Understand your Network – Simplifying Netstat with the Network Top Processes Program!
In this post, we discover network secrets with netstat, and provide you with a powerful Netstat Network Connection Program that refines its abilities to identify the active network connections that are most utilized.
Just in case you missed it, we’ve covered netstat in our Networking Forensics Basics post and included it in our Basic Network Commands Reference Guide.
Understanding established connections on your network can lead towards creating reliable and efficient network infrastructure. Netstat provides the ability to display a list of all the current network connections on your computer, both incoming and outgoing, while including the following information:
Local Address |
Local end of the connection (IP address and port number). |
Foreign Address |
Remote end of the connection, so what you are connecting to (IP address and port number). |
Protocol |
Displaying the communication protocol being used for each connection. Examples: TCP (Transmission Control Protocol) UDP (User Datagram Protocol). |
State |
It shows the current state of each connection, such as: ESTABLISHED (actively exchanging data) LISTENING (waiting for incoming connections) TIME_WAIT (waiting for the connection to fully close). |
However, running netstat can provide overwhelming information. By understanding the top processes running on your network, you can significantly enhance your ability to effectively monitor and manage network connections. And that is exactly why we’ve scripted a program to make it happen!
Network Top Processes Program will do the following:
- Summarize the top 10 network processes.
- Provide a count of the top active connections.
- Show detailed information about each process, including the PID, local address, remote address, and connection status.
- Display a graphical representation of the connection counts.
How does the Network Top Processes Program run?
Below are the steps the program takes to execute:
Step 1 | import psutil: Process and System Utilities library to gather information about established network connections, the status of the connection and their associated processes. |
Step 2 | import matplotlib.pyplot as plt: matplotlib imported to create the bar chart graph. |
Step 3 | from tabulate import tabulate: Tabulate library, which helps to format and display tabular data neatly. |
Step 4 | The function ‘get_top_processes_with_connections_info()’ is defined to gather and display information about the top processes with the most network connections. |
Step 5 | psutil.net_connections(kind=’inet’) + psutil.net_connections(kind=’inet6′) – gets the internet connections on the computer, both for IPv4 and IPv6. |
Step 6 |
process_connections: This dictionary creates a key, value pair for process names and number of collections. Key = process names and Value = number of collections |
Step 7 |
Iterating through ‘connections’: The code loops through each network connection and checks if the connection status is “ESTABLISHED.” If it is established, it retrieves the process name associated with that connection using the `psutil.Process(pid).name()` function and updates the `process_connections` dictionary to count the number of connections for each process. |
Step 8 | Sorting the processes: The dictionary ‘process_connections’ is then sorted in descending order based on the number of connections each process has, creating a list of tuples called `sorted_processes`. |
Step 9 | Displaying the top processes: The code prints a table using the `tabulate` library, showing the top 10 processes with the most connections. The table has two columns: “Process” (the name of the process) and “Connections” (the number of connections it has). |
Step 10 |
Getting detailed connection information: For each of the top processes, the code prints a more detailed table that shows: PID – Process ID LADDR – local address with its port RADDR – remote address with its port STATUS – connection status |
Step 11 | Creating a bar chart: The bar chart represents the top processes and the number of connections they have. |
Step 12 | ‘if __name__ == “__main__’: This block of code ensures that the `get_top_processes_with_connections_info()` function is called only when the program is run as the main script. |
By running this script, you can gain valuable insights into your network’s top processes and connections. It allows you to monitor network performance, identify resource-intensive processes, detect unusual network activity, and optimize network usage.
Run the program and let us know what you think!