https://community.checkpoint.com/t5/General-Topics/Convert-connection-table-to-csv-using-windows-scripting-host/m-p/102792#M19837 <P>Before I discovered Connstat, I created my own conversion of fields I felt were relevant from a saved connection table (fw -tab connections -u &gt; file.txt).&nbsp; The output is a csv file.&nbsp; As an addition, I then created (and borrowed some code) to count instances of source or destination IPs.&nbsp; That is in the form of basic code that can be imported as macros to run in Excel.&nbsp; There are neater and more robust ways of doing it, but this helped resolve which IPs were filling the connection table.&nbsp; At minimum, this gives a code level example of how to read the connection table.<BR /><BR />The default expected file name is connections.txt located in the same directory as the wsh, windows scripting host, file.&nbsp; The default output is conntable.csv.&nbsp; Error checking is minimal, so use carefully.&nbsp; &nbsp;Message boxes are used for selection.<BR /><BR />Note that some malware detection may block downloading a zip with wsh and bas files.</P> Fri, 20 Nov 2020 14:40:06 GMT George_Ellis 2020-11-20T14:40:06Z https://community.checkpoint.com/t5/General-Topics/Convert-connection-table-to-csv-using-windows-scripting-host/m-p/102792#M19837 <P>Before I discovered Connstat, I created my own conversion of fields I felt were relevant from a saved connection table (fw -tab connections -u &gt; file.txt).&nbsp; The output is a csv file.&nbsp; As an addition, I then created (and borrowed some code) to count instances of source or destination IPs.&nbsp; That is in the form of basic code that can be imported as macros to run in Excel.&nbsp; There are neater and more robust ways of doing it, but this helped resolve which IPs were filling the connection table.&nbsp; At minimum, this gives a code level example of how to read the connection table.<BR /><BR />The default expected file name is connections.txt located in the same directory as the wsh, windows scripting host, file.&nbsp; The default output is conntable.csv.&nbsp; Error checking is minimal, so use carefully.&nbsp; &nbsp;Message boxes are used for selection.<BR /><BR />Note that some malware detection may block downloading a zip with wsh and bas files.</P> Fri, 20 Nov 2020 14:40:06 GMT https://community.checkpoint.com/t5/General-Topics/Convert-connection-table-to-csv-using-windows-scripting-host/m-p/102792#M19837 George_Ellis 2020-11-20T14:40:06Z