I'm looking for a tool that will enumerate the IP addresses that a system is connecting to. This is mainly for forensic purposes, to gather IOCs. I know we can run a netstat on windows, but would like something that is comprehensive and reports all processes (hidden, system, etc.)

closed as unclear what you're asking by forest, Teun Vink, symcbean, Xander, schroeder Apr 24 at 21:41

Please clarify your specific problem or add additional details to highlight exactly what you need. As it's currently written, it’s hard to tell exactly what you're asking. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • 2
    Netstat is not processed-based, it does not matter if a process is hidden. It can list all connections. – Overmind Apr 24 at 6:19
  • What about connections going through a proxy or a NAT, will it list the destination IP or my internal proxy server IP? – Anup Michael Salve Apr 24 at 7:23
  • 1
    It does not matter where they do through as longs as they exist. – Overmind Apr 24 at 7:48
  • 2
    To answer this question, we need more information. What exactly is the situation? Are you working on a RAM-dump? A live system? If so, what operating system? As it stands now, your question is too broad. Please edit your question to add all the relevant information. – MechMK1 Apr 24 at 8:05
  • It will list the addresses that your machine has a connection to, e.g. a proxy. The forwarding of traffic happens in the proxy, not your PC (that would make a proxy pointless). Ultimately if you're in doubt it's comparably cheap to format your machine and start over. – Izmaki Apr 24 at 8:06

In Linux you can use netstat -ptan and if you don't have netstat you can use ss -neopa and if you are connected to a server trough a proxy you will not see the ip address of that server is connected to which process.


For windows use this TCPView, this is a great tool for looking for exactly what you are looking for. If you want to look at the actual content of the traffic, check out Wireshark which allows for you to view the packets.

Happy hunting!

Not the answer you're looking for? Browse other questions tagged or ask your own question.