Kenneth G. Hartman bio photo

Kenneth G. Hartman

Security Consultant,  
Forensic Analyst & 
Certified SANS Instructor

Email Twitter GitHub

Several years ago, I created a PowerShell script to create a log of outbound connections. What if you need something quick and dirty and cannot use a script like that or external tools like Process Explorer, etc?

Here is a batch script that runs in an infinite loop and catches changes to the output of netstat:

#netstat-changes.bat
#Capture changes to a netstat output
netstat -naob > old.txt
:loop
netstat -naob > new.txt
fc old.txt new.txt >> change.txt
copy /y new.txt old.txt
goto loop

The output is certainly not pretty, but it gets the job done.