Windows Collection - Netstat Details

Title

Question:

When the RN150 is collecting netstat data, does it use \\127.0.0.1\admin$ or does it use the connection IP, \\10.0.0.1\admin$?

Answer:

A DCE/RPC connection is then opened to deliver the command to the cmd.exe utility. The command issued redirects its output to a temporary plain text file in the ADMIN$ share, where the name is the timestamp of the current time prefixed by two underscores and suffixed with a random number, eg, ‘__1497992728.46’. The final form of the command executed on the remote Windows system is:

cmd.exe /Q /c netstat -anop TCP 1> \\127.0.0.1\ADMIN$\filename 2>&1

Was this helpful?

Support Hub

Product

Foundation/CloudScape

Deployment type

On-premises

Visibility

Guest

URL Name

windows-collection-netstat-details

Are you sure you want to cancel the case creation?

Case closed successfully

Action performed successfully

Upload Attachment

Maximum file size allowed is 3 MB.

File type not supported.

Supported file types:

Documents (.txt, .doc, .docx, .pdf), Images (.jpg, .png), Comma Separated Files (.csv) Speadsheets (.xlsx, .xls)

Are you sure you want to close this case

Get Hotline support

Products	Region	Phone Numbers
FlexNet Operations FlexNet Embedded FlexNet Publisher FlexNet Connect FlexNet Code Insight InstallAnywhere InstallShield	North America *	+1 630-332-2513 (toll) +1 877-279-2853 (toll-free in North America)
	Europe *	+44 1925 944367 (toll) +44 800 047 8642 (toll-free in Europe)
	Japan *	+81 3-4540-5335 (select option 2)
	Australia *	+61 3 9895 2177 +61 1800 560 603 (toll-free in Australia)
Usage Intelligence (formerly Revulytics) Compliance Intelligence	Please use the Case Portal to submit your support ticket or reach out to your Revenera contact.

Question:

Answer:

Related Articles

Please wait...

Case id: 00001065