Viewing open connections of a program

[SSkillZ]

Hello,
I'm searching how to get a list of connections a program\process has,
kinda like netstat...

Any ideas?

[MikeAThon]

Use GetExtendedTcpTable() with one of the PID options. See http://msdn2.microsoft.com/en-us/library/aa365928.aspx

This function is availabel only on XP SP2 and later (ie, Vista). If your program must work on earlier systems, then life is more complicated.

The GetTcpTable() fucntion is available for all versions of Windows, but does not have program information. If you just want a list of connections, and do not care about which program owns it, then this is by far the easiest solution.

If you absolutely need program information, and absolutely need it on earlier versions of Windows, then there are two options:

(1) If it's sufficient to support WinXP and not earlier, then there's an undocumented function in the Iphlpapi named AllocateAndGetTcpExTableFromStack(). At least it formerly was undocumented. Today you can see it at http://msdn2.microsoft.com/en-us/library/aa365804.aspx

(2) If you must support all versions of Windows, then you must rely on the ZwQuerySystemInformation(), which is also undocumented or at least deprecated. The best example of its use for this purpose is the "portuser.cpp" program from Gary Nebbet. You can search for it, but one good article explaining its use is "Getting TCP-UDP Tables for Pre-XP SP2 Systems" at http://www.codeproject.com/useritems/Portuser.asp

Note that all the above refers to TCP-related functions. There are counterpart UDP-related functions too.

Mike

[SSkillZ]

Thanks a lot, most complete answer :)