Click here to Skip to main content
Click here to Skip to main content

Enhance netstat

, 16 Nov 2003
Rate this:
Please Sign up or sign in to vote.
This article shows an implementation of the main TCP/UDP functions of the IP Helper API that is used to get info about active connections including the process attached to a connection.

Sample Image - enetstat.jpg


The main idea of this project was already implemented and presented by some guys around here: using GetTcpTable and GetUdpTable to read connection states of running processes. Yet another thing that is mentioned in this kind of articles are two undocumented APIs from iphlpapi.dll: AllocateAndGetTcpExTableFromStack and AllocateAndGetUdpExTableFromStack. Using these APIs, we can get access to the name of the process that holds the running connection. Unfortunately it does work only with Win2000, WinXP or newer versions.


First of all, I'd like to mention there is something new regarding this subject. Enetstat will allow the user to close any "established" connection using the following API function:

DWORD SetTcpEntry(

Having an established connection, we can close it using the following state: MIB_TCP_STATE_DELETE_TCB.

sKillConn.dwLocalAddr = (DWORD)ulLocIP; //local ip
sKillConn.dwLocalPort = (DWORD)usLocalPort; //local port
sKillConn.dwRemoteAddr = (DWORD)ulRemIP; //remote ip
sKillConn.dwRemotePort = (DWORD)usRemPort; //remote port

DWORD dwRez = SetTcpEntry(&sKillConn);

That's all about it. My piece of code is not described in detail and I suppose there is no need for that as long as we already have a cool and detailed description made by Axel Charpentier.

Well, if you need any good reference about this subject you'll find it here:

Getting active TCP/UDP connections on a box, by Axel Charpentier.


This article has no explicit license attached to it but may contain usage terms in the article text or the download files themselves. If in doubt please contact the author via the discussion board below.

A list of licenses authors might use can be found here


About the Author

Web Developer
Romania Romania
No Biography provided

Comments and Discussions

AnswerRe: What about speed ? Pinmembery0da5-Feb-05 23:25 
GeneralRe: What about speed ? PinmemberSmart K86-Feb-05 23:18 
Generalstack Memory Leak Pinmembermervick26-Jan-05 16:43 
GeneralRe: stack Memory Leak Pinmembery0da26-Jan-05 21:22 
GeneralRe: stack Memory Leak Pinmembermervick27-Jan-05 16:17 
GeneralRe: stack Memory Leak Pinmembery0da27-Jan-05 21:19 
Generalenetstat on winnt and Win2k and NT4 Pinmembery0da27-Apr-04 21:25 
GeneralAllocateAndGetTcpExTableFromStack for Windows 2000 Pinmemberblakeo2314-Apr-04 9:39 
GeneralRe: AllocateAndGetTcpExTableFromStack for Windows 2000 PinsussAnonymous14-Apr-04 21:01 
GeneralRe: AllocateAndGetTcpExTableFromStack for Windows 2000 Pinmemberblakeo2315-Apr-04 1:10 
QuestionHow to close UDP ports ? Pinmembermarcosvelasco16-Dec-03 6:21 
AnswerRe: How to close UDP ports ? PinsussAnonymous19-Dec-03 11:29 
GeneralA free tool called Active Ports can work under Windows 2K PinmemberJohannowic19-Nov-03 20:25 
GeneralRe: A free tool called Active Ports can work under Windows 2K Pinmembery0da20-Nov-03 1:30 
GeneralWindows 2000 and XP... Pinmembermarcosvelasco18-Nov-03 8:00 
GeneralRe: Windows 2000 and XP... Pinmembery0da19-Nov-03 1:10 
GeneralRe: Windows 2000 and XP... PinsussAnonymous4-Dec-03 0:54 
GeneralVery good PinmemberDaniel Turini17-Nov-03 12:34 
GeneralRe: Very good Pinmembery0da18-Nov-03 3:46 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.

| Advertise | Privacy | Terms of Use | Mobile
Web04 | 2.8.150414.1 | Last Updated 17 Nov 2003
Article Copyright 2003 by y0da
Everything else Copyright © CodeProject, 1999-2015
Layout: fixed | fluid