So a little while ago I created a netstat function for powershell that doesn’t use the netstat.exe from windows but rather uses pinvoke to call some API’s. Perhaps a bit over kill, but was a fun little project. The problem I ran in to was the display of that info. So, I took what was there and turned it in to a module, and here is how its done.

So, for a module to be easily accessible it needs to be in one of two locations depending if you want it user or system level.

Step 1 – Create the modules folder!

User Level Module Location: $home\Documents\WindowsPowershell\Modules

Machine Level Module Location: $HOME\Modules

Where you store it is up to you. Each module must have a folder, in this case, I called it NetworkUtil and the way modules work is it loads the PSM1 file with the same name as the folder (which is module name).

Step 2 – The files

you could have a very simple module that is one ps1 file, and just name it the same as the folder and you’re good, but because our script may down the road involve a few more functions (in the form of PS1 files) as well as special formatting, we’re going to create a few files.

NetworkUtil.psm1 – The module file that tells it what files are involved in this module.

Network.Format.ps1xml – The file that contains info on how we want our function displayed.

NetworkUtil.psd1 – a manifest module, basically it gives some info about it and is of a standard format. This can be copied from http://msdn.microsoft.com/en-us/library/dd878337(VS.85).aspx and modified to suit your modules needs. There is ONE important modification here, and that’s for our format file. in the FormatsToProcess assign ‘NetworkUtil.Format.ps1xml’.

Get-Netstat.ps1 – And of course, our script file

Step 3 – Give those files some content!

Easy ones first.

The Get-Netstat.ps1 should contain the netstat function we created before

Next, the NetworkUtil.psm1 needs to contain one lonely line for now.

. $psScriptRoot\Get-Netstat.ps1

the NetworkUtil.psd1 which as indicated above can be copied from http://msdn.microsoft.com/en-us/library/dd878337(VS.85).aspx with that one minor modification;

FormatsToProcess = ‘NetworkUtil.Format.ps1xml’

Now for the fun part, the format file. More info can be found here, but basically its just an XML doc with some pretty basic info. We define the header names and size and then defile the properties that it should display under those headers. This is a real basic format file, but it does the trick

<?xml version="1.0" encoding="utf-8"?>
<Configuration>
  <ViewDefinitions>
    <View>
      <Name>DefaultView</Name>
      <ViewSelectedBy>
        <TypeName>Connection</TypeName>
      </ViewSelectedBy>
      <TableControl>
        <TableHeaders>
          <TableColumnHeader>
            <Width>4</Width>
          </TableColumnHeader>
          <TableColumnHeader>
            <Width>6</Width>
          </TableColumnHeader>
          <TableColumnHeader>
            <Width>15</Width>
          </TableColumnHeader>
          <TableColumnHeader>
            <Width>6</Width>
          </TableColumnHeader>
          <TableColumnHeader>
            <Width>15</Width>
          </TableColumnHeader>
          <TableColumnHeader>
            <Width>6</Width>
          </TableColumnHeader>
          <TableColumnHeader>
            <Width>15</Width>
          </TableColumnHeader>
        </TableHeaders>
        <TableRowEntries>
          <TableRowEntry>
            <TableColumnItems>
              <TableColumnItem>
                <PropertyName>protocol</PropertyName>
              </TableColumnItem>
              <TableColumnItem>
                <PropertyName>PID</PropertyName>
              </TableColumnItem>
              <TableColumnItem>
                <PropertyName>LocalIP</PropertyName>
              </TableColumnItem>
              <TableColumnItem>
                <PropertyName>localport</PropertyName>
              </TableColumnItem>
              <TableColumnItem>
                <PropertyName>remoteip</PropertyName>
              </TableColumnItem>
              <TableColumnItem>
                <PropertyName>remoteport</PropertyName>
              </TableColumnItem>
              <TableColumnItem>
                <PropertyName>state</PropertyName>
              </TableColumnItem>
            </TableColumnItems>
          </TableRowEntry>
        </TableRowEntries>
      </TableControl>
    </View>
  </ViewDefinitions>
</Configuration>

Nothing to special going on here, but it surely makes it a lot easier to read!

Now we just need to import our module

Import-Module NetworkUtil

And we’re ready to go!

Get-Netstat

Because our netstat is now so cool we can take a look at all TCP connections that are not on the loop back connection.

Get-Netstat –TCPonly | where {$_.localip –ne “172.0.0.1”}

or perhaps only established connections and in order of local port.

Get-Netstat | where {$_.state –eq “established”} | sort localport

Maybe we want to see all web sessions we are connected to.

Get-Netstat | where {$_.remoteport –eq 80}

Now we want to see the names (name resolution is done on request so this might slow down to regular netstat speed)

Get-Netstat | where {$_.remoteport –eq 80} | select RemoteHostName,State

Once I found a good place to upload this I’ll make this module downloadable.

Enjoy!