(((Get-NetTCPConnection | Select-Object RemoteAddress).RemoteAddress | Group-Object).Name) | Where-Object {$_ -notcontains "::" -and $_ -notcontains "0.0.0.0"}

#Relación entre IP, puertos y procesos

Get-NetTCPConnection | %{Write-Host $_.LocalAddress,$_.LocalPort,$_.RemoteAddress,$_.RemotePort,$_.OwningProcess,(Get-Process -id $_.OwningProcess).Name}

#Agrupar IP

((Get-NetTCPConnection | Select-Object RemoteAddress).RemoteAddress | Group-Object).Name

#Agrupar IP y quitar las que no son necesarias

(((Get-NetTCPConnection | Select-Object RemoteAddress).RemoteAddress | Group-Object).Name) | Where-Object {$_ -notcontains "::" -and $_ -notcontains "0.0.0.0"}

Publicado el día 6 de abril de 2017

CATEGORÍAS

PowerShell, Red

ETIQUETAS

Connect, Connection, Contains, Get-NetTCPConnection, Get-Process, Group-Object, IP, Jesús Niño Camazón, Mac, notcontains, Protocolo, RemoteAddress, Select-Object, TCP, Where-Object, Write-Host

CATEGORÍAS

ETIQUETAS

MÁS