--- name: "Parse::Netstat::win32" section: "3pm" platform: "linux" package: "libparse-netstat-perl" version: "0.150-1" release: "Debian 13 (Trixie)" platforms: ["linux"] url: "https://new.carta.tech/Parse::Netstat::win32" --- # Parse::Netstat::win32(3pm) Parse the output of Windows "netstat" command ## NAME Parse::Netstat::win32 - Parse the output of Windows "netstat" command ## VERSION This document describes version 0.150 of Parse::Netstat::win32 (from Perl distribution Parse-Netstat), released on 2022-12-04. ## SYNOPSIS ``` use Parse::Netstat qw(parse_netstat); my $res = parse_netstat(output=>join("", `netstat -anp`), flavor=>"win32"); ``` Sample \`netstat -anp\` output: ``` Active Connections Proto Local Address Foreign Address State PID TCP 0.0.0.0:135 0.0.0.0:0 LISTENING 988 c:\windows\system32\WS2_32.dll C:\WINDOWS\system32\RPCRT4.dll c:\windows\system32\rpcss.dll C:\WINDOWS\system32\svchost.exe -- unknown component(s) -- [svchost.exe] TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4 [System] TCP 127.0.0.1:1027 0.0.0.0:0 LISTENING 1244 [alg.exe] TCP 192.168.0.104:139 0.0.0.0:0 LISTENING 4 [System] UDP 0.0.0.0:1025 *:* 1120 C:\WINDOWS\system32\mswsock.dll c:\windows\system32\WS2_32.dll c:\windows\system32\DNSAPI.dll c:\windows\system32\dnsrslvr.dll C:\WINDOWS\system32\RPCRT4.dll [svchost.exe] UDP 0.0.0.0:500 *:* 696 [lsass.exe] ``` Sample result: ``` [ 200, "OK", { active_conns => [ { execs => [ "c:\\windows\\system32\\WS2_32.dll", "C:\\WINDOWS\\system32\\RPCRT4.dll", "c:\\windows\\system32\\rpcss.dll", "C:\\WINDOWS\\system32\\svchost.exe", "[svchost.exe]", ], foreign_host => "0.0.0.0", foreign_port => 0, local_host => "0.0.0.0", local_port => 135, pid => 988, proto => "tcp", state => "LISTENING", }, { execs => ["[System]"], foreign_host => "0.0.0.0", foreign_port => 0, local_host => "0.0.0.0", local_port => 445, pid => 4, proto => "tcp", state => "LISTENING", }, { execs => ["[alg.exe]"], foreign_host => "0.0.0.0", foreign_port => 0, local_host => "127.0.0.1", local_port => 1027, pid => 1244, proto => "tcp", state => "LISTENING", }, { execs => ["[System]"], foreign_host => "0.0.0.0", foreign_port => 0, local_host => "192.168.0.104", local_port => 139, pid => 4, proto => "tcp", state => "LISTENING", }, { execs => [ "C:\\WINDOWS\\system32\\mswsock.dll", "c:\\windows\\system32\\WS2_32.dll", "c:\\windows\\system32\\DNSAPI.dll", "c:\\windows\\system32\\dnsrslvr.dll", "C:\\WINDOWS\\system32\\RPCRT4.dll", "[svchost.exe]", ], foreign_host => "*", foreign_port => "*", local_host => "0.0.0.0", local_port => 1025, pid => 1120, proto => "udp", }, { execs => ["[lsass.exe]"], foreign_host => "*", foreign_port => "*", local_host => "0.0.0.0", local_port => 500, pid => 696, proto => "udp", }, ], }, ] ``` ## FUNCTIONS ### parse\_netstat Usage: ``` parse_netstat(%args) -> [$status_code, $reason, $payload, \%result_meta] ``` Parse the output of Windows "netstat" command. Netstat can be called with `"-n"` (show raw IP addresses and port numbers instead of hostnames or port names) or without. It can be called with `"-a"` (show all listening and non-listening socket) option or without. And can be called with `"-p"` (show PID/program names) or without. This function is not exported by default, but exportable. Arguments ('\*' denotes required arguments): - • **output**\* =\> *str* Output of netstat command. - • **tcp** =\> *bool* (default: 1) Whether to parse TCP (and TCP6) connections. - • **udp** =\> *bool* (default: 1) Whether to parse UDP (and UDP6) connections. Returns an enveloped result (an array). First element ($status\_code) is an integer containing HTTP-like status code (200 means OK, 4xx caller error, 5xx function error). Second element ($reason) is a string containing error message, or something like "OK" if status is 200. Third element ($payload) is the actual result, but usually not present when enveloped result is an error response ($status\_code is not 2xx). Fourth element (%result\_meta) is called result metadata and is optional, a hash that contains extra information, much like how HTTP response headers provide additional metadata. Return value: (any) ## HOMEPAGE Please visit the project's homepage at \. ## SOURCE Source repository is at \. ## AUTHOR perlancar \ ## CONTRIBUTING To contribute, you can send patches by email/via RT, or send pull requests on GitHub. Most of the time, you don't need to build the distribution yourself. You can simply modify the code, then test via: ``` % prove -l ``` If you want to build the distribution (e.g. to try to install it locally on your system), you can install Dist::Zilla, Dist::Zilla::PluginBundle::Author::PERLANCAR, Pod::Weaver::PluginBundle::Author::PERLANCAR, and sometimes one or two other Dist::Zilla- and/or Pod::Weaver plugins. Any additional steps required beyond that are considered a bug and can be reported to me. ## COPYRIGHT AND LICENSE This software is copyright (c) 2022, 2017, 2015, 2014, 2012, 2011 by perlancar \. This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself. ## BUGS Please report any bugs or feature requests on the bugtracker website \ When submitting a bug or request, please include a test-file or a patch to an existing test-file that illustrates the bug or desired feature.