title: Unknown tcp states being returned by MSFT_NetTCPConnection CIM Query
body: <p><strong>Overview</strong></p>
  <p>The method below queries the <a href="https://docs.microsoft.com/en-us/previous-versions/windows/desktop/nettcpipprov/msft-nettcpconnection" rel="nofollow noreferrer">MSFT_NetTCPConnection</a> CIM instance and returns a list of TCP Connections on the target machine. This is the CIM instance that underlies the powershell <a href="https://docs.microsoft.com/en-us/powershell/module/nettcpip/get-nettcpconnection?view=win10-ps" rel="nofollow noreferrer">Get-NetTCPConnection</a> command.</p>
  <p><strong>Problem</strong></p>
  <p>I noticed that I get some instances back that report back a TCP state id 100, which is <a href="https://docs.microsoft.com/en-us/previous-versions/windows/desktop/nettcpipprov/msft-nettcpconnection" rel="nofollow noreferrer">undocumented</a> as far as I can tell. What does this status mean? My guess is that these are dead connections and I can probably filter them out but I'm hoping someone out there might know the answer to this.</p>
  <pre class="lang-cs prettyprint-override"><code>public const string TcpConnectionNamespace = Wmi.StandardCimv2Namespace;
  public const string TcpConnectionClassName = &quot;MSFT_NetTCPConnection&quot;;
  public const string ProcessIdKey = &quot;OwningProcess&quot;;
  public const string LocalAddressKey = &quot;LocalAddress&quot;;
  public const string LocalPortKey = &quot;LocalPort&quot;;
  public const string RemoteAddressKey = &quot;RemoteAddress&quot;;
  public const string RemotePortKey = &quot;RemotePort&quot;;
  public const string StateKey = &quot;State&quot;;
  
  public IEnumerable&lt;TcpConnectionModel&gt; GetTcpConnections()
  {
      var session = CimSession.Create(Server);
      var instances = session.QueryInstances(
          TcpConnection.TcpConnectionNamespace,
          Wmi.QueryDialect,
          $&quot;Select * From {TcpConnection.TcpConnectionClassName}&quot;);
  
      foreach (var instance in instances)
      {
          var processId = Convert.ToUInt32(instance.CimInstanceProperties[TcpConnection.ProcessIdKey].Value);
          yield return new TcpConnectionModel()
          {
              ProcessId = processId,
              ProcessName = _processService.GetProcessFromPid(processId).ProcessName,
              LocalAddress = IPAddress.Parse(instance.CimInstanceProperties[TcpConnection.LocalAddressKey].Value.ToString()),
              LocalPort = Convert.ToUInt16(instance.CimInstanceProperties[TcpConnection.LocalPortKey].Value.ToString()),
              RemoteAddress = IPAddress.Parse(instance.CimInstanceProperties[TcpConnection.RemoteAddressKey].Value.ToString()),
              RemotePort = Convert.ToUInt16(instance.CimInstanceProperties[TcpConnection.RemotePortKey].Value.ToString()),
              State = TcpConnection.ConvertState(Convert.ToInt32(instance.CimInstanceProperties[TcpConnection.StateKey].Value))
          };
      }
  }
  </code></pre>
  <p><strong>TCP States</strong>
  <a href="https://i.stack.imgur.com/DjBHo.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/DjBHo.png" alt="enter image description here" /></a></p>