Visualizing TCP connections with Powershell and Graphviz

I've recently been somewhat obsessed with Graphviz, particularly with the PSGraph Powershell Module.  At work I use it as part of the CI/CD of various projects to automatically document the flow of information between functions, servers, etc. 

But in this post, I want to show how i start with the ss command (socket statistics), and end up with a graph that shows who you're connected to, and how.

First of all, you need a few things:

• A Linux distro. I use Pop OS.
• Powershell
• PSGraph
• Graphviz (sudo apt-get install graphviz)

This is the script that does all the fun:

	class SS {
	[string]$LocalAddress
	[string]$LocalPort
	[string]$RemoteAddress
	[string]$RemotePort
	[int]$PID
	[string]$ProcessName
	}
	$SSRaw = ss -t -r -p -o state established --no-header
	$SSArr = @()
	1..($SSRaw.Count -1) | ForEach-Object {
	$SSLine = $SSRaw[$PSItem]
	$Split = $SSLine.Split(' ') | Where-Object {$_}
	$SS = New-Object -TypeName SS
	$SS.LocalAddress = $Split[2].Split(':')[-2]
	$SS.LocalPort = $Split[2].Split(':')[-1]
	$SS.RemoteAddress = $Split[3].Split(':')[-2].Replace(']','')
	$SS.RemotePort = $Split[3].Split(':')[-1]
	$SS.ProcessName = $Split[4].Split('"')[1]
	$SS.PID = $Split[4].Split('=')[1].Replace(',fd','')
	$SSArr += $SS
	}
	graph network @{rankdir='LR'} {
	node @{shape='rect'}
	edge $SSArr -FromScript {$_.ProcessName} -ToScript {$_.RemoteAddress} @{label={$_.RemotePort}}
	} | Export-PSGraph -ShowGraph

view raw Show-TCPConnections.ps1 hosted with ❤ by GitHub

So first, I create a class with the properties I want.

Then I run the ss command, and declare an empty array.

Then I loop through the output of the ss command, parse it into the individual pieces of information I want, and add it to the array.

Then the PSGraph magic. To be honest, I struggle to explain in great detail how it works, but the things to note are:

• -FromScript are the "start" boxes
• -ToScript are the "end" boxes. 
• label is the text on the line

And then just show the graph. The command also supports saving it in various formats.

Running it as I type this post, this is the generated graph:

I find this fascinating, as it may tell you about something nefarious or just interesting.

For example here, I can see that Chrome is talking to my Chromecasts, and Syncthing is talking to my file server.

As a bonus, here is my folder tree under /dev 

Just slightly modified from the example in the documentation.

That's all for now!

/Kevin