Any chance on windows server to see how long TCP port in use?

Question

We have some troubles with tons of TPC ports, hanging in TIME_WAIT status on several windows machines. Reboot solves this problem, but I'm just interested in one more thing. Is there any way to know on windows OS, when TCP port was open or how many days it is in current status? Default -netstat is not showing any interesting info.

Answer 1

In Windows PowerShell (but not PowerShell Core ), on Windows 8.1 / Windows Server 2012 R2 or above you can find out when a TCP connection was created .

^{Note : The Get-NetTCPConnection cmdlet first became available in Windows 8 / Windows Server 2012, but creation-time functionality only appears in the 8.1 / 2012R2 docs. The OP reports that even on 2012R2 it doesn't work , however. Do tell us if you know more.}

The following command shows all TCP connections in state TimeWait ( TIME_WAIT ), in ascending chronological order (oldest one first):

Get-NetTCPConnection -State TimeWait | Sort-Object CreationTime | 
  Format-Table Local*, Remote*, State, CreationTime

If you want to see the results by time span (how long ago they were created):

Get-NetTCPConnection -State TimeWait | Sort-Object CreationTime | 
  Format-Table Local*, Remote*, State, 
               @{ n='Created Ago'; e = { [datetime]::Now - $_.CreationTime } }

^{Note: Use Select-Object instead of Format-Table if you want to process the results programmatically . Format-* cmdlets are only for display .}

However, that won't tell you how long the connections have been in a given state .