PowerShellBeginner · Windows 10/11 or Windows Server; PowerShell 7+

TCP state counts

Summarize local sockets by connection state.

Before you begin

  • PowerShell 7 or later on Windows.
  • The Windows module or CIM performance class named in the source must be available. Protected logs and some counters require elevated read access.
What this script changesRead-only local report. It does not start services, install updates, delete files, or change configuration. Output may contain account, hardware, path, or network information; review before sharing.

Set up your example

  1. Save the download as monitor-tcp-state-counts.ps1.
  2. Open PowerShell 7 in the download folder.
  3. Run pwsh -NoProfile -File ./monitor-tcp-state-counts.ps1 -Help, then inspect its parameter block.

This recipe uses your own local input or creates its own example output. Follow the setup steps below.

Download the ZIP, extract it, and open a terminal inside the extracted folder. The source file is monitor-tcp-state-counts.ps1.

Run the script

Run command
pwsh -NoProfile -File ./monitor-tcp-state-counts.ps1

If your system uses python3 instead of python, use that command for Python examples. Keep paths containing spaces in quotes. Required inputs and optional settings are described in the code and setup steps.

What to expect

Many TimeWait sockets become one aggregate count.

The complete script

monitor-tcp-state-counts.ps1
#Requires -Version 7.0
[CmdletBinding()]
param([switch]$Help,[switch]$AsJson)
$ErrorActionPreference='Stop'
if ($Help) { Write-Output 'Summarize local sockets by connection state. Use -AsJson for structured output.'; exit 0 }
function Show-Report { param([object]$Data) if ($AsJson) { ConvertTo-Json -InputObject @($Data) -Depth 8 } else { $Data | Format-Table -AutoSize | Out-String -Width 240 | Write-Output } }
try {
$rows = & {
Get-NetTCPConnection | Group-Object State | Select-Object @{n='State';e={$_.Name}},Count | Sort-Object Count -Descending
}
Show-Report $rows

} catch { Write-Error $_.Exception.Message; exit 1 }

Open source as plain text · Download source and sample files

How it works

  1. Summarize local sockets by connection state.
  2. The script queries local Windows data and formats a snapshot without changing settings.
  3. -AsJson changes presentation to JSON for comparison between runs.

Make it your own

Adjust the report

Insert Where-Object LocalPort -eq 443 before Group-Object for one local port.

Capture JSON

Add -AsJson and redirect to a new unused filename. Shell redirection can overwrite an existing file, so choose a fresh name.

Change one setting at a time, run it again on sample data, and compare the output. The customization guide walks through this process.

If something goes wrong

A command is unavailable or access is denied.

The Windows module or CIM performance class named in the source must be available. Protected logs and some counters require elevated read access. Use only permissions you are authorized to use; protected records may require elevation.

No rows are returned.

No matching data can be valid. Remove optional filters and confirm this Windows edition exposes the requested information.

Reference & next steps

These official references explain the underlying tools. The Scriptage example and guide are original instructional content. See verification notes for what has been checked and the limits of those checks.

Copies a template for your own notes. It does not send anything.