# TCP Table

## Overview

**Evidence:** TCP Table\
**Description:** Collect TCP Table\
**Category:** Network\
**Platform:** windows\
**Short Name:** tcpt\
**Is Parsed:** Yes\
**Sent to Investigation Hub:** Yes\
**Collect File(s):** No

## Background

Windows maintains a table of all active TCP connections including local/remote addresses, ports, connection state, and the process ID that owns each connection.

Active TCP connections can reveal malware C2 communications, lateral movement, data exfiltration, and unauthorized network access in progress.

## Data Collected

This collector gathers structured data about tcp table.

### TCP Table Data

| Field        | Description        | Example         |
| ------------ | ------------------ | --------------- |
| `State`      | Connection state   | 5 (ESTABLISHED) |
| `Local`      | Local IP address   | 192.168.1.100   |
| `LocalPort`  | Local port number  | 49152           |
| `Remote`     | Remote IP address  | 93.184.216.34   |
| `RemotePort` | Remote port number | 443             |
| `ProcessID`  | Owning process ID  | 1234            |

## Collection Method

This collector uses Windows API to enumerate TCP connections:

* `GetExtendedTcpTable` with `TCP_TABLE_OWNER_PID_ALL` flag
* Includes all TCP connection states
* Associates connections with process IDs

TCP states include: CLOSED, LISTEN, SYN\_SENT, SYN\_RECEIVED, ESTABLISHED, FIN\_WAIT\_1, FIN\_WAIT\_2, CLOSE\_WAIT, CLOSING, LAST\_ACK, TIME\_WAIT.

## Forensic Value

Active TCP connections can reveal ongoing malicious activity. Investigators use this data to identify active C2 communications, detect data exfiltration in progress, track lateral movement connections, identify unauthorized remote access, correlate network activity with processes, and detect suspicious port usage.
