Skip to content

Instantly share code, notes, and snippets.

@cheynewallace
Last active March 31, 2024 18:53
Show Gist options
  • Star 10 You must be signed in to star a gist
  • Fork 2 You must be signed in to fork a gist
  • Save cheynewallace/5971686 to your computer and use it in GitHub Desktop.
Save cheynewallace/5971686 to your computer and use it in GitHub Desktop.
C# Get Active Ports and Associated Process Names. This code will parse the output from a "netstat -a -n -o" and retrieve a list of active listening ports, along with the associated PID. The PID is then resolved to a process name so we can see exactly which port is attached to which process.
// ===============================================
// The Method That Parses The NetStat Output
// And Returns A List Of Port Objects
// ===============================================
public static List<Port> GetNetStatPorts()
{
var Ports = new List<Port>();
try {
using (Process p = new Process()) {
ProcessStartInfo ps = new ProcessStartInfo();
ps.Arguments = "-a -n -o";
ps.FileName = "netstat.exe";
ps.UseShellExecute = false;
ps.WindowStyle = ProcessWindowStyle.Hidden;
ps.RedirectStandardInput = true;
ps.RedirectStandardOutput = true;
ps.RedirectStandardError = true;
p.StartInfo = ps;
p.Start();
StreamReader stdOutput = p.StandardOutput;
StreamReader stdError = p.StandardError;
string content = stdOutput.ReadToEnd() + stdError.ReadToEnd();
string exitStatus = p.ExitCode.ToString();
if (exitStatus != "0") {
// Command Errored. Handle Here If Need Be
}
//Get The Rows
string[] rows = Regex.Split(content, "\r\n");
foreach (string row in rows) {
//Split it baby
string[] tokens = Regex.Split(row, "\\s+");
if (tokens.Length > 4 && (tokens[1].Equals("UDP") || tokens[1].Equals("TCP"))) {
string localAddress = Regex.Replace(tokens[2], @"\[(.*?)\]", "1.1.1.1");
Ports.Add(new Port {
protocol = localAddress.Contains("1.1.1.1") ? String.Format("{0}v6",tokens[1]) : String.Format("{0}v4",tokens[1]),
port_number = localAddress.Split(':')[1],
process_name = tokens[1] == "UDP" ? LookupProcess(Convert.ToInt16(tokens[4])) : LookupProcess(Convert.ToInt16(tokens[5]))
});
}
}
}
}
catch (Exception ex)
{
Console.WriteLine(ex.Message)
}
return Ports;
}
public static string LookupProcess(int pid)
{
string procName;
try { procName = Process.GetProcessById(pid).ProcessName; }
catch (Exception) { procName = "-";}
return procName;
}
// ===============================================
// The Port Class We're Going To Create A List Of
// ===============================================
public class Port
{
public string name
{
get
{
return string.Format("{0} ({1} port {2})",this.process_name, this.protocol, this.port_number);
}
set { }
}
public string port_number { get; set; }
public string process_name { get; set; }
public string protocol { get; set; }
}
@conductor111
Copy link

It's not a good idea to use GetProcessById (line 60) for each process because this will cause high CPU usage. GetProcessById requests a complete slice of the system processes each time. It is better to call GetProcesses once (f.e. before foreach, line 36) and query the process characteristics from the resulting collection.

@RedWingBB
Copy link

Thanks for the article
I found this on a lucky search - c# example lists all listeners and the process, no netstat call
https://code.msdn.microsoft.com/windowsdesktop/C-Sample-to-list-all-the-4817b58f

@asheroto
Copy link

@RedWingBB you don't happen to have a copy of that code, do ya? Link is dead...

@magnusjjj
Copy link

A process number can be higher than int16 :).

Is there a license for this gist?

@cheynewallace
Copy link
Author

Sorry guys, I wrote this code about a decade ago or more. I havn't written any C# since back around then so do with it as you will.
There's no license here, use it, modify it, if it helps you out, do what you want with it.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment