Finding tcp ports used by application

Question

Alright, so I'm extending my company's flexlm vendor daemon to be a little bit more revealing to client applications.

I need to be able to find out what port lmgrd is listening on before clients connect. The API documentation seems to be rather barren, and I believe they keep most of their code in a compiled form so I can't just look at their source.

Is it possible to call upon the awesome power of the Windows API to find out what ports a particular process is using? If Process Explorer from sysinternals can do it, I should be able to right? Does anyone have sample code for this?

It needs to support Windows XP and higher since many of our clients have yet to upgrade.

Edit: I should note that it turns out FLEX has support for pulling the port from the license file. I don't have the code in front of me, but know that this isn't the best way to find out what ports your vendor daemon/lmgrd is running.

vcsjones · Accepted Answer · 2011-06-27 23:12:10Z

GetTcpTable2 -- see EDIT

http://msdn.microsoft.com/en-us/library/bb408406(v=vs.85).aspx

The GetTcpTable function retrieves the IPv4 TCP connection table.

This will fill in a MIB_TCPTABLE structure.

typedef struct _MIB_TCPTABLE {
  DWORD      dwNumEntries;
  MIB_TCPROW table[ANY_SIZE];
} MIB_TCPTABLE, *PMIB_TCPTABLE;

And now the MIB_TCPROW

typedef struct _MIB_TCPROW {
  DWORD dwState;
  DWORD dwLocalAddr;
  DWORD dwLocalPort;
  DWORD dwRemoteAddr;
  DWORD dwRemotePort;
} MIB_TCPROW, *PMIB_TCPROW;

EDIT IMPORTANT:

You need to use GetTcpTable2 in order to get the corresponding PID associated as well.

typedef struct _MIB_TCPROW2 {
  DWORD                        dwState;
  DWORD                        dwLocalAddr;
  DWORD                        dwLocalPort;
  DWORD                        dwRemoteAddr;
  DWORD                        dwRemotePort;
  DWORD                        dwOwningPid;
  TCP_CONNECTION_OFFLOAD_STATE dwOffloadState;
} MIB_TCPROW2, *PMIB_TCPROW2;

dwOwningPid

Crap. No can do. Seems the GetTcpTable2 function is a Vista and higher function. I should have specified it should work with Windows XP as a minimum since many of our clients haven't upgraded yet. I'll update my original post. Excellent find though, I must say.
So... it seems the closest Windows XP version of this is AllocateAndGetTcpExTableFromStackmsdn.microsoft.com/en-us/library/aa365804(v=vs.85).aspx
The GetTcpTable or GetExtendedTcpTable functions should be used to retrieve the TCP connection table instead of using the AllocateAndGetTcpExTableFromStack function. Note The AllocateAndGetTcpExTableFromStack function is deprecated and not supported on Windows Vista and later. On the Microsoft Windows Software Development Kit (SDK) released for Windows Vista and later, the function prototype for AllocateAndGetTcpExTableFromStack is still defined in the Iphlpapi.h header file for continued support on Windows Server 2003 and Windows XP.

spender · Answer 2 · 2011-06-27 22:53:08Z

up vote1down vote

In the worst case, you could always parse the output of:

netstat -bna

answered Jun 27 '11 at 22:53

spender
33.5k33997

Interesting idea. More to find a reverse engineered version of that app. I've fallen upon the old winternals source code and will see how that fellow implemented his TCPView application. – RandomInsano Jun 28 '11 at 20:30

feedback

score 0 · Answer 3

Here's the code I ended up with, for anyone who hits this problem after me

#include "stdafx.h"
#include 
#include 

// These are just for the ntohl function in the printf below
#include 
#pragma comment(lib, "Ws2_32.lib")

DWORD (WINAPI *pGetExtendedTcpTable)(
  PVOID pTcpTable,
  PDWORD pdwSize,
  BOOL bOrder,
  ULONG ulAf,
  TCP_TABLE_CLASS TableClass,
  ULONG Reserved
);

int _tmain(int argc, _TCHAR* argv[])
{
    MIB_TCPTABLE_OWNER_PID *pTCPInfo;
    MIB_TCPROW_OWNER_PID *owner;
    DWORD size;
    DWORD dwResult;

    HMODULE hLib = LoadLibrary( "iphlpapi.dll" );

    pGetExtendedTcpTable = (DWORD (WINAPI *)(PVOID,PDWORD,BOOL,ULONG,TCP_TABLE_CLASS,ULONG))
        GetProcAddress(hLib, "GetExtendedTcpTable");

    if ( !pGetExtendedTcpTable )
    {
        printf("Could not load iphlpapi.dll. This application is for Windows XP SP2 and up.\n");
        return 1;
    }

    dwResult = pGetExtendedTcpTable(NULL,       &size, false, AF_INET, TCP_TABLE_OWNER_PID_LISTENER, 0);
    pTCPInfo = (MIB_TCPTABLE_OWNER_PID*)malloc(size);
    dwResult = pGetExtendedTcpTable(pTCPInfo,   &size, false, AF_INET, TCP_TABLE_OWNER_PID_LISTENER, 0);

    if (dwResult != NO_ERROR)
    {
        printf("Couldn't get our IP table");
        return 2;
    }

    printf("Iterating though table:\n");
    for (DWORD dwLoop = 0; dwLoop < pTCPInfo->dwNumEntries; dwLoop++)
    {
        owner = &pTCPInfo->table[dwLoop];

        printf("  PID: %5u - Port: %5u\n", owner->dwOwningPid, ntohs(owner->dwLocalPort));
    }

    // Pause a moment
    printf("Done Processing\n");

    return 0;
}

siooh

piątek, 2 listopada 2012

Windows TCP source port + PID , DLL

Finding tcp ports used by application

3 Answers

Brak komentarzy:

Prześlij komentarz

Ginekolog dr n. med. Piotr Siwek

Obserwatorzy

Łączna liczba wyświetleń