How to get number of connections on PORT per IP in Windows? - c++

Question

I have been searching around Google for some time and I can`t seem to find an answer...
I am using GetExtendedTcpTable() to view my current connections, but I am unable to get the number of connections that each IP does on a specific PORT.
Is there any example/function for this ? Or do I have to create something ?
Any guidance or example is much appreciated.
Have a nice day!

Answer 1

So using this code from MSDN as the basis we end up with this example which enumerates a list of connections, populating the pointer to int ports with the number of connections from remote systems to the local ports.
To determine the number of connections to a particular local port, you can simply print out the value of ports[port].
The code as supplied is very much more C, than C++, I just used a new[] and delete[] for the ports.
#include <winsock2.h>
#include <ws2tcpip.h>
#include <iphlpapi.h>
#include <stdio.h>
#pragma comment(lib, "iphlpapi.lib")
#pragma comment(lib, "ws2_32.lib")
#define MALLOC(x) calloc(1, (x))
#define FREE(x) free((x))
int main()
{
// Declare and initialize variables
PMIB_TCPTABLE_OWNER_PID pTcpTable;
int *ports; // an array of all the possible ports
DWORD dwSize = 0;
DWORD dwRetVal = 0;
char szRemoteAddr[128];
struct in_addr IpAddr;
int i;
ports = new int[1 << (sizeof(u_short) * 8)]();
pTcpTable = (MIB_TCPTABLE_OWNER_PID *)MALLOC(sizeof(MIB_TCPTABLE_OWNER_PID));
if (pTcpTable == NULL) {
printf("Error allocating memory\n");
return 1;
}
dwSize = sizeof(MIB_TCPTABLE);
// Make an initial call to GetTcpTable to
// get the necessary size into the dwSize variable
if ((dwRetVal = GetExtendedTcpTable(pTcpTable, &dwSize, TRUE, AF_INET, TCP_TABLE_BASIC_CONNECTIONS, 0)) ==
ERROR_INSUFFICIENT_BUFFER) {
FREE(pTcpTable);
pTcpTable = (MIB_TCPTABLE_OWNER_PID *)MALLOC(dwSize);
if (pTcpTable == NULL) {
printf("Error allocating memory\n");
return 1;
}
}
// Make a second call to GetTcpTable to get
// the actual data we require
if ((dwRetVal = GetExtendedTcpTable(pTcpTable, &dwSize, TRUE, AF_INET, TCP_TABLE_BASIC_CONNECTIONS, 0)) == NO_ERROR) {
printf("\tNumber of entries: %d\n", (int)pTcpTable->dwNumEntries);
for (i = 0; i < (int)pTcpTable->dwNumEntries; i++) {
printf("\n\tTCP[%d] State: %ld - ", i,
pTcpTable->table[i].dwState);
if (pTcpTable->table[i].dwState != MIB_TCP_STATE_ESTAB)
continue;
// get the port in host order
u_short port = ntohs((u_short)pTcpTable->table[i].dwLocalPort);
ports[port] += 1; // increment this port
IpAddr.S_un.S_addr = (u_long)pTcpTable->table[i].dwRemoteAddr;
inet_ntop(AF_INET, &IpAddr, szRemoteAddr, sizeof(szRemoteAddr));
printf("\tTCP[%d] Remote Addr: %s:%d\n", i, szRemoteAddr, ntohs((u_short)pTcpTable->table[i].dwRemotePort));
}
}
else {
printf("\tGetExtendedTcpTable failed with %d\n", dwRetVal);
FREE(pTcpTable);
delete[] ports;
return 1;
}
if (pTcpTable != NULL) {
FREE(pTcpTable);
pTcpTable = NULL;
}
delete[] ports;
return 0;
}
Now if you wanted a list of the remote addresses coming to a port, then you could make a std::vector<std::string> remote_addresses and perform a remote_addresses.push_back(szRemoteAddr) when you determined that the port was correct.
There is a potential race condition where between the initial call to GetExtendedTcpTable and the subsequent call to GetExtendedTcpTable another connection comes in, which increases the value of dwSize. Generally asking for more memory helps in this case to just prevent this from being an issue - i.e. after the initial call, try asking for 8K more than you need - it's not likely to be a big issue, though.