Skip to main content

Posts

Showing posts with the label Netstat

PowerShell Port Scanning one liner - check range of port

Netcat is one of the best tools to check if port is open or not, and Netcat does offer also a lot of features other than port scanning. However, if netcat is not available on the system or it's not allowed to be installed. In Windows environment PowerShell will come in handy. Example one-liner code below uses PowerShell to scan a specified Target IP and also a range of ports to be scanned. To test the code, change the target IP as desired and also the range of port to be tested.  1..65535 | % {Test-NetConnection  127.0.0.1-Port $_ } 442..443 | % {Test-NetConnection  8.8.8.8 -Port $_ } Sample Output of the above commands:  1..10 | % {Test-NetConnection  127.0.0.1-Port $_ } 442..443 | % {Test-NetConnection  8.8.8.8 -Port $_ } Cheers! Take care. Till next Time. Enjoy exploring the world of PowerShell and enjoy the journey of learning.. Stay safe! and Keep things up!  Do ASAP,  A lways  S ay  A   P rayer ... Practice O.T.G. =  O be...

What application is running behind svchost.exe in Windows?

Task Manager can be opened in different ways via Taskbar, pressing Ctrl + Shift + Esc or right clicking on the Windows icon and selecting Task Manager. In Task Manager window, it will show what are the processes or services running on the system. On the Details Tab of the Task Manager the details of the .exe file or the applications or services running on the system will be displayed. One noticeable thing on Task Manager is the svchost.exe, depending on how busy the system is or how many applications, browsers or other items that will need to connect to svchost.exe. The said exe file can easily be seen on Task Manager since there will be few of them.   But what is the application running behind the svchost.exe? Or what is occupying or using svchost.exe? Why there are a few of them running on the system? To get to the bottom of all the questions above, PID or Process ID will show what is behind the svchost.exe. To do this, open an elevated CMD or command prompt window....

IOT – what is it about?

IOT –  an acronym for Internet of things. What is IOT? What is it about? What does it do? IOT composes of two components, Internet and things. So, what are the things? Things are smart phone, Arduino, Beagle bone, Raspberry Pi, Smart TV’s, Refrigerators, air-condition system or basically any devices or appliances that are capable to be connected to the network or to the Internet. If those thing, devices or appliances is not connected to the network or internet they are just on their own. They are just things of the people who owned them. But once they are connected to the Internet and are controlled remotely, then it becomes an IOT the Internet of Things, since they are already part of a larger network. In which, some software or individuals can access to the things remotely. IOT is a good thing but there will always be individuals who will abuse or do evil things. IOT devices or appliances should be safe and secure. But things are hackable  and I gu...

PowerShell Test Port Forwarding - check if port is open

Port forwarding is necessary if the device is that needs to connect to the unsecured world of the Internet. Of course, before opening port or doing any port forwarding make sure that security is in place. Firewall rules, software configuration are properly set, up-to-date anti-virus and other settings that needs to be done to secure the system. PowerShell can test whether a remote port is open or a Port Forwarding rules on either on the Firewall or router is set correctly. Here’s a one liner code, to check whether the Port is open or not. Both one line code below does the same thing, check whether the Port is open or not. 1 . New-Object System.Net.Sockets.TCPClient -ArgumentList "Remote.Public.IP.Address", 3389 2. Test-NetConnection -Port 80 -InformationLevel Detailed Replace the port number, with any port number to be tested. If the connected property on the displayed output is true, then the port is open. More details on the link b...

Show localports opening in Advfirewall using netsh

Old command to show ports opening in netsh is: netsh firewall show portopening For Windows OSes which uses Advance Firewall the above command may not work anymore. PowerShell of course can get the list of ports used by Windows advance firewall with security. The link below shows on how to use PowerShell to query advance firewall: http://blogs.technet.com/b/jamesone/archive/2009/02/18/how-to-manage-the-windows-firewall-settings-with-powershell.aspx If a program or application utilizes a specific port and is not open or not being set on the firewall then the particular program or application may not be accessible remotely. If command line is preferable, netsh is able to get or list the ports used by the firewall. netsh advfirewall firewall show rule name=all   verbose | findstr "LocalPort:" Sample output for the command above: LocalPort:                  ...

PowerShell get network adapter Speed

How to check network adapter speed installed on a computer using PowerShell? Code snippet below will get the name of all the network adapter installed on a computer and also the speed. To use the script on a remote computer supply the computer name and run the script with appropriate privileges to get the data on the remote computer. #=========================== $computer_name = "." $Net_adapter = gwmi   -class Win32_NetworkAdapter -namespace "root\CIMV2" ` -computername $computer_name foreach ( $objItem in $Net_adapter ) { "Adapter is: " + $objItem . name + " -- " + "Adapter Speed is: " + [ math ]:: truncate( $objItem . speed / 1MB ) + " MB" } #=========================== Change the 1MB to 1GB if you need the output in GB. Sample Output: Adapter is: Teredo Tunneling Pseudo-Interface -- Adapter Speed is: 0 MB Adapter is: Microsoft ISATAP Adapter #3 -- Adap...

Show interface IP Address in Windows 10

Commands below work in Windows 10, I think it will also work in Windows 2012. Displaying or show IP Address in Windows is quite straight forward using ipconfig /all command. The command has the /all parameter so it will display the IP Address of all the interfaces on the machine. Display IP Address of a specific interface in Windows via command line using “netsh” tool. To display the interface IP Address you need to get the interface name. Typing the command below will show all the interface name and its state whether its connected or disconnected.      netsh interface show interface Sample output: Admin State    State          Type             Interface Name ------------------------------------------------------------------------- Enabled        Connected      ...

Ports Replication Used by Active Directory

If replication is failing between servers in Active Directory, ports below should be checked whether they are open, block or other application is using them. Port           135     RPC-based replication (Dynamic) TCP LDAP       389     UDP / TCP LDAP       636     TCP (SSL) LDAP       3268   (Global Catalog) Kerberos   88       UDP / TCP DNS         53        UDP / TCP From the list of ports the easiest one to troubleshoot is port 53, if replication is failing and at the same time users are complaining that they are not able to access websites using domain names such as facebook, twitter or youtube. Then put DNS as top priority on troubleshooting procedures. One good habit that...

Netstat to check listening ports

To check listening ports on windows, netstat is a tool that is quite handy. And not only windows uses this tool, Linux system use this tool also. In windows to check listening ports and the application that uses the port type: netstat -abn The command needs to run at an elevated command prompt. netstat -ano   is able to check listening and established ports. Check out this link on how to open an elevated command prompt: http://quickbytesstuff.blogspot.sg/2014/10/open-elevated-command-prompt.html The command will list the local address the foreign address or the public ip and the state. Example output will be like this: [chrome.exe]  TCP    192.168.1.50:3101    0.0.117.1:443     ESTABLISHED In Linux this command would come handy: netstat -tulpn It will list the udp, tcp ports that are listening and also the daemon service listening or using the port. Check out link below how to use netstat and Power...