feat: report what listens, and which Windows service it is #1

2026-10-07T05:20:50Z

christianmanivong commented

2026-10-07 05:20:50 +00:00

One script: Get-NetTCPConnection -State Listen, Get-NetUDPEndpoint, the processes that hold the sockets, and Win32_Service's PIDs.

A process that runs exactly one service is attributed to it. A shared svchost runs several, and Windows does not say which of them holds the socket, so it is attributed to none.
http.sys sockets (WinRM, IIS, SMB) belong to the System process.

The fixture is synthetic. There is no Windows host to test against. tools/harvest.py now records this script's output too. For NetOrk/netork#673.

One script: `Get-NetTCPConnection -State Listen`, `Get-NetUDPEndpoint`, the processes that hold the sockets, and `Win32_Service`'s PIDs. - A process that runs exactly one service is attributed to it. A shared svchost runs several, and Windows does not say which of them holds the socket, so it is attributed to none. - http.sys sockets (WinRM, IIS, SMB) belong to the System process. **The fixture is synthetic.** There is no Windows host to test against. `tools/harvest.py` now records this script's output too. For NetOrk/netork#673.

christianmanivong added 1 commit 2026-10-07 05:20:51 +00:00

feat: report what listens, and which Windows service it is a6814ad92e

One script: Get-NetTCPConnection -State Listen, Get-NetUDPEndpoint, the
processes holding them and Win32_Service's PIDs. A process running one
service names it; a shared svchost runs several, and which of them holds
the socket Windows does not say, so it names none. http.sys sockets
(WinRM, IIS, SMB) belong to the System process.

The fixture is synthetic: no Windows host was at hand. tools/harvest.py
records the real output. For netOrk#673.

christianmanivong merged commit 0edc0cc0fd into main

2026-10-07 05:21:33 +00:00

christianmanivong deleted branch feat/listening-sockets

2026-10-07 05:21:33 +00:00

Sign in to join this conversation.

1 Participants

Notifications

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: NAPALM/napalm-windows#1