feat: report what listens, and which Windows service it is
One script: Get-NetTCPConnection -State Listen, Get-NetUDPEndpoint, the processes holding them and Win32_Service's PIDs. A process running one service names it; a shared svchost runs several, and which of them holds the socket Windows does not say, so it names none. http.sys sockets (WinRM, IIS, SMB) belong to the System process. The fixture is synthetic: no Windows host was at hand. tools/harvest.py records the real output. For netOrk#673.
This commit is contained in:
1 parent
1ce42ef099
commit
a6814ad92e
7 files changed
+185
-2
No files matched your search
+31
@@ -0,0 +1,31 @@
|
||||
{
|
||||
"tcp": [
|
||||
{"address": "0.0.0.0", "port": 135, "pid": 912},
|
||||
{"address": "::", "port": 135, "pid": 912},
|
||||
{"address": "0.0.0.0", "port": 445, "pid": 4},
|
||||
{"address": "0.0.0.0", "port": 5985, "pid": 4},
|
||||
{"address": "0.0.0.0", "port": 3389, "pid": 1180},
|
||||
{"address": "0.0.0.0", "port": 1433, "pid": 4321},
|
||||
{"address": "127.0.0.1", "port": 1434, "pid": 4321},
|
||||
{"address": "fe80::1c2a:3b4c:5d6e:7f80%12", "port": 1433, "pid": 4321}
|
||||
],
|
||||
"udp": [
|
||||
{"address": "0.0.0.0", "port": 123, "pid": 1404},
|
||||
{"address": "::", "port": 123, "pid": 1404},
|
||||
{"address": "0.0.0.0", "port": 5353, "pid": 0}
|
||||
],
|
||||
"processes": [
|
||||
{"pid": 4, "name": "System"},
|
||||
{"pid": 912, "name": "svchost"},
|
||||
{"pid": 1180, "name": "svchost"},
|
||||
{"pid": 1404, "name": "svchost"},
|
||||
{"pid": 4321, "name": "sqlservr"}
|
||||
],
|
||||
"services": [
|
||||
{"pid": 912, "name": "RpcEptMapper"},
|
||||
{"pid": 912, "name": "RpcSs"},
|
||||
{"pid": 1180, "name": "TermService"},
|
||||
{"pid": 1404, "name": "W32Time"},
|
||||
{"pid": 4321, "name": "MSSQL$SQLEXPRESS"}
|
||||
]
|
||||
}
|
||||
Reference in new issue
Block a user