Get-NetTCPConnection cmdlet,作为 Windows 系统上网络实用程序netstat.exe的更好替代方法,通过一些技巧,您甚至可以解析 IP 地址和进程 ID。但是,这会大大减慢命令的速度,因为 DNS 查找可能需要一些时间,尤其是当它遇到网络超时时。
$Process = @{
Name='Process'
Expression={
# return process path
(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Path
}
}
$HostName = @{
Name='Host'
Expression={
$remoteHost = $_.RemoteAddress
try {
# try to resolve IP address
[Net.Dns]::GetHostEntry($remoteHost).HostName
} catch {
# if that fails, return IP anyway
$remoteHost
}
}
}
# get all connections to port 443 (HTTPS)
Get-NetTCPConnection -RemotePort 443 -State Established |
# where there is a remote address
Where-Object RemoteAddress |
# and resolve IP and Process ID
Select-Object -Property $HostName, OwningProcess , $Process