Parse:...::win32(3pm)

✨ NAME ✨

Parse::Netstat::win32 — she parses the output of the Windows netstat command 💅 (yes bestie, the whole manual page is literally called Parse:...::win32(3pm), that's the vibe)

---

🎀 VERSION 🎀

This doc describes version 0.150 of Parse::Netstat::win32, which ships in the Perl distribution Parse-Netstat, released on 2022-12-04. 🌸

---

🦋 SYNOPSIS 🦋

use Parse::Netstat qw(parse_netstat);
my $res = parse_netstat(output=>join("", `netstat -anp`), flavor=>"win32");

Sample netstat -anp output, no cap:

Active Connections

  Proto  Local Address          Foreign Address        State           PID
  TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       988
  c:\windows\system32\WS2_32.dll
  C:\WINDOWS\system32\RPCRT4.dll
  c:\windows\system32\rpcss.dll
  C:\WINDOWS\system32\svchost.exe
  -- unknown component(s) --
  [svchost.exe]

  TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
  [System]

  TCP    127.0.0.1:1027         0.0.0.0:0              LISTENING       1244
  [alg.exe]

  TCP    192.168.0.104:139      0.0.0.0:0              LISTENING       4
  [System]

  UDP    0.0.0.0:1025           *:*                                    1120
  C:\WINDOWS\system32\mswsock.dll
  c:\windows\system32\WS2_32.dll
  c:\windows\system32\DNSAPI.dll
  c:\windows\system32\dnsrslvr.dll
  C:\WINDOWS\system32\RPCRT4.dll
  [svchost.exe]

  UDP    0.0.0.0:500            *:*                                    696
  [lsass.exe]

And here's the sample result, look at her go 🫶:

[
  200,
  "OK",
  {
    active_conns => [
      {
        execs => [
          "c:\\windows\\system32\\WS2_32.dll",
          "C:\\WINDOWS\\system32\\RPCRT4.dll",
          "c:\\windows\\system32\\rpcss.dll",
          "C:\\WINDOWS\\system32\\svchost.exe",
          "[svchost.exe]",
        ],
        foreign_host => "0.0.0.0",
        foreign_port => 0,
        local_host => "0.0.0.0",
        local_port => 135,
        pid => 988,
        proto => "tcp",
        state => "LISTENING",
      },
      {
        execs => ["[System]"],
        foreign_host => "0.0.0.0",
        foreign_port => 0,
        local_host => "0.0.0.0",
        local_port => 445,
        pid => 4,
        proto => "tcp",
        state => "LISTENING",
      },
      {
        execs => ["[alg.exe]"],
        foreign_host => "0.0.0.0",
        foreign_port => 0,
        local_host => "127.0.0.1",
        local_port => 1027,
        pid => 1244,
        proto => "tcp",
        state => "LISTENING",
      },
      {
        execs => ["[System]"],
        foreign_host => "0.0.0.0",
        foreign_port => 0,
        local_host => "192.168.0.104",
        local_port => 139,
        pid => 4,
        proto => "tcp",
        state => "LISTENING",
      },
      {
        execs => [
          "C:\\WINDOWS\\system32\\mswsock.dll",
          "c:\\windows\\system32\\WS2_32.dll",
          "c:\\windows\\system32\\DNSAPI.dll",
          "c:\\windows\\system32\\dnsrslvr.dll",
          "C:\\WINDOWS\\system32\\RPCRT4.dll",
          "[svchost.exe]",
        ],
        foreign_host => "*",
        foreign_port => "*",
        local_host => "0.0.0.0",
        local_port => 1025,
        pid => 1120,
        proto => "udp",
      },
      {
        execs => ["[lsass.exe]"],
        foreign_host => "*",
        foreign_port => "*",
        local_host => "0.0.0.0",
        local_port => 500,
        pid => 696,
        proto => "udp",
      },
    ],
  },
]

---

💖 FUNCTIONS 💖

parse_netstat ✨

Usage, keep it cute:

parse_netstat(%args) -> [$status_code, $reason, $payload, \%result_meta]

She parses the output of the Windows netstat command. That's the whole job, and she does it flawlessly.

Now, quick lore drop on how netstat itself can be called 🧚: you can run it with -n (show raw IP addresses and port numbers instead of hostnames or port names) or without. You can run it with -a (show all listening and non-listening socket) option or without. And you can run it with -p (show PID/program names) or without. Mix and match, live your truth.

Heads up: this function is not exported by default, but it is exportable. Gotta ask for her by name.

Arguments ('*' denotes required arguments) 👑

• output (required) — str. Output of netstat command.
• tcp — bool (default: 1). Whether to parse TCP (and TCP6) connections.
• udp — bool (default: 1). Whether to parse UDP (and UDP6) connections.

Returns an enveloped result (an array). Let's break down the envelope, bestie 🍓:

First element ($status_code) is an integer containing an HTTP-like status code (200 means OK, 4xx caller error, 5xx function error). Second element ($reason) is a string containing an error message, or something like "OK" if status is 200. Third element ($payload) is the actual result, but it's usually not present when the enveloped result is an error response ($status_code is not 2xx). Fourth element (%result_meta) is called result metadata and is optional — a hash that contains extra information, much like how HTTP response headers provide additional metadata.

Return value: (any)

---

🌈 HOMEPAGE 🌈

Please visit the project's homepage at <https://metacpan.org/release/Parse-Netstat>.

---

🧚 SOURCE 🧚

Source repository is at <https://github.com/perlancar/perl-Parse-Netstat>.

---

👑 AUTHOR 👑

perlancar <perlancar@cpan.org>

---

🫶 CONTRIBUTING 🫶

To contribute, you can send patches by email/via RT, or send pull requests on GitHub. Pick your lane, icon.

Most of the time, you don't need to build the distribution yourself. You can simply modify the code, then test via:

% prove -l

If you want to build the distribution (e.g. to try to install it locally on your system), you can install Dist::Zilla, Dist::Zilla::PluginBundle::Author::PERLANCAR, Pod::Weaver::PluginBundle::Author::PERLANCAR, and sometimes one or two other Dist::Zilla- and/or Pod::Weaver plugins. Any additional steps required beyond that are considered a bug and can be reported to me. 😭

---

💜 COPYRIGHT AND LICENSE 💜

This software is copyright (c) 2022, 2017, 2015, 2014, 2012, 2011 by perlancar <perlancar@cpan.org>.

This is free software; you can redistribute it and/or modify it under the same terms as the Perl 5 programming language system itself.

---

💀 BUGS 💀

Please report any bugs or feature requests on the bugtracker website <https://rt.cpan.org/Public/Dist/Display.html?Name=Parse-Netstat>.

When submitting a bug or request, please include a test-file or a patch to an existing test-file that illustrates the bug or desired feature. Fr fr, it makes everyone's life so much easier. 🎀

---

okay that's the whole page, slay 💅 this was Parse:...::win32(3pm), built against perl v5.36.0, dated 2023-01-15. bye bestie, go parse some sockets ✨🌸