Find established endpoints
Documentation: Microsoft Learn
Group established TCP connections by remote address, then sort by count to find the endpoints with the most concurrent connections.
The script
Script reader
Inspect before you run
Inspect the script below. It does not run in this browser.
Inspection only — no command has run.
Show reference output
Inspect this example’s structure
Read the command and its supplied arguments. This example requires real PowerShell or its module; this diagram does not execute it.
Get-NetTCPConnection -State Established | Group-Object RemoteAddress | Sort-Object Count -Descending | Select-Object Name,Count- Stage 1Get-NetTCPConnection
-State - Stage 2Group-Object
Positional values or no named parameters - Stage 3Sort-Object
-Descending - Stage 4Select-Object
Positional values or no named parameters
How it works
Established connections are grouped by RemoteAddress, Sort-Object ranks the buckets by size, and the projection reports each address as Name alongside the number of concurrent connections to it.
Adapting it
Drop internal ranges before grouping with a Where-Object testing RemoteAddress against your own prefixes, which leaves only genuinely external destinations in the summary.
If the result is unexpected
The established-connection report misses short-lived endpoints.
Connection tables are snapshots and ownership can change before a second process query.
- Collect connection and process identifiers close together and keep unresolved owners in the output.
Validate the result
Rows retain endpoint details even when a process exits before name resolution.
Keep the check reliable
Use repeated observations for transient traffic and avoid equating a snapshot with complete history.
