Skip to content

minority opinions

Menu
  • Contact
  • Home
  • Tags
Menu

윈도우 netstat 상태 로그 저장하기

Posted on November 24, 2021July 8, 2023 by Daniel J.

보안침해사고 서버를 분석 하다보면 간혹 Windows OS 네트워크 연결 세션 ESTABLISHED 에 대하여 지속적으로 체크하여 로그 형태로 남겨야할 상황이 필요할때가 있다 간단하게 배치파일로 만들어서 사용하면 나름 업무에 유용하게 쓸수 있다.

배치파일 다운로드: https://blog.kakaocdn.net/dn/x4icL/btrw2NVjZky/82EBWImjNLCxKjmJJIAN9k/netstat-check.bat?attach=1&knm=tfile.bat

netstat 상태 10초마다 로그 파일 남기기


@echo off
:_loop

echo %time% ###############################################   >> %cd%%COMPUTERNAME%_conn.txt
netstat -nao | findstr "ESTABLISHED" >> %cd%%COMPUTERNAME%_conn.txt
powershell sleep 2

goto _loop

저장된 로그 형태


17:14:07.36 ###############################################   
  TCP    10.1xx.xx.63:49750     10.xx.xx.11.53:8443     ESTABLISHED     4940
  TCP    10.1xx.xx.63:49909     10.xx.xx.210:1234       ESTABLISHED     16460
  TCP    10.1xx.xx.63:49946     10.xx.xx.12.11:5548     ESTABLISHED     16460
  TCP    10.1xx.xx.63:49952     211xx.xx.13.15:11887    ESTABLISHED     16952
  TCP    10.1xx.xx.63:49992     1.2xx.xx.7.32:20222     ESTABLISHED     5572
  TCP    10.1xx.xx.63:49995     1.2xx.xx.7.32:20222     ESTABLISHED     6996
  TCP    10.1xx.xx.63:53392     1.2xx.xx.7.31:2022      ESTABLISHED     3708
  TCP    127.0.0.1:49695        127.0.0.1:49696        ESTABLISHED     5072
  TCP    127.0.0.1:49696        127.0.0.1:49695        ESTABLISHED     5072
  TCP    127.0.0.1:49745        127.0.0.1:49746        ESTABLISHED     4940
  TCP    127.0.0.1:49746        127.0.0.1:49745        ESTABLISHED     4940
  TCP    127.0.0.1:49748        127.0.0.1:49749        ESTABLISHED     4940
  TCP    127.0.0.1:49749        127.0.0.1:49748        ESTABLISHED     4940
  TCP    127.0.0.1:49846        127.0.0.1:49847        ESTABLISHED     5072
  TCP    127.0.0.1:49847        127.0.0.1:49846        ESTABLISHED     5072
  TCP    127.0.0.1:50134        127.0.0.1:50135        ESTABLISHED     5072
  TCP    127.0.0.1:50135        127.0.0.1:50134        ESTABLISHED     5072
  TCP    127.0.0.1:54760        127.0.0.1:54762        ESTABLISHED     17412
  TCP    127.0.0.1:54762        127.0.0.1:54760        ESTABLISHED     17412
17:14:22.42 ###############################################   
  TCP    10.1xx.xx.63:49750     10.100.xx.53:8443     ESTABLISHED     4940
  TCP    10.1xx.xx.63:49909     10.xx.1.210:1234       ESTABLISHED     16460
  TCP    10.1xx.xx.63:49946     10.100.112.11:5548     ESTABLISHED     16460
  TCP    10.1xx.xx.63:49952     211.xx.213.xx:11887    ESTABLISHED     16952
  TCP    10.1xx.xx.63:49992     1.224.xx.32:20222     ESTABLISHED     5572
  TCP    127.0.0.1:49695        127.0.0.1:49696        ESTABLISHED     5072
  TCP    127.0.0.1:49696        127.0.0.1:49695        ESTABLISHED     5072
  TCP    127.0.0.1:49745        127.0.0.1:49746        ESTABLISHED     4940
  TCP    127.0.0.1:49746        127.0.0.1:49745        ESTABLISHED     4940
  TCP    127.0.0.1:49748        127.0.0.1:49749        ESTABLISHED     4940
  TCP    127.0.0.1:49749        127.0.0.1:49748        ESTABLISHED     4940
  TCP    127.0.0.1:49846        127.0.0.1:49847        ESTABLISHED     5072
  TCP    127.0.0.1:49847        127.0.0.1:49846        ESTABLISHED     5072
  TCP    127.0.0.1:50134        127.0.0.1:50135        ESTABLISHED     5072
  TCP    127.0.0.1:50135        127.0.0.1:50134        ESTABLISHED     5072
  TCP    127.0.0.1:54760        127.0.0.1:54762        ESTABLISHED     17412

Related

Leave a Reply Cancel reply

Your email address will not be published. Required fields are marked *

Category

  • Article (49)
  • Uncategorized (214)
  • 게임 소식 (9)
  • 기술 정보 & 테크 소식 (188)
  • 꿀팁정리 & 자기계발 (250)
  • 블로그 (8)
  • 사건 사고 (3)
  • 역사 (11)
  • 이슈 뉴스 정리 (127)
  • 정치 인물 사회 (22)
  • 주식 경제 (102)

Popular Posts

  • 장사의신 애월 파스타집 고양이 기름때 위생 논란
  • 서울 서이초등학교 학부모 갑질 교사 자살 사건
  • 한문철 전직 보디빌더 인천 주차장 폭행사건 가해자는 누구?
  • 코딩하는 공익 반병현 셀프 바이럴 논란
  • 황의조 휴대폰 해킹, 성관계 사진 인스타 유포

©2023 minority opinions | Design: Newspaperly WordPress Theme