查看指定进程的网络连接状态（tcpvcon.exe）
有一段时间没来论坛了，抱歉，今天为大家送上一个查看指定进程的网络连接（tcp/ucp）状态的命令行工具（tcpvcon.exe）。具体帮助如下：[quote]TCPView v2.52 - TCP/UDP endpoint viewer
Copyright (C) 1998-2007 Mark Russinovich
Sysinternals - [url=http://www.sysinternals.com/]www.sysinternals.com[/url]
Usage: tcpvcon [-a] [-c] [-n] [process name or PID]
-a Show all endpoints (default is to show established TCP
connections).
-c Print output as CSV.
-n Don't resolve addressed.
process Only show endpoints owned by the process specified.[/quote]
简单的介绍一下用法：
1、不加任何参数运行，显示当前已经于外界建立的tcp连接的进程名，进程ID，连接状态，本地主机名或IP及端口或服务名，远程主机域名或IP及端口或服务名，以清单显示输出：
[quote][TCP] QQ.exe
PID: 1244
State: CLOSE_WAIT
Local: ingle-520:1067
Remote: 219.133.63.142:https
[TCP] googletalk.exe
PID: 1408
State: ESTABLISHED
Local: ingle-520:1044
Remote: tw-in-f125.google.com:5222
[TCP] SecureCRT.EXE
PID: 3480
State: ESTABLISHED
Local: ingle-520:1683
Remote: 212.91.135.228:ssh
[TCP] QQ.exe
PID: 1244
State: CLOSE_WAIT
Local: ingle-520:2009
Remote: 219.133.63.142:https[/quote]
2、参数-a指定显示当前所有的tcp及ucp连接，其中星号表示未知的值。
3、参数-n指定不进行地址转换，主机及服务名全部采用数字的形式显示。
4、参数-c指定以逗号分隔各个值的形式进行输出，这样有利于在批处理脚本里面进行分析解析数据。
5、最后还可以接上进程名或者进程ID号，以显示指定进程的网络连接状态。
下面是综合上面几个参数的例子：[quote]
# > tcpvcon.exe -c -n qq.exe
TCPView v2.52 - TCP/UDP endpoint viewer
Copyright (C) 1998-2007 Mark Russinovich
Sysinternals - [url=http://www.sysinternals.com/]www.sysinternals.com[/url]
TCP,QQ.exe,1244,CLOSE_WAIT,212.91.135.43:1532,219.133.60.243:8000
TCP,QQ.exe,1244,CLOSE_WAIT,212.91.135.43:1067,219.133.63.142:443
TCP,QQ.exe,1244,CLOSE_WAIT,212.91.135.43:2009,219.133.63.142:443
TCP,QQ.exe,1244,CLOSE_WAIT,212.91.135.43:1975,219.133.63.142:443
# >[/quote]
[url]http://bcn.bathome.net/s/tool/index.html?key=tcpvcon[/url]
页:
[1]