{"id":353682,"date":"2024-09-20T22:47:09","date_gmt":"2024-09-20T22:47:09","guid":{"rendered":"https:\/\/www.ninjaone.com\/script-hub\/surveiller-les-connexions-tcp-et-udp\/"},"modified":"2024-10-13T19:02:48","modified_gmt":"2024-10-13T19:02:48","slug":"surveiller-les-connexions-tcp-et-udp","status":"publish","type":"script_hub","link":"https:\/\/www.ninjaone.com\/fr\/script-hub\/surveiller-les-connexions-tcp-et-udp\/","title":{"rendered":"Comment surveiller les connexions TCP et UDP sur Windows \u00e0 l’aide de PowerShell"},"content":{"rendered":"

Dans le monde en constante \u00e9volution de la s\u00e9curit\u00e9 informatique, il est primordial de maintenir une visibilit\u00e9 sur les connexions r\u00e9seau. Que vous g\u00e9riez un r\u00e9seau de grande entreprise ou que vous supervisiez une PME, il est essentiel de savoir quelles adresses IP<\/a> communiquent activement avec vos syst\u00e8mes.<\/p>\n

Cet article de blog pr\u00e9sente un script PowerShell<\/a> sp\u00e9cialement con\u00e7u pour alerter les administrateurs sur des adresses IP sp\u00e9cifiques qui sont soit en \u00e9coute, soit dans un certain \u00e9tat. Cet outil est inestimable pour les professionnels de l’informatique, les fournisseurs de services g\u00e9r\u00e9s (MSP)<\/a> et les \u00e9quipes de s\u00e9curit\u00e9 qui souhaitent renforcer leurs capacit\u00e9s de surveillance du r\u00e9seau. Le contenu suivant explique comment surveiller les connexions TCP et UDP sur Windows \u00e0 l’aide de PowerShell<\/strong>.<\/span><\/span><\/p>\n

Comprendre le script PowerShell<\/h2>\n

Le script fourni sert de m\u00e9canisme d’alerte pour les connexions r\u00e9seau, en identifiant les adresses IP sp\u00e9cifi\u00e9es en \u00e9tat Listening ou Established. Il va au-del\u00e0 des contr\u00f4les de pare-feu de base, en fournissant des informations sur les connexions actives qui peuvent contourner les filtres de s\u00e9curit\u00e9 traditionnels. Le script fournit des informations essentielles telles que l’adresse, l’ID du processus, l’\u00e9tat, le protocole, l’adresse locale et le nom du processus. Pour ceux qui utilisent NinjaOne, les r\u00e9sultats peuvent \u00eatre automatiquement enregistr\u00e9s dans un champ personnalis\u00e9 pour une analyse ult\u00e9rieure.<\/p>\n

Importance pour les professionnels de l’informatique et les MSP<\/h2>\n

Dans l’environnement num\u00e9rique actuel, o\u00f9 les cybermenaces sont omnipr\u00e9sentes, il est essentiel de disposer d’un contr\u00f4le pr\u00e9cis sur les connexions r\u00e9seau. Ce script r\u00e9pond \u00e0 la n\u00e9cessit\u00e9 de surveiller en temps r\u00e9el les activit\u00e9s du r\u00e9seau, ce qui permet aux professionnels de l’informatique de r\u00e9agir rapidement aux menaces potentielles pour la s\u00e9curit\u00e9. Pour les MSP qui g\u00e8rent plusieurs r\u00e9seaux de clients, ce script offre une m\u00e9thode standardis\u00e9e de surveillance et de reporting de l’activit\u00e9 du r\u00e9seau, garantissant un contr\u00f4le constant et approfondi.<\/p>\n

Le script\u00a0:<\/h2>\n
#Requires -Version 5.1\r\n\r\n<#\r\n.SYNOPSIS\r\n    Alert on specified addresses that are Listening or Established and optionally save the results to a custom field.\r\n.DESCRIPTION\r\n    Will alert on addresses, regardless if a firewall is blocking them or not.\r\n    Checks for addresses that are in a 'Listen' or 'Established' state.\r\n    UDP is a stateless protocol and will not have a state.\r\n    Outputs the addresses, process ID, state, protocol, local address, and process name.\r\n    When a Custom Field is provided this will save the results to that custom field.\r\n\r\nPARAMETER: -IpAddress \"192.168.11.1, 192.168.1.1\/24\"\r\n    A comma separated list of IP Addresses to check. Can include IPv4 CIDR notation for ranges. IPv6 CIDR notation not supported. (e.g. 192.168.1.0\/24, 10.0.10.12)\r\n.EXAMPLE\r\n    -IpAddress \"192.168.1.0\/24, 10.0.10.12\"\r\n    ## EXAMPLE OUTPUT WITH IpAddress ##\r\n    [Info] Valid IP Address: 192.168.11.1\r\n    [Info] Valid IP Network: 192.168.1.1\/24\r\n    [Alert] Found Local Address: 192.168.1.18, Local Port: 139, Remote Address: 0.0.0.0, Remote Port: None, PID: 4, Protocol: TCP, State: Listen, Process: System\r\n    [Alert] Found Local Address: 192.168.1.18, Local Port: 138, Remote Address: None, Remote Port: None, PID: 4, Protocol: UDP, State: None, Process: System\r\n    [Alert] Found Local Address: 192.168.1.18, Local Port: 137, Remote Address: None, Remote Port: None, PID: 4, Protocol: UDP, State: None, Process: System\r\n\r\nPARAMETER: -CustomField \"ReplaceMeWithAnyMultilineCustomField\"\r\n    Name of the custom field to save the results to.\r\n.EXAMPLE\r\n    -IpAddress \"192.168.11.1, 192.168.1.1\/24\" -CustomField \"ReplaceMeWithAnyMultilineCustomField\"\r\n    ## EXAMPLE OUTPUT WITH CustomField ##\r\n    [Info] Valid IP Address: 192.168.11.1\r\n    [Info] Valid IP Network: 192.168.1.1\/24\r\n    [Alert] Found Local Address: 192.168.1.18, Local Port: 139, Remote Address: 0.0.0.0, Remote Port: None, PID: 4, Protocol: TCP, State: Listen, Process: System\r\n    [Alert] Found Local Address: 192.168.1.18, Local Port: 138, Remote Address: None, Remote Port: None, PID: 4, Protocol: UDP, State: None, Process: System\r\n    [Alert] Found Local Address: 192.168.1.18, Local Port: 137, Remote Address: None, Remote Port: None, PID: 4, Protocol: UDP, State: None, Process: System\r\n    \r\n    [Info] Saving results to custom field: ReplaceMeWithAnyMultilineCustomField\r\n    [Info] Results saved to custom field: ReplaceMeWithAnyMultilineCustomField\r\n.OUTPUTS\r\n    None\r\n.NOTES\r\n    Supported Operating Systems: Windows 10\/Windows Server 2016 or later with PowerShell 5.1\r\n    Release Notes: Initial Release\r\nBy using this script, you indicate your acceptance of the following legal terms as well as our Terms of Use at https:\/\/www.ninjaone.com\/terms-of-use.\r\n    Ownership Rights: NinjaOne owns and will continue to own all right, title, and interest in and to the script (including the copyright). NinjaOne is giving you a limited license to use the script in accordance with these legal terms. \r\n    Use Limitation: You may only use the script for your legitimate personal or internal business purposes, and you may not share the script with another party. \r\n    Republication Prohibition: Under no circumstances are you permitted to re-publish the script in any script library or website belonging to or under the control of any other software provider. \r\n    Warranty Disclaimer: The script is provided \u201cas is\u201d and \u201cas available\u201d, without warranty of any kind. NinjaOne makes no promise or guarantee that the script will be free from defects or that it will meet your specific needs or expectations. \r\n    Assumption of Risk: Your use of the script is at your own risk. You acknowledge that there are certain inherent risks in using the script, and you understand and assume each of those risks. \r\n    Waiver and Release: You will not hold NinjaOne responsible for any adverse or unintended consequences resulting from your use of the script, and you waive any legal or equitable rights or remedies you may have against NinjaOne relating to your use of the script. \r\n    EULA: If you are a NinjaOne customer, your use of the script is subject to the End User License Agreement applicable to you (EULA).\r\n#>\r\n\r\n[CmdletBinding()]\r\nparam (\r\n    [Parameter()]\r\n    [String]$IpAddress,\r\n    [String]$CustomFieldName\r\n)\r\n\r\nbegin {\r\n    function Test-IsElevated {\r\n        $id = [System.Security.Principal.WindowsIdentity]::GetCurrent()\r\n        $p = New-Object System.Security.Principal.WindowsPrincipal($id)\r\n        $p.IsInRole([System.Security.Principal.WindowsBuiltInRole]::Administrator)\r\n    }\r\n    function Set-NinjaProperty {\r\n        [CmdletBinding()]\r\n        Param(\r\n            [Parameter(Mandatory = $True)]\r\n            [String]$Name,\r\n            [Parameter()]\r\n            [String]$Type,\r\n            [Parameter(Mandatory = $True, ValueFromPipeline = $True)]\r\n            $Value,\r\n            [Parameter()]\r\n            [String]$DocumentName\r\n        )\r\n    \r\n        $Characters = $Value | Measure-Object -Character | Select-Object -ExpandProperty Characters\r\n        if ($Characters -ge 10000) {\r\n            throw [System.ArgumentOutOfRangeException]::New(\"Character limit exceeded, value is greater than 10,000 characters.\")\r\n        }\r\n        \r\n        # If we're requested to set the field value for a Ninja document we'll specify it here.\r\n        $DocumentationParams = @{}\r\n        if ($DocumentName) { $DocumentationParams[\"DocumentName\"] = $DocumentName }\r\n        \r\n        # This is a list of valid fields that can be set. If no type is given, it will be assumed that the input doesn't need to be changed.\r\n        $ValidFields = \"Attachment\", \"Checkbox\", \"Date\", \"Date or Date Time\", \"Decimal\", \"Dropdown\", \"Email\", \"Integer\", \"IP Address\", \"MultiLine\", \"MultiSelect\", \"Phone\", \"Secure\", \"Text\", \"Time\", \"URL\", \"WYSIWYG\"\r\n        if ($Type -and $ValidFields -notcontains $Type) { Write-Warning \"$Type is an invalid type! Please check here for valid types. https:\/\/ninjarmm.zendesk.com\/hc\/en-us\/articles\/16973443979789-Command-Line-Interface-CLI-Supported-Fields-and-Functionality\" }\r\n        \r\n        # The field below requires additional information to be set\r\n        $NeedsOptions = \"Dropdown\"\r\n        if ($DocumentName) {\r\n            if ($NeedsOptions -contains $Type) {\r\n                # We'll redirect the error output to the success stream to make it easier to error out if nothing was found or something else went wrong.\r\n                $NinjaPropertyOptions = Ninja-Property-Docs-Options -AttributeName $Name @DocumentationParams 2>&1\r\n            }\r\n        }\r\n        else {\r\n            if ($NeedsOptions -contains $Type) {\r\n                $NinjaPropertyOptions = Ninja-Property-Options -Name $Name 2>&1\r\n            }\r\n        }\r\n        \r\n        # If an error is received it will have an exception property, the function will exit with that error information.\r\n        if ($NinjaPropertyOptions.Exception) { throw $NinjaPropertyOptions }\r\n        \r\n        # The below type's require values not typically given in order to be set. The below code will convert whatever we're given into a format ninjarmm-cli supports.\r\n        switch ($Type) {\r\n            \"Checkbox\" {\r\n                # While it's highly likely we were given a value like \"True\" or a boolean datatype it's better to be safe than sorry.\r\n                $NinjaValue = [System.Convert]::ToBoolean($Value)\r\n            }\r\n            \"Date or Date Time\" {\r\n                # Ninjarmm-cli expects the  Date-Time to be in Unix Epoch time so we'll convert it here.\r\n                $Date = (Get-Date $Value).ToUniversalTime()\r\n                $TimeSpan = New-TimeSpan (Get-Date \"1970-01-01 00:00:00\") $Date\r\n                $NinjaValue = $TimeSpan.TotalSeconds\r\n            }\r\n            \"Dropdown\" {\r\n                # Ninjarmm-cli is expecting the guid of the option we're trying to select. So we'll match up the value we were given with a guid.\r\n                $Options = $NinjaPropertyOptions -replace '=', ',' | ConvertFrom-Csv -Header \"GUID\", \"Name\"\r\n                $Selection = $Options | Where-Object { $_.Name -eq $Value } | Select-Object -ExpandProperty GUID\r\n        \r\n                if (-not $Selection) {\r\n                    throw [System.ArgumentOutOfRangeException]::New(\"Value is not present in dropdown\")\r\n                }\r\n        \r\n                $NinjaValue = $Selection\r\n            }\r\n            default {\r\n                # All the other types shouldn't require additional work on the input.\r\n                $NinjaValue = $Value\r\n            }\r\n        }\r\n        \r\n        # We'll need to set the field differently depending on if its a field in a Ninja Document or not.\r\n        if ($DocumentName) {\r\n            $CustomField = Ninja-Property-Docs-Set -AttributeName $Name -AttributeValue $NinjaValue @DocumentationParams 2>&1\r\n        }\r\n        else {\r\n            $CustomField = $NinjaValue | Ninja-Property-Set-Piped -Name $Name 2>&1\r\n        }\r\n        \r\n        if ($CustomField.Exception) {\r\n            throw $CustomField\r\n        }\r\n    }\r\n    function Test-IPNetwork {\r\n        param([string]$Text)\r\n        $Ip, $Prefix = $Text -split '\/'\r\n        $Ip -as [System.Net.IPAddress] -and\r\n        $Prefix -as [int] -and $Prefix -ge 0 -and $Prefix -le 32\r\n    }\r\n    function Get-IPNetwork {\r\n        [CmdletBinding()]\r\n    \r\n        Param(\r\n            [Parameter(Mandatory, Position = 0)]\r\n            [ValidateScript({ $_ -eq ([IPAddress]$_).IPAddressToString })]\r\n            [string]$IPAddress,\r\n    \r\n            [Parameter(Mandatory, Position = 1, ParameterSetName = \"SubnetMask\")]\r\n            [ValidateScript({ $_ -eq ([IPAddress]$_).IPAddressToString })]\r\n            [ValidateScript({\r\n                    $SMReversed = [IPAddress]$_\r\n                    $SMReversed = $SMReversed.GetAddressBytes()\r\n                    [array]::Reverse($SMReversed)\r\n                    [IPAddress]$SMReversed = $SMReversed\r\n                    [convert]::ToString($SMReversed.Address, 2) -match \"^[1]*0{0,}$\"\r\n                })]\r\n            [string]$SubnetMask,\r\n    \r\n            [Parameter(Mandatory, Position = 1, ParameterSetName = \"CIDRNotation\")]\r\n            [ValidateRange(0, 32)]\r\n            [int]$PrefixLength,\r\n    \r\n            [switch]$ReturnAllIPs\r\n        )\r\n    \r\n        [IPAddress]$IPAddress = $IPAddress\r\n    \r\n        if ($SubnetMask) {\r\n            [IPAddress]$SubnetMask = $SubnetMask\r\n            $SMReversed = $SubnetMask.GetAddressBytes()\r\n            [array]::Reverse($SMReversed)\r\n            [IPAddress]$SMReversed = $SMReversed\r\n    \r\n            [int]$PrefixLength = [convert]::ToString($SMReversed.Address, 2).replace(0, '').length\r\n        } \r\n        else {\r\n            [IPAddress]$SubnetMask = ([Math]::Pow(2, $PrefixLength) - 1) * [Math]::Pow(2, (32 - $PrefixLength))\r\n        }\r\n    \r\n        \r\n        $FullMask = [UInt32]'0xffffffff'\r\n        $WildcardMask = [IPAddress]($SubnetMask.Address -bxor $FullMask)\r\n        $NetworkId = [IPAddress]($IPAddress.Address -band $SubnetMask.Address)\r\n        $Broadcast = [IPAddress](($FullMask - $NetworkId.Address) -bxor $SubnetMask.Address)\r\n    \r\n        # Used for determining first usable IP Address\r\n        $FirstIPByteArray = $NetworkId.GetAddressBytes()\r\n        [Array]::Reverse($FirstIPByteArray)\r\n    \r\n        # Used for determining last usable IP Address\r\n        $LastIPByteArray = $Broadcast.GetAddressBytes()\r\n        [Array]::Reverse($LastIPByteArray)\r\n    \r\n        # Handler for \/31, \/30 CIDR prefix values, and default for all others.\r\n        switch ($PrefixLength) {\r\n            31 {\r\n                $TotalIPs = 2\r\n                $UsableIPs = 2\r\n                $FirstIP = $NetworkId\r\n                $LastIP = $Broadcast\r\n                $FirstIPInt = ([IPAddress]$FirstIPByteArray).Address\r\n                $LastIPInt = ([IPAddress]$LastIPByteArray).Address\r\n                break\r\n            }\r\n    \r\n            32 {\r\n                $TotalIPs = 1\r\n                $UsableIPs = 1\r\n                $FirstIP = $IPAddress\r\n                $LastIP = $IPAddress\r\n                $FirstIPInt = ([IPAddress]$FirstIPByteArray).Address\r\n                $LastIPInt = ([IPAddress]$LastIPByteArray).Address\r\n                break\r\n            }\r\n    \r\n            default {\r\n    \r\n                # Usable Address Space\r\n                $TotalIPs = [Math]::pow(2, (32 - $PrefixLength))\r\n                $UsableIPs = $TotalIPs - 2\r\n    \r\n                # First usable IP\r\n                $FirstIPInt = ([IPAddress]$FirstIPByteArray).Address + 1\r\n                $FirstIP = [IPAddress]$FirstIPInt\r\n                $FirstIP = ($FirstIP).GetAddressBytes()\r\n                [Array]::Reverse($FirstIP)\r\n                $FirstIP = [IPAddress]$FirstIP\r\n    \r\n                # Last usable IP\r\n                $LastIPInt = ([IPAddress]$LastIPByteArray).Address - 1\r\n                $LastIP = [IPAddress]$LastIPInt\r\n                $LastIP = ($LastIP).GetAddressBytes()\r\n                [Array]::Reverse($LastIP)\r\n                $LastIP = [IPAddress]$LastIP\r\n            }\r\n        }\r\n    \r\n        $AllIPs = if ($ReturnAllIPs) {\r\n    \r\n            if ($UsableIPs -ge 500000) {\r\n                Write-Host ('[Warn] Generating an array containing {0:N0} IPs, this may take a little while' -f $UsableIPs)\r\n            }\r\n    \r\n            $CurrentIPInt = $FirstIPInt\r\n    \r\n            Do {\r\n                $IP = [IPAddress]$CurrentIPInt\r\n                $IP = ($IP).GetAddressBytes()\r\n                [Array]::Reverse($IP) | Out-Null\r\n                $IP = ([IPAddress]$IP).IPAddressToString\r\n                $IP\r\n    \r\n                $CurrentIPInt++\r\n    \r\n            } While ($CurrentIPInt -le $LastIPInt)\r\n        }\r\n    \r\n    \r\n        $obj = [PSCustomObject]@{\r\n            NetworkId    = ($NetworkId).IPAddressToString\r\n            Broadcast    = ($Broadcast).IPAddressToString\r\n            SubnetMask   = ($SubnetMask).IPAddressToString\r\n            PrefixLength = $PrefixLength\r\n            WildcardMask = ($WildcardMask).IPAddressToString\r\n            FirstIP      = ($FirstIP).IPAddressToString\r\n            LastIP       = ($LastIP).IPAddressToString\r\n            TotalIPs     = $TotalIPs\r\n            UsableIPs    = $UsableIPs\r\n            AllIPs       = $AllIPs\r\n        }\r\n    \r\n        Write-Output $obj\r\n    }\r\n}\r\nprocess {\r\n    if (-not (Test-IsElevated)) {\r\n        Write-Error -Message \"Access Denied. Please run with Administrator privileges.\"\r\n        exit 1\r\n    }\r\n    if ($env:ipAddress -and $env:ipAddress -ne 'null') {\r\n        $IpAddress = $env:ipAddress\r\n    }\r\n    if ($env:customFieldName -and $env:customFieldName -ne 'null') {\r\n        $CustomFieldName = $env:customFieldName\r\n    }\r\n\r\n    # Parse the Addresses to check\r\n    $Addresses = if ($IpAddress) {\r\n        # Validate the IP Address\r\n        $IpAddress -split ',' | ForEach-Object {\r\n            \"$_\".Trim()\r\n        } | ForEach-Object {\r\n            if (($_ -as [System.Net.IPAddress])) {\r\n                Write-Host \"[Info] Valid IP Address: $_\"\r\n                [System.Net.IPAddress]::Parse($_)\r\n            }\r\n            elseif ($(Test-IPNetwork $_)) {\r\n                Write-Host \"[Info] Valid IP Network: $_\"\r\n                $Address, $PrefixLength = $_ -split '\/'\r\n                try {\r\n                    Get-IPNetwork -IPAddress $Address -PrefixLength $PrefixLength -ReturnAllIPs | Select-Object -ExpandProperty AllIPs\r\n                }\r\n                catch {\r\n                    Write-Host \"[Error] Invalid IP CIDR: $_\"\r\n                    exit 1\r\n                }\r\n            }\r\n            else {\r\n                Write-Host \"[Error] Invalid IP Address: $_\"\r\n                exit 1\r\n            }\r\n        }\r\n    }\r\n    else { $null }\r\n\r\n    # Get the open ports\r\n    $FoundAddresses = $(\r\n        Get-NetTCPConnection | Select-Object @(\r\n            'LocalAddress'\r\n            'LocalPort'\r\n            @{Name = \"RemoteAddress\"; Expression = { if ($_.RemoteAddress) { $_.RemoteAddress }else { \"None\" } } }\r\n            @{Name = \"RemotePort\"; Expression = { if ($_.RemotePort) { $_.RemotePort }else { \"None\" } } }\r\n            'State'\r\n            @{Name = \"Protocol\"; Expression = { \"TCP\" } }\r\n            'OwningProcess'\r\n            @{Name = \"Process\"; Expression = { (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName } }\r\n        )\r\n        Get-NetUDPEndpoint | Select-Object @(\r\n            'LocalAddress'\r\n            'LocalPort'\r\n            @{Name = \"RemoteAddress\"; Expression = { \"None\" } }\r\n            @{Name = \"RemotePort\"; Expression = { \"None\" } }\r\n            @{Name = \"State\"; Expression = { \"None\" } }\r\n            @{Name = \"Protocol\"; Expression = { \"UDP\" } }\r\n            'OwningProcess'\r\n            @{Name = \"Process\"; Expression = { (Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue).ProcessName } }\r\n        )\r\n    ) | Where-Object {\r\n        $(\r\n            <# When Addresses are specified select just those addresses. #>\r\n            if ($Addresses) {\r\n                $_.LocalAddress -in $Addresses -or\r\n                $_.RemoteAddress -in $Addresses\r\n            }\r\n            else { $true }\r\n        ) -and\r\n        (\r\n            <# Filter out anything that isn't listening or established. #>\r\n            $(\r\n                $_.Protocol -eq \"TCP\" -and\r\n                $(\r\n                    $_.State -eq \"Listen\" -or\r\n                    $_.State -eq \"Established\"\r\n                )\r\n            ) -or\r\n            <# UDP is stateless, return all UDP connections. #>\r\n            $_.Protocol -eq \"UDP\"\r\n        )\r\n    } | Sort-Object LocalAddress, RemoteAddress | Select-Object * -Unique\r\n\r\n    if (-not $FoundAddresses -or $FoundAddresses.Count -eq 0) {\r\n        Write-Host \"[Info] No Addresses were found listening or established with the specified network or address\"\r\n    }\r\n\r\n    # Output the found Addresses\r\n    $FoundAddresses | ForEach-Object {\r\n        Write-Host \"[Alert] Found Local Address: $($_.LocalAddress), Local Port: $($_.LocalPort), Remote Address: $($_.RemoteAddress), Remote Port: $($_.RemotePort), PID: $($_.OwningProcess), Protocol: $($_.Protocol), State: $($_.State), Process: $($_.Process)\"\r\n    }\r\n    # Save the results to a custom field if one was provided\r\n    if ($CustomFieldName -and $CustomFieldName -ne 'null') {\r\n        try {\r\n            Write-Host \"[Info] Saving results to custom field: $CustomFieldName\"\r\n            Set-NinjaProperty -Name $CustomFieldName -Value $(\r\n                $FoundAddresses | ForEach-Object {\r\n                    \"Local Address: $($_.LocalAddress), Local Port: $($_.LocalPort), Remote Address: $($_.RemoteAddress), Remote Port: $($_.RemotePort), PID: $($_.OwningProcess), Protocol: $($_.Protocol), State: $($_.State), Process: $($_.Process)\"\r\n                } | Out-String\r\n            )\r\n            Write-Host \"[Info] Results saved to custom field: $CustomFieldName\"\r\n        }\r\n        catch {\r\n            Write-Host $_.Exception.Message\r\n            Write-Host \"[Warn] Failed to save results to custom field: $CustomFieldName\"\r\n            exit 1\r\n        }\r\n    }\r\n}\r\nend {\r\n    \r\n    \r\n    \r\n}\r\n<\/pre>\n
 <\/p>\n\n
<\/h2>
<\/p><\/div>
<\/a><\/div><\/div>\n
Comment fonctionne le script<\/h2>\n
1. Configuration initiale<\/em><\/h3>\n
Le script n\u00e9cessite la version 5.1 ou ult\u00e9rieure de PowerShell et est destin\u00e9 \u00e0 \u00eatre utilis\u00e9 sur Windows 10 ou Windows Server 2016 et les versions plus r\u00e9centes. Il commence par v\u00e9rifier si le script est ex\u00e9cut\u00e9 avec des privil\u00e8ges d’administrateur, ce qui est n\u00e9cessaire pour acc\u00e9der aux informations de connexion r\u00e9seau.<\/p>\n
2. Analyse des param\u00e8tres<\/em><\/h3>\n
Le script accepte deux param\u00e8tres principaux : -IpAddress et -CustomField. Le param\u00e8tre -IpAddress vous permet de sp\u00e9cifier une liste d’adresses IP ou de plages d’adresses IP not\u00e9es CIDR \u00e0 surveiller. Le param\u00e8tre -CustomField est facultatif et permet d’enregistrer les r\u00e9sultats dans un champ personnalis\u00e9 NinjaOne.<\/p>\n
3. Validation de l’adresse<\/em><\/h3>\n
Une fois les param\u00e8tres fournis, le script valide chaque adresse IP ou plage de r\u00e9seaux. Si une adresse ou un r\u00e9seau valide est d\u00e9tect\u00e9, il proc\u00e8de \u00e0 l’extraction de toutes les adresses IP correspondantes dans cette plage.<\/p>\n
4. Surveillance des connexions r\u00e9seau<\/em><\/h3>\n
Le script utilise les cmdlets Get-NetTCPConnection et Get-NetUDPEndpoint pour capturer toutes les connexions TCP et UDP actuelles sur le syst\u00e8me. Il filtre ces connexions pour identifier celles qui sont dans un \u00e9tat Listening ou ‘Established pour TCP, et capture toutes les connexions UDP \u00e9tant donn\u00e9 qu’elles n’ont pas d’\u00e9tat.<\/p>\n
5. R\u00e9sultats et sauvegarde optionnelle<\/em><\/h3>\n
Les connexions identifi\u00e9es sont ensuite affich\u00e9es dans un format structur\u00e9, avec des d\u00e9tails tels que les adresses locales et distantes, les ports, les identifiants de processus, les protocoles et les \u00e9tats. Si un champ personnalis\u00e9 est sp\u00e9cifi\u00e9, le script enregistre ces r\u00e9sultats pour une analyse ult\u00e9rieure dans NinjaOne.<\/p>\n
Cas d’utilisation : Application dans le monde r\u00e9el<\/h2>\n
Prenons le cas d’une entreprise MSP qui g\u00e8re l’infrastructure informatique d’une soci\u00e9t\u00e9 de services financiers. L’entreprise a des exigences strictes en mati\u00e8re de s\u00e9curit\u00e9 et doit surveiller toutes les connexions entrantes et sortantes pour d\u00e9tecter tout acc\u00e8s non autoris\u00e9. L’entreprise MSP d\u00e9ploie ce script sur l’ensemble des serveurs et des terminaux, en sp\u00e9cifiant les plages d’adresses IP internes de l’entreprise afin de s’assurer que seuls les appareils autoris\u00e9s communiquent avec le r\u00e9seau. Si le script d\u00e9tecte une connexion \u00e0 partir d’une adresse IP non approuv\u00e9e, il alerte l’administrateur, qui peut alors prendre des mesures imm\u00e9diates pour enqu\u00eater et r\u00e9duire le risque.<\/p>\n
Comparaison avec d’autres m\u00e9thodes<\/h2>\n
Alors que d’autres outils tels que Wireshark ou Netstat peuvent fournir des informations d\u00e9taill\u00e9es sur le trafic r\u00e9seau, ce script PowerShell offre une approche simplifi\u00e9e et automatis\u00e9e. Contrairement \u00e0 Wireshark, qui n\u00e9cessite une analyse manuelle des paquets, ce script \u00e9met automatiquement des alertes sur des connexions sp\u00e9cifiques, ce qui le rend plus accessible pour une surveillance continue. Par rapport \u00e0 Netstat, le script apporte une valeur ajout\u00e9e en filtrant et en signalant les connexions dans un format plus structur\u00e9 et plus exploitable.<\/p>\n
Questions fr\u00e9quemment pos\u00e9es<\/h2>\n
Q\u00a0: Ce script peut-il surveiller les adresses IPv6 ?<\/h3>\n
R\u00a0: Actuellement, le script ne prend en charge que les adresses et les r\u00e9seaux IPv4. La prise en charge d’IPv6 n\u00e9cessiterait des modifications du script pour g\u00e9rer le format d’adresse diff\u00e9rent.<\/p>\n
Q\u00a0: Que se passe-t-il si une adresse IP non valide est saisie ?<\/h3>\n
R\u00a0: Le script comprend des contr\u00f4les de validation et interrompt l’ex\u00e9cution si une adresse IP ou un r\u00e9seau non valide est d\u00e9tect\u00e9, en envoyant un message d’erreur \u00e0 l’utilisateur.<\/p>\n
Q\u00a0: Comment les r\u00e9sultats sont-ils enregistr\u00e9s dans NinjaOne ?<\/h3>\n
R\u00a0: Si le param\u00e8tre -CustomField est fourni, le script utilise l’interface CLI de NinjaOne pour enregistrer les r\u00e9sultats dans le champ personnalis\u00e9 sp\u00e9cifi\u00e9, garantissant ainsi l’acc\u00e8s aux donn\u00e9es<\/a> pour des r\u00e9f\u00e9rences ou des rapports ult\u00e9rieurs.<\/p>\n
Implications des r\u00e9sultats<\/h2>\n
Les r\u00e9sultats de ce script peuvent avoir des cons\u00e9quences importantes pour la s\u00e9curit\u00e9 informatique. En identifiant et en alertant sur les connexions actives, les professionnels de l’informatique peuvent rapidement d\u00e9tecter les acc\u00e8s non autoris\u00e9s, les communications potentielles de logiciels malveillants ou les services mal configur\u00e9s. L’utilisation r\u00e9guli\u00e8re de ce script am\u00e9liore la visibilit\u00e9 des activit\u00e9s du r\u00e9seau, ce qui contribue \u00e0 rendre l’environnement informatique plus s\u00fbr et plus r\u00e9sistant.<\/p>\n
Bonnes pratiques de l’utilisation du script<\/h2>\n
    \n
  1. Ex\u00e9cuter r\u00e9guli\u00e8rement<\/strong>: Planifiez l’ex\u00e9cution du script \u00e0 intervalles r\u00e9guliers, afin d’assurer une surveillance continue des connexions r\u00e9seau.<\/li>\n
  2. Int\u00e9grer avec NinjaOne<\/strong>: Exploitez les capacit\u00e9s de NinjaOne pour stocker et analyser les r\u00e9sultats, ce qui permet un suivi \u00e0 long terme et une analyse des tendances.<\/li>\n
  3. Adapt\u00e9 \u00e0 votre environnement<\/strong>: Modifiez le script si n\u00e9cessaire pour prendre en compte des plages d’adresses IP sp\u00e9cifiques ou des exigences suppl\u00e9mentaires en mati\u00e8re de journalisation.<\/li>\n
  4. Test dans un environnement s\u00fbr<\/strong>: Avant de le d\u00e9ployer en production, testez le script dans un environnement contr\u00f4l\u00e9 pour vous assurer qu’il fonctionne comme pr\u00e9vu.<\/li>\n<\/ol>\n
    Conclusion<\/h2>\n
    Ce script PowerShell offre une solution performante pour surveiller les connexions TCP et UDP sur les syst\u00e8mes Windows. En l’int\u00e9grant dans votre bo\u00eete \u00e0 outils de surveillance du r\u00e9seau, en particulier dans NinjaOne<\/a>, vous pouvez obtenir une meilleure visibilit\u00e9 et un meilleur contr\u00f4le de votre environnement informatique. Pour les professionnels de l’informatique et les MSP, ce script fournit une approche pratique de la protection de l’int\u00e9grit\u00e9 du r\u00e9seau, permettant des r\u00e9ponses proactives aux menaces potentielles.<\/p>\n
     <\/p>\n","protected":false},"author":35,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"open","ping_status":"open","template":"","meta":{"_acf_changed":false,"_relevanssi_hide_post":"","_relevanssi_hide_content":"","_relevanssi_pin_for_all":"","_relevanssi_pin_keywords":"","_relevanssi_unpin_keywords":"","_relevanssi_related_keywords":"","_relevanssi_related_include_ids":"","_relevanssi_related_exclude_ids":"","_relevanssi_related_no_append":"","_relevanssi_related_not_related":"","_relevanssi_related_posts":"","_relevanssi_noindex_reason":"","_lmt_disableupdate":"","_lmt_disable":""},"operating_system":[4212],"use_cases":[4285],"class_list":["post-353682","script_hub","type-script_hub","status-publish","hentry","script_hub_category-windows"],"acf":[],"_links":{"self":[{"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/script_hub\/353682","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/script_hub"}],"about":[{"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/types\/script_hub"}],"author":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/users\/35"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/comments?post=353682"}],"wp:attachment":[{"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/media?parent=353682"}],"wp:term":[{"taxonomy":"script_hub_category","embeddable":true,"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/operating_system?post=353682"},{"taxonomy":"use_cases","embeddable":true,"href":"https:\/\/www.ninjaone.com\/fr\/wp-json\/wp\/v2\/use_cases?post=353682"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}