banshee/windows-collection/windows/snmp/
tcp
The number of established TCP connections of a Windows, by SNMP
by banshee1 installation2 versions
v2Latest
Published on October 28, 2026. One naming convention across collections; documentation completed.
TCP connections of a Windows, by SNMP
Returns the number of established TCP connections of a Windows. Two watches are proposed, both unchecked: what is normal depends on the role of the server.
Versions
Generic: written for the SNMP agent of Windows, the feature "SNMP Service" of Windows Server or the optional feature of Windows 10 and 11, and for TCP-MIB, which it serves. That every release of Windows serves it alike is assumed, not yet checked on a real Windows.
How it works
The collector reads tcpCurrEstab (1.3.6.1.2.1.6.9.0, TCP-MIB): the number of TCP connections in the state ESTABLISHED or CLOSE-WAIT, at the moment of the read.
- Nothing is skipped at the first run: it is a count, not a counter.
Nothing is written to the Windows: SNMP reads only.
Prerequisites
- The SNMP service of Windows, installed and started: - on Windows Server, the feature "SNMP Service" (Server Manager, Add Roles and Features; or
Install-WindowsFeature SNMP-Servicein PowerShell); - on Windows 10 and 11, the optional feature "Simple Network Management Protocol (SNMP)" (Settings, Optional features; orAdd-WindowsCapability -Online -Name SNMP.Client~~~~0.0.1.0in PowerShell). - In the properties of the service "SNMP Service", tab Security: - a community with the right READ ONLY, which banshee reads in
protocol:snmp:v2c:community; - under "Accept SNMP packets from these hosts", the address of the poller. - SNMPv3: the SNMP agent of Windows does not offer it;
protocol:snmp:versionstaysv2c. The community then travels in clear text: keep it read-only and accepted from the poller alone. - The Windows firewall open to the poller on UDP 161 (the rule "SNMP Service (UDP In)").
Outputs
| Name | Label | Unit | Per instance |
|---|---|---|---|
established | Established TCP connections | — | no |
Watches
| Name | Title | Kind | Defaults | Checked by default |
|---|---|---|---|---|
too-many | Too many TCP connections | above a threshold, on established | no threshold: to set on the probe | no |
unusual | Unusual number of connections | off its habit, on established | normal sensitivity, no floor | no |
"Unusual number of connections" needs the history of the measure: until the poller has learnt it, the watch says it is learning and raises nothing.
Limits
- The count is a moment, read once per run: a burst of short connections between two runs is not seen.
- Connections are not told apart by port nor by address: the agent's connection table is not read.
- A connection in CLOSE-WAIT is counted as established: many of them point to an application that does not close its connections.