volatility3 netscan

vol.py -f mem.dmp windows.netscan

Lists active network connections at the time of the memory dump with Volatility 3, revealing the C2 and attacker communications.

Run it when you want to know who the compromised host was talking to at the time of the capture: netscan walks the kernel network structures (TCP/UDP tables) and lists connections with their process, IP, and port. It's the snapshot of the attacker's communications — the C2 (an established connection to an external IP from a suspicious process) and lateral movement (connections to internal hosts). In memory IR, netscan is the complement to pslist: processes tell you what's running, netscan tells you who it's talking to.

Don't use it as a complete network inventory: netscan sees what the kernel structures contain — already closed connections or ephemeral UDP traffic may not appear; for history, use pcap or logs. On dumps from very active hosts, the list is long and noise (updates, legitimate telemetry) muddies the signal: filter by suspicious processes from pslist and by non-standard ports. And note: netscan gives IPs and ports, not content — to know WHAT was transmitted you need pcap or decryption. The process associated with each connection is the key field to separate legitimate from anomalous.