Skip to content

Instantly share code, notes, and snippets.

@argctl
Last active February 1, 2026 05:42
Show Gist options
  • Select an option

  • Save argctl/08d38ef676793d78bddae5c7bb4e3d26 to your computer and use it in GitHub Desktop.

Select an option

Save argctl/08d38ef676793d78bddae5c7bb4e3d26 to your computer and use it in GitHub Desktop.
net_process.ps1
#while ($true) {
param(
[string]$UDP
)
if ($UDP -eq "") {
Write-Host "To check for a UDP address, add -UDP True \n Query time will increase significantly"
}
Get-Date
Get-NetTCPConnection | Where-Object { $_.State -eq "Established" -and !($_.RemoteAddress -eq "127.0.0.1")} |
ForEach-Object {
$process = Get-Process -Id $_.OwningProcess
if ($UDP -eq "True") {
Write-Host "UDP lookup #$i for TCP LocalPort=$($_.LocalPort)"
$udpEndpoint = Get-NetUDPEndpoint -LocalPort $_.LocalPort -ErrorAction SilentlyContinue
}
[pscustomobject]@{
ProcessName = $process.Name
OwningProccess = $_.OwningProcess
State = $_.State
LocalAddress = $_.LocalAddress
LocalPort = $_.LocalPort
RemotePort = $_.RemotePort
RemoteAddress = $_.RemoteAddress
UDPLocalAddress = $udpEndpoint?.LocalAddress
}
} | Format-Table -AutoSize
#Start-Sleep -Seconds 2
if ($UDP -eq "True") {
Get-NetUDPEndpoint |
Select-Object LocalAddress, LocalPort, OwningProcess,
@{n='ProcessName';e={(Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).Name}} |
Sort-Object LocalPort, LocalAddress | Format-Table -AutoSize
}
#}
@argctl
Copy link
Author

argctl commented Feb 1, 2026

check for processes with established connections, check for processes with established TCP connections that also have UDP endpoints on that same port, then list processes using UDP by all UDP ports.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment