Wednesday, December 16, 2015

Netstat Surprise: Process Headers are Footers

Sometimes I need to examine the list of network connections/listeners and what process created them. For that, I generally use netstat -bna because the netstat utility is guaranteed to be on every modern Windows machine. However, the output format recently caused me a good deal of confusion and some lost time.

See, the utility prints the name of the owning process on the line after all the connections it owns. I would expect those headers to be, well, headers, but no no, they are footers. I suppose I should have seen this - it's reasonably intuitable if you check the top or bottom of the list - but in my defense, I was dealing with a massive amount of connections, so I had to Ctrl+C the program so as to not scroll the interesting ones out of the console buffer.

It would make more sense, in my opinion, for these markers to actually be headers.

No comments:

Post a Comment