Detect the TCP and UDP connections direction

Posted on 2005-04-21
Last Modified: 2012-05-05
Hi ,

I was create a monitor TCP/UDP connection program and work fine.I'am interesting to add a new field (direction) that show if one connection was established by a local PC or by a Host PC.The informations that I' have are:

Local IP:        ex. 192.168.01
Local Port:     ex. 1569
Remore IP:    ex. 192.168.07
Remote Port: ex. 80

For retrive the connections I use GetTcpTable and GetUdpTable.Can anyone help me to find the solution ?

Thanks !
Question by:Marco_Panza
    LVL 86

    Expert Comment

    IMHO there's no "clean" way to do that, but the port number should help - if it is a "well known" port, the connection was established by the "other" machine, e.g.

    // Declare and initialize variables
    PMIB_TCPTABLE pTcpTable;

    pTcpTable = (MIB_TCPTABLE*) malloc(sizeof(MIB_TCPTABLE));
    DWORD dwSize = 0;

    // Make an initial call to GetTcpTable to
    // get the necessary size into the dwSize variable
    if (GetTcpTable(pTcpTable, &dwSize, TRUE) == ERROR_INSUFFICIENT_BUFFER) {
      pTcpTable = (MIB_TCPTABLE*) malloc ((UINT) dwSize);

    // Make a second call to GetTcpTable to get
    // the actual data we require
    if ((dwRetVal = GetTcpTable(pTcpTable, &dwSize, TRUE)) == NO_ERROR) {
      for (int i = 0; i < (int) pTcpTable->dwNumEntries; i++) {
        printf("State: %ld\n", pTcpTable->table[i].dwState);

                printf("...established from remote host\n");
                printf("...established from local host\n");

    Author Comment

    This is very iteresting trick !!!

    The local port can help.I have find another way (but i don't known if is correct).Please send me your comment:

    If the local PC accept one connection must bind first the local port and the local port is locked.
    If the local PC try to connect to another PC not bind the local port and the local port is not locked.

    If is true , simply I try to bind the local port with address = ADDR_ANY .

    If the operation fail the connection was established from remote host (the local PC was bind and lock the local port).

    I'am not a network expert.What you think ?

    Thanks again !

    LVL 86

    Accepted Solution

    >>If the local PC accept one connection must bind first the local port and the local port is locked.
    >>If the local PC try to connect to another PC not bind the local port and the local port is not locked.

    That sounds OK. The problem in general is that apart from that there's no certain way to detect whether a socket link was established by "accept()" or "connect()", that's why I wrote that there's no clean way - "clean" in terms that you cannot be absolutely sure, since not every service/port is listed as "well known".

    Author Comment

    OK Very good !

    Another simply question:IF the connection was established by remote PC the direction is incoming and if the connection was established by local PC the connection is oucoming.This is true ? or not ?

    Thanks !

    LVL 86

    Expert Comment

    I'd say "yes", since that would be the reverse logic.

    Write Comment

    Please enter a first name

    Please enter a last name

    We will never share this with anyone.

    Featured Post

    How your wiki can always stay up-to-date

    Quip doubles as a “living” wiki and a project management tool that evolves with your organization. As you finish projects in Quip, the work remains, easily accessible to all team members, new and old.
    - Increase transparency
    - Onboard new hires faster
    - Access from mobile/offline

    In days of old, returning something by value from a function in C++ was necessarily avoided because it would, invariably, involve one or even two copies of the object being created and potentially costly calls to a copy-constructor and destructor. A…
    Written by John Humphreys C++ Threading and the POSIX Library This article will cover the basic information that you need to know in order to make use of the POSIX threading library available for C and C++ on UNIX and most Linux systems.   [s…
    The viewer will learn how to pass data into a function in C++. This is one step further in using functions. Instead of only printing text onto the console, the function will be able to perform calculations with argumentents given by the user.
    The viewer will be introduced to the technique of using vectors in C++. The video will cover how to define a vector, store values in the vector and retrieve data from the values stored in the vector.

    759 members asked questions and received personalized solutions in the past 7 days.

    Join the community of 500,000 technology professionals and ask your questions.

    Join & Ask a Question

    Need Help in Real-Time?

    Connect with top rated Experts

    13 Experts available now in Live!

    Get 1:1 Help Now