Hi, I am using Volatility to list the open sockets on my WinXP file image, with command "sockets". It should display all the open sockets, like "netstat -a" does, but it didnt display anything. Is that a bug, or that is the way it supposes to work? I tried with "sockscan" on the same image, and yes, this time it shows a lot of open sockets. The problem is that this command is really slow: it took a minute or so on a 400MB image. Meanwhile, "sockscan2" is a lot faster: it returns information almost immediately. "connections", "connscan" and "connscan2" shows nothing. is that expected?? I suppose that "connections" and "sockets" are about the same thing. is that correct? Thanks, Jun _______________________________________________ Vol-dev mailing list Vol-dev(a)volatilityfoundation.org http://lists.volatilityfoundation.org/mailman/listinfo/vol-dev