tcp

TCP connections of a Windows, by SSH

Returns the TCP connections of a Windows, IPv4 and IPv6 together: those established, those waiting to be closed on either side (TIME-WAIT, CLOSE-WAIT), the listening ports and the total. Three watches are proposed, all unchecked: what is normal depends on the role of the server.

How it works

The collector runs one PowerShell command that reads Get-NetTCPConnection (the CIM class MSFT_NetTCPConnection) and counts the connections by state on the target:

powershell -NoProfile -NonInteractive -Command "ConvertTo-Json -Compress -InputObject @(Get-NetTCPConnection | Group-Object State -NoElement | Select-Object Name, Count)"

• Get-NetTCPConnection, of the module NetTCPIP, ships with every Windows from Server 2012 and Windows 8 on.
• One object per state present: its name, in English whatever the language of Windows (Established, TimeWait, CloseWait, Listen…), and its number of connections.
• The counting happens on the target, so that a server with a hundred thousand connections returns a few lines.
• The total counts every state, Bound and the states of opening and closing included.
• Nothing is skipped at the first run: they are counts, not counters.
• No connection at all stops the collector as misconfigured: the collector's own SSH connection is one, and reading none is reading nothing. So does an answer that is not the expected JSON.

Nothing is written to the Windows: the command only reads.

Prerequisites

• The OpenSSH server of Windows, installed and started: - on Windows Server 2019 and later, Windows 10 (version 1809 and later) and Windows 11, where it is built in: the optional feature "OpenSSH Server" (Settings, Optional features; or Add-WindowsCapability -Online -Name OpenSSH.Server~~~~0.0.1.0 in PowerShell), then the service sshd started and set to start automatically; - on Windows Server 2012, 2012 R2 and 2016, Windows 8, 8.1 and the earlier Windows 10, where it is not built in: OpenSSH for Windows installed from its Microsoft release (Win32-OpenSSH), then the service sshd started and set to start automatically.
• The default shell of the OpenSSH server left at cmd.exe, as it is installed: the collector starts PowerShell itself, and a command meant for cmd.exe would be read differently by a PowerShell default shell.
• Windows PowerShell 3.0 or later, as shipped with every Windows from Server 2012 and Windows 8 on (3.0 on Server 2012, 4.0 on 2012 R2, 5.1 from 2016 on).
• An account for monitoring, without administrator rights, member of the local groups "Performance Monitor Users" and "Event Log Readers", so that the performance counters and the System log are not refused to it. banshee reads it in protocol:ssh:user, with its password in protocol:ssh:password or its key in protocol:ssh:private-key (the public key then in C:\Users\<account>.ssh\authorized_keys).
• The fingerprint of the server's host key, set in protocol:ssh:fingerprint (on the server, C:\ProgramData\ssh\ssh_host_ed25519_key.pub); not needed when the Security settings trust the first SSH fingerprint presented.
• The Windows firewall open to the poller on TCP 22 (the rule "OpenSSH SSH Server (sshd)", created with the feature).

Outputs

Watches

"Unusual number of connections" needs the history of the measure: until the poller has learnt it, the watch says it is learning and raises nothing. CLOSE-WAIT piling up says an application does not close its connections.

Limits

• The count is a moment, read once per run: a burst of short connections between two runs is not seen.
• Connections are not told apart by port nor by address.
• Not yet checked on a real Windows: how long Get-NetTCPConnection takes on a server with many connections.