• Status: Solved
  • Priority: Medium
  • Security: Public
  • Views: 335
  • Last Modified:

Detect the TCP and UDP connections direction

Hi ,

I was create a monitor TCP/UDP connection program and work fine.I'am interesting to add a new field (direction) that show if one connection was established by a local PC or by a Host PC.The informations that I' have are:

Local IP:        ex. 192.168.01
Local Port:     ex. 1569
Remore IP:    ex. 192.168.07
Remote Port: ex. 80
State:            ex. CLOSED , LISTENING , SYN_SENT , SYN_RCVD , ESTABLISHED , LAST_ACK , CLOSING , etc..

For retrive the connections I use GetTcpTable and GetUdpTable.Can anyone help me to find the solution ?

Thanks !
0
Marco_Panza
Asked:
Marco_Panza
  • 3
  • 2
1 Solution
 
jkrCommented:
IMHO there's no "clean" way to do that, but the port number should help - if it is a "well known" port, the connection was established by the "other" machine, e.g.

// Declare and initialize variables
PMIB_TCPTABLE pTcpTable;

pTcpTable = (MIB_TCPTABLE*) malloc(sizeof(MIB_TCPTABLE));
DWORD dwSize = 0;

// Make an initial call to GetTcpTable to
// get the necessary size into the dwSize variable
if (GetTcpTable(pTcpTable, &dwSize, TRUE) == ERROR_INSUFFICIENT_BUFFER) {
  GlobalFree(pTcpTable);
  pTcpTable = (MIB_TCPTABLE*) malloc ((UINT) dwSize);
}

// Make a second call to GetTcpTable to get
// the actual data we require
if ((dwRetVal = GetTcpTable(pTcpTable, &dwSize, TRUE)) == NO_ERROR) {
  for (int i = 0; i < (int) pTcpTable->dwNumEntries; i++) {
    printf("State: %ld\n", pTcpTable->table[i].dwState);

      if(getservbyport(pTcpTable->dwLocalPort,NULL))
            printf("...established from remote host\n");
        else
            printf("...established from local host\n");
            
  }
}
0
 
Marco_PanzaAuthor Commented:
This is very iteresting trick !!!

The local port can help.I have find another way (but i don't known if is correct).Please send me your comment:

If the local PC accept one connection must bind first the local port and the local port is locked.
If the local PC try to connect to another PC not bind the local port and the local port is not locked.

If is true , simply I try to bind the local port with address = ADDR_ANY .

If the operation fail the connection was established from remote host (the local PC was bind and lock the local port).

I'am not a network expert.What you think ?

Thanks again !

Marco
0
 
jkrCommented:
>>If the local PC accept one connection must bind first the local port and the local port is locked.
>>If the local PC try to connect to another PC not bind the local port and the local port is not locked.

That sounds OK. The problem in general is that apart from that there's no certain way to detect whether a socket link was established by "accept()" or "connect()", that's why I wrote that there's no clean way - "clean" in terms that you cannot be absolutely sure, since not every service/port is listed as "well known".
0
 
Marco_PanzaAuthor Commented:
OK Very good !

Another simply question:IF the connection was established by remote PC the direction is incoming and if the connection was established by local PC the connection is oucoming.This is true ? or not ?

Thanks !

Marco
0
 
jkrCommented:
I'd say "yes", since that would be the reverse logic.
0

Featured Post

Technology Partners: We Want Your Opinion!

We value your feedback.

Take our survey and automatically be enter to win anyone of the following:
Yeti Cooler, Amazon eGift Card, and Movie eGift Card!

  • 3
  • 2
Tackle projects and never again get stuck behind a technical roadblock.
Join Now