获取 Netstat 输出 - Server 2008 R2 上的代码失败
Getting Netstat output - code fails on Server 2008 R2
我对 PowerShell 和一般的脚本编写还很陌生。我被要求生成一段时间内大量服务器上所有侦听 TCP 端口的列表，返回一个可以导入和搜索的大 csv 文件。不幸的是，其中一些仍然是 运行ning Server 2008R2（是的，是的，我知道......）所以使用 Get-NetTCPConnection 是不可能的。我几乎必须尝试 运行 NetStat 并利用它的输出。我发现了一个由 Adam Bertram 在 2015 年编写的名为 Get-LocalPort.ps1 的精彩脚本，它将输出转换为适当的 Powershell 对象并且看起来很理想，但它在 Server 2008R2 上也不 运行。它会产生错误 Method invocation failed because [System.Object[]] doesn't contain a method named 'Trim'.，我认为它来自行 $Netstat = (netstat -anb | where {$_ -and ($_ -ne 'Active Connections')}).Trim() | Select-Object -Skip 1 | foreach {$_ -replace '\s{2,}','|'} 我不明白为什么该行适用于较新的版本，但不适用于 2008R2。任何人都可以帮助我调整它以便它在旧版本的 Powershell 上 运行s 吗？非常感谢。
整个脚本如下：
<#
.SYNOPSIS
This parses the native netstat.exe's output using the command line "netstat -anb" to find
all of the network ports in use on a local machine and all associated processes and services
.NOTES
Created on: 2/15/2015
Created by: Adam Bertram
Filename: Get-LocalPort.ps1
.EXAMPLE
PS> Get-LocalPort.ps1
This example will find all network ports in uses on the local computer with associated
processes and services
.EXAMPLE
PS> Get-LocalPort.ps1 | Where-Object {$_.ProcessOwner -eq 'svchost.exe'}
This example will find all network ports in use on the local computer that were opened
by the svchost.exe process.
.EXAMPLE
PS> Get-LocalPort.ps1 | Where-Object {$_.IPVersion -eq 'IPv4'}
This example will find all network ports in use on the local computer using IPv4 only.
#>
[CmdletBinding()]
param ()
begin {
Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'
}
process {
try {
## Capture the output of the native netstat.exe utility
## Remove the top row from the result and trim off any leading or trailing spaces from each line
## Replace all instances of more than 1 space with a pipe symbol. This allows easier parsing of
## the fields
$Netstat = (netstat -anb | where {$_ -and ($_ -ne 'Active Connections')}).Trim() | Select-Object -Skip 1 | foreach {$_ -replace '\s{2,}','|'}
$i = 0
foreach ($Line in $Netstat) {
## Create the hashtable to conver to object later
$Out = @{
'Protocol' = ''
'State' = ''
'IPVersion' = ''
'LocalAddress' = ''
'LocalPort' = ''
'RemoteAddress' = ''
'RemotePort' = ''
'ProcessOwner' = ''
'Service' = ''
}
## If the line is a port
if ($Line -cmatch '^[A-Z]{3}\|') {
$Cols = $Line.Split('|')
$Out.Protocol = $Cols[0]
## Some ports don't have a state. If they do, there's always 4 fields in the line
if ($Cols.Count -eq 4) {
$Out.State = $Cols[3]
}
## All port lines that start with a [ are IPv6
if ($Cols[1].StartsWith('[')) {
$Out.IPVersion = 'IPv6'
$Out.LocalAddress = $Cols[1].Split(']')[0].TrimStart('[')
$Out.LocalPort = $Cols[1].Split(']')[1].TrimStart(':')
if ($Cols[2] -eq '*:*') {
$Out.RemoteAddress = '*'
$Out.RemotePort = '*'
} else {
$Out.RemoteAddress = $Cols[2].Split(']')[0].TrimStart('[')
$Out.RemotePort = $Cols[2].Split(']')[1].TrimStart(':')
}
} else {
$Out.IPVersion = 'IPv4'
$Out.LocalAddress = $Cols[1].Split(':')[0]
$Out.LocalPort = $Cols[1].Split(':')[1]
$Out.RemoteAddress = $Cols[2].Split(':')[0]
$Out.RemotePort = $Cols[2].Split(':')[1]
}
## Because the process owner and service are on separate lines than the port line and the number of lines between them is variable
## this craziness was necessary. This line starts parsing the netstat output at the current port line and searches for all
## lines after that that are NOT a port line and finds the first one. This is how many lines there are until the next port
## is defined.
$LinesUntilNextPortNum = ($Netstat | Select-Object -Skip $i | Select-String -Pattern '^[A-Z]{3}\|' -NotMatch | Select-Object -First 1).LineNumber
## Add the current line to the number of lines until the next port definition to find the associated process owner and service name
$NextPortLineNum = $i + $LinesUntilNextPortNum
## This would contain the process owner and service name
$PortAttribs = $Netstat[($i+1)..$NextPortLineNum]
## The process owner is always enclosed in brackets of, if it can't find the owner, starts with 'Can'
$Out.ProcessOwner = $PortAttribs -match '^\[.*\.exe\]|Can'
if ($Out.ProcessOwner) {
## Get rid of the brackets and pick the first index because this is an array
$Out.ProcessOwner = ($Out.ProcessOwner -replace '\[|\]','')[0]
}
## A service is always a combination of multiple word characters at the start of the line
if ($PortAttribs -match '^\w+$') {
$Out.Service = ($PortAttribs -match '^\w+$')[0]
}
[pscustomobject]$Out
}
## Keep the counter
$i++
}
} catch {
Write-Error "Error: $($_.Exception.Message) - Line Number: $($_.InvocationInfo.ScriptLineNumber)"
}
}
您可以执行以下操作：
# skipping header
$ns = netstat -anb | Select -Skip 3
$ns | Foreach-Object {
# Trim surrounding spaces
$line = $_.Trim()
# Check for lines starting with TCP
if ($line -cmatch '^TCP') {
# Split lines by spaces
$p,$l,$f,$s = $line -split '\s+'
# Output $obj if it already exists before new one is created
if ($obj) { $obj }
# service and process owner are blanked since they are on another line
$obj = new-object -TypeName Psobject -Property @{
Protocol=$p
State=$s
IPVersion=('IPv6','IPv4')[$l -match ':.*:']
LocalAddress=($l -replace '[\[\]]|:[^:]+$')
LocalPort=$l -replace '^.*:'
RemoteAddress=($f -replace '[\[\]]|:[^:]+$')
RemotePort=$f -replace '^.*:'
ProcessOwner=''
Service=''
}
}
elseif ($line -cmatch '^UDP') {
$p,$l,$f = $line -split '\s+'
if ($obj) { $obj }
$obj = new-object -TypeName Psobject -Property @{
Protocol=$p
State=''
IPVersion=('IPv4','IPv6')[$l -match ':.*:']
LocalAddress=($l -replace '[\[\]]|:[^:]+$')
LocalPort=$l -replace '^.*:'
RemoteAddress=($f -replace '[\[\]]|:[^:]+$')
RemotePort=$f -replace '^.*:'
ProcessOwner=''
Service=''
}
}
# line starts with [ then it is service name
elseif ($line -match '^\[') {
$obj.Service = $line -replace '[\[\]]'
}
else {
$obj.ProcessOwner = $line
}
}
感谢 AdminOfThings，您的第一条评论是正确的。 $Netstat = netstat -anb | where {$_ -and ($_ -ne 'Active Connections')} | foreach { $_.Trim() } | Select-Object -Skip 1 | foreach {$_ -replace '\s{2,}','|'}' 行有效，但是我还必须将末尾的行从 [pscustomobject]$Out 更改为 New-Object -TypeName PSObject -Property $Out 因为 [pscustomobject] 显然是 PS 3 中的另一个新事物。有了这些更改它适用于 Server 2008R2、2012R2 和 2016。
我对 PowerShell 和一般的脚本编写还很陌生。我被要求生成一段时间内大量服务器上所有侦听 TCP 端口的列表，返回一个可以导入和搜索的大 csv 文件。不幸的是，其中一些仍然是 运行ning Server 2008R2（是的，是的，我知道......）所以使用 Get-NetTCPConnection 是不可能的。我几乎必须尝试 运行 NetStat 并利用它的输出。我发现了一个由 Adam Bertram 在 2015 年编写的名为 Get-LocalPort.ps1 的精彩脚本，它将输出转换为适当的 Powershell 对象并且看起来很理想，但它在 Server 2008R2 上也不 运行。它会产生错误 Method invocation failed because [System.Object[]] doesn't contain a method named 'Trim'.，我认为它来自行 $Netstat = (netstat -anb | where {$_ -and ($_ -ne 'Active Connections')}).Trim() | Select-Object -Skip 1 | foreach {$_ -replace '\s{2,}','|'} 我不明白为什么该行适用于较新的版本，但不适用于 2008R2。任何人都可以帮助我调整它以便它在旧版本的 Powershell 上 运行s 吗？非常感谢。
整个脚本如下：
<#
.SYNOPSIS
This parses the native netstat.exe's output using the command line "netstat -anb" to find
all of the network ports in use on a local machine and all associated processes and services
.NOTES
Created on: 2/15/2015
Created by: Adam Bertram
Filename: Get-LocalPort.ps1
.EXAMPLE
PS> Get-LocalPort.ps1
This example will find all network ports in uses on the local computer with associated
processes and services
.EXAMPLE
PS> Get-LocalPort.ps1 | Where-Object {$_.ProcessOwner -eq 'svchost.exe'}
This example will find all network ports in use on the local computer that were opened
by the svchost.exe process.
.EXAMPLE
PS> Get-LocalPort.ps1 | Where-Object {$_.IPVersion -eq 'IPv4'}
This example will find all network ports in use on the local computer using IPv4 only.
#>
[CmdletBinding()]
param ()
begin {
Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'
}
process {
try {
## Capture the output of the native netstat.exe utility
## Remove the top row from the result and trim off any leading or trailing spaces from each line
## Replace all instances of more than 1 space with a pipe symbol. This allows easier parsing of
## the fields
$Netstat = (netstat -anb | where {$_ -and ($_ -ne 'Active Connections')}).Trim() | Select-Object -Skip 1 | foreach {$_ -replace '\s{2,}','|'}
$i = 0
foreach ($Line in $Netstat) {
## Create the hashtable to conver to object later
$Out = @{
'Protocol' = ''
'State' = ''
'IPVersion' = ''
'LocalAddress' = ''
'LocalPort' = ''
'RemoteAddress' = ''
'RemotePort' = ''
'ProcessOwner' = ''
'Service' = ''
}
## If the line is a port
if ($Line -cmatch '^[A-Z]{3}\|') {
$Cols = $Line.Split('|')
$Out.Protocol = $Cols[0]
## Some ports don't have a state. If they do, there's always 4 fields in the line
if ($Cols.Count -eq 4) {
$Out.State = $Cols[3]
}
## All port lines that start with a [ are IPv6
if ($Cols[1].StartsWith('[')) {
$Out.IPVersion = 'IPv6'
$Out.LocalAddress = $Cols[1].Split(']')[0].TrimStart('[')
$Out.LocalPort = $Cols[1].Split(']')[1].TrimStart(':')
if ($Cols[2] -eq '*:*') {
$Out.RemoteAddress = '*'
$Out.RemotePort = '*'
} else {
$Out.RemoteAddress = $Cols[2].Split(']')[0].TrimStart('[')
$Out.RemotePort = $Cols[2].Split(']')[1].TrimStart(':')
}
} else {
$Out.IPVersion = 'IPv4'
$Out.LocalAddress = $Cols[1].Split(':')[0]
$Out.LocalPort = $Cols[1].Split(':')[1]
$Out.RemoteAddress = $Cols[2].Split(':')[0]
$Out.RemotePort = $Cols[2].Split(':')[1]
}
## Because the process owner and service are on separate lines than the port line and the number of lines between them is variable
## this craziness was necessary. This line starts parsing the netstat output at the current port line and searches for all
## lines after that that are NOT a port line and finds the first one. This is how many lines there are until the next port
## is defined.
$LinesUntilNextPortNum = ($Netstat | Select-Object -Skip $i | Select-String -Pattern '^[A-Z]{3}\|' -NotMatch | Select-Object -First 1).LineNumber
## Add the current line to the number of lines until the next port definition to find the associated process owner and service name
$NextPortLineNum = $i + $LinesUntilNextPortNum
## This would contain the process owner and service name
$PortAttribs = $Netstat[($i+1)..$NextPortLineNum]
## The process owner is always enclosed in brackets of, if it can't find the owner, starts with 'Can'
$Out.ProcessOwner = $PortAttribs -match '^\[.*\.exe\]|Can'
if ($Out.ProcessOwner) {
## Get rid of the brackets and pick the first index because this is an array
$Out.ProcessOwner = ($Out.ProcessOwner -replace '\[|\]','')[0]
}
## A service is always a combination of multiple word characters at the start of the line
if ($PortAttribs -match '^\w+$') {
$Out.Service = ($PortAttribs -match '^\w+$')[0]
}
[pscustomobject]$Out
}
## Keep the counter
$i++
}
} catch {
Write-Error "Error: $($_.Exception.Message) - Line Number: $($_.InvocationInfo.ScriptLineNumber)"
}
}
您可以执行以下操作：
# skipping header
$ns = netstat -anb | Select -Skip 3
$ns | Foreach-Object {
# Trim surrounding spaces
$line = $_.Trim()
# Check for lines starting with TCP
if ($line -cmatch '^TCP') {
# Split lines by spaces
$p,$l,$f,$s = $line -split '\s+'
# Output $obj if it already exists before new one is created
if ($obj) { $obj }
# service and process owner are blanked since they are on another line
$obj = new-object -TypeName Psobject -Property @{
Protocol=$p
State=$s
IPVersion=('IPv6','IPv4')[$l -match ':.*:']
LocalAddress=($l -replace '[\[\]]|:[^:]+$')
LocalPort=$l -replace '^.*:'
RemoteAddress=($f -replace '[\[\]]|:[^:]+$')
RemotePort=$f -replace '^.*:'
ProcessOwner=''
Service=''
}
}
elseif ($line -cmatch '^UDP') {
$p,$l,$f = $line -split '\s+'
if ($obj) { $obj }
$obj = new-object -TypeName Psobject -Property @{
Protocol=$p
State=''
IPVersion=('IPv4','IPv6')[$l -match ':.*:']
LocalAddress=($l -replace '[\[\]]|:[^:]+$')
LocalPort=$l -replace '^.*:'
RemoteAddress=($f -replace '[\[\]]|:[^:]+$')
RemotePort=$f -replace '^.*:'
ProcessOwner=''
Service=''
}
}
# line starts with [ then it is service name
elseif ($line -match '^\[') {
$obj.Service = $line -replace '[\[\]]'
}
else {
$obj.ProcessOwner = $line
}
}
感谢 AdminOfThings，您的第一条评论是正确的。 $Netstat = netstat -anb | where {$_ -and ($_ -ne 'Active Connections')} | foreach { $_.Trim() } | Select-Object -Skip 1 | foreach {$_ -replace '\s{2,}','|'}' 行有效，但是我还必须将末尾的行从 [pscustomobject]$Out 更改为 New-Object -TypeName PSObject -Property $Out 因为 [pscustomobject] 显然是 PS 3 中的另一个新事物。有了这些更改它适用于 Server 2008R2、2012R2 和 2016。