Download Netscan ((LINK)) Free
Lucille Minasian
To scan for network artifacts in 32- and 64-bit Windows Vista, Windows 2008 Server and Windows 7 memory dumps, use the netscan command. This finds TCP endpoints, TCP listeners, UDP endpoints, and UDP listeners. It distinguishes between IPv4 and IPv6, prints the local and remote IP (if applicable), the local and remote port (if applicable), the time when the socket was bound or when the connection was established, and the current state (for TCP connections only). For more information, see -new-netscan-module.html Volatility's New Netscan Module.
Use .xml config instead of .ini.
I was using v5.4.8 with netscan.ini config file. The v6.0.5 ignored the netscan.ini and created netscan.xml in C:\Users\\Documents folder. Switches /xml or /ini did not help. I had to copy netscan.xml from Documents to the folder where netscan.exe was, to make the settings portable (window title should have "[PORTABLE MODE]" appended to it).
In addition to using the option "/ini", you can also now use "/xml" to save settings in an xml file when running on a hard drive an if you do not want to store things in the registry.
The /xml is a much better option since if netscan is run from a removable USB drive, it writes settings to an xml file on the drive by default.