Before I discovered Connstat, I created my own conversion of fields I felt were relevant from a saved connection table (fw -tab connections -u > file.txt). The output is a csv file. As an addition, I then created (and borrowed some code) to count instances of source or destination IPs. That is in the form of basic code that can be imported as macros to run in Excel. There are neater and more robust ways of doing it, but this helped resolve which IPs were filling the connection table. At minimum, this gives a code level example of how to read the connection table.
The default expected file name is connections.txt located in the same directory as the wsh, windows scripting host, file. The default output is conntable.csv. Error checking is minimal, so use carefully. Message boxes are used for selection.
Note that some malware detection may block downloading a zip with wsh and bas files.
