How to find running processes and their port number

The netstat command line utility displays protocol statistics and current TCP/IP network connections. If we want to display the associated process identifier (PID) of each process we add the -o parameter.

To filter the result we need to pipe to the Find utility and again, the result is text!. In PowerShell we can get the same information with the following command, however the process PID is missing and the connections in LISTENING state are not included by default.

PS > [System.Net.NetworkInformation.IPGlobalProperties]::GetIPGlobalProperties().GetActiveTcpConnections()

With the Get-NetworkStatistics function we can get the same information but each returned connection is an object. Get-NetworkStatistics parses only TCP/UDP connections (entries that starts with '[::' are ignored). Each connection is divided into two columns. For example, if the 'Local Address' column has a value of '0.0.0.0:80' the IP address will be shown in the LocalAddress property (e.g 0.0.0.0)  and the port number in the LocalPort property (e.g 80). The name of each process is also added to the result. This should make filtering much more easier when we pipe the result to the Where-Object cmdlet, allowing us to filter on any property of a connection.

UPDATE1: Added support for IPv6 connections. @xcud and surveyor, thanks for the input!
UPDATE2: Per @xcud request (see comment below) I published an extended version of the function HERE.

function Get-NetworkStatistics
{
    $properties = 'Protocol','LocalAddress','LocalPort'
    $properties += 'RemoteAddress','RemotePort','State','ProcessName','PID'

    netstat -ano | Select-String -Pattern '\s+(TCP|UDP)' | ForEach-Object {

        $item = $_.line.split(" ",[System.StringSplitOptions]::RemoveEmptyEntries)

        if($item[1] -notmatch '^\[::')
        {           
            if (($la = $item[1] -as [ipaddress]).AddressFamily -eq 'InterNetworkV6')
            {
               $localAddress = $la.IPAddressToString
               $localPort = $item[1].split('\]:')[-1]
            }
            else
            {
                $localAddress = $item[1].split(':')[0]
                $localPort = $item[1].split(':')[-1]
            } 

            if (($ra = $item[2] -as [ipaddress]).AddressFamily -eq 'InterNetworkV6')
            {
               $remoteAddress = $ra.IPAddressToString
               $remotePort = $item[2].split('\]:')[-1]
            }
            else
            {
               $remoteAddress = $item[2].split(':')[0]
               $remotePort = $item[2].split(':')[-1]
            } 

            New-Object PSObject -Property @{
                PID = $item[-1]
                ProcessName = (Get-Process -Id $item[-1] -ErrorAction SilentlyContinue).Name
                Protocol = $item[0]
                LocalAddress = $localAddress
                LocalPort = $localPort
                RemoteAddress =$remoteAddress
                RemotePort = $remotePort
                State = if($item[0] -eq 'tcp') {$item[3]} else {$null}
            } | Select-Object -Property $properties
        }
    }
}

To get all processes running on a local port 80:

Or find a connection information by filtering on ProcessName:

Guest blog - Eliminate the risk by knowing your disk

I'm very pleased to have on my blog a friend, colleague and a PowerShell convert, Dolav Hadas. This will be his second guest blog, the first one was in Hebrew. Dolav, the stage is yours.

For those who prefer the blue screen (not the BSOD ) Get-FreeSpace is a function which delivers logical disk information from local and remote computers. Before querying a remote machine the function sends a ping request to the target machine. The function will continue querying disk information, only for those machines that answered its ping request. The Unreachable Destinations are saved in memory, and can be shown on screen by using the ListUnreachable Switch parameter.

A list of remote computers can be added to the command line by writing the machine names or by reading it from a text file:

Get-FreeSpace –ComputerName Server1,Server2,Server3,Server4 …

OR

“Server1”,”Server2”,”Server3”,”Server4” | Get-FreeSpace

OR

Get-Content .\ServersList.txt | Get-FreeSpace

The result is the same:

The attached script also contains a filter, written by Shay Levy, that can be used to mark low disk space rows:

Get-FreeSpace -ComputerName Server1,Server2,server3,server4 | Out-Color -FilterScript {$_.FreeSpacePercent -lt 10} | Format-Table 

For detailed help just type:

Get-Help Get-FreeSpace –Full

For just the examples type:

Get-Help Get-FreeSpace -Examples

Get-DiskInfo, The GUI version (written with Sapien's Primal Forms 2009 Editor). The GUI version has more features and in my opinion, much easier to use:

1. The first step is to write down a list of computers in the left pane

2. Then click the button to get disk data. The results are listed in the following table

a. Use to mark low disk space rows

3. For your convenient, you can change or sort columns.

4. The Computer List is saved and you can reload it by clicking the button.

5. You can export the disk data to a CSV file, by pressing the button.

6. Press to open the .chm help file.

You can download the setup file for the GUI version and the script file for the console version HERE.