MIB_TCPROW2 structure (tcpmib.h)
The MIB_TCPROW2 structure contains information that describes an IPv4 TCP connection.
Syntax
typedef struct _MIB_TCPROW2 {
DWORD dwState;
DWORD dwLocalAddr;
DWORD dwLocalPort;
DWORD dwRemoteAddr;
DWORD dwRemotePort;
DWORD dwOwningPid;
TCP_CONNECTION_OFFLOAD_STATE dwOffloadState;
} MIB_TCPROW2, *PMIB_TCPROW2;
Members
dwState
Type: DWORD
The state of the TCP connection. This member can be one of the values defined in the Iprtrmib.h header file.
On the Windows SDK released for Windows Vista and later, the organization of header files has changed. This member can be one of the values from the MIB_TCP_STATE enumeration defined in the Tcpmib.h header file, not in the Iprtrmib.h header file. Note that the Tcpmib.h header file is automatically included in Iprtrmib.h, which is automatically included in the Iphlpapi.h header file. The Tcpmib.h and Iprtrmib.h header files should never be used directly.
dwLocalAddr
Type: DWORD
The local IPv4 address for the TCP connection on the local computer. A value of zero indicates the listener can accept a connection on any interface.
dwLocalPort
Type: DWORD
The local port number in network byte order for the TCP connection on the local computer.
The maximum size of an IP port number is 16 bits, so only the lower 16 bits should be used. The upper 16 bits may contain uninitialized data.
dwRemoteAddr
Type: DWORD
The IPv4 address for the TCP connection on the remote computer. When the dwState member is MIB_TCP_STATE_LISTEN, this value has no meaning.
dwRemotePort
Type: DWORD
The remote port number in network byte order for the TCP connection on the remote computer. When the dwState member is MIB_TCP_STATE_LISTEN, this member has no meaning.
The maximum size of an IP port number is 16 bits, so only the lower 16 bits should be used. The upper 16 bits may contain uninitialized data.
dwOwningPid
Type: DWORD
The PID of the process that issued a context bind for this TCP connection.
dwOffloadState
Type: TCP_CONNECTION_OFFLOAD_STATE
The offload state for this TCP connection. This parameter can be one of the enumeration values for the TCP_CONNECTION_OFFLOAD_STATE defined in the Tcpmib.h header.
Remarks
The GetTcpTable2 function retrieves the IPv4 TCP connection table on the local computer and returns this information in a MIB_TCPTABLE2 structure.
An array of MIB_TCPROW2 structures are contained in the MIB_TCPTABLE2 structure.
The dwState member indicates the state of the TCP entry in a TCP state diagram. A TCP connection progresses through a series of states during its lifetime. The states are: LISTEN, SYN-SENT, SYN-RECEIVED, ESTABLISHED, FIN-WAIT-1, FIN-WAIT-2, CLOSE-WAIT, CLOSING, LAST-ACK, TIME-WAIT, and the fictional state CLOSED. The CLOSED state is fictional because it represents the state when there is no Transmission Control Block, and therefore, no connection. The TCP protocol is described in RFC 793. For more information, see http://www.ietf.org/rfc/rfc793.txt.
The dwLocalPort, and dwRemotePort members are in network byte order. In order to use the dwLocalPort or dwRemotePort members, the ntohs or inet_ntoa functions in Windows Sockets or similar functions may be needed. The dwLocalAddr and dwRemoteAddr members are stored as a DWORD in the same format as the in_addr structure. In order to use the dwLocalAddr or dwRemoteAddr members, the ntohl or inet_ntoa functions in Windows Sockets or similar functions may be needed. On Windows Vista and later, the RtlIpv4AddressToString or RtlIpv4AddressToStringEx functions may be used to convert the IPv4 address in the dwLocalAddr or dwRemoteAddr members to a string without loading the Windows Sockets DLL.
Examples
The following example retrieves the TCP connection table for IPv4 and prints the state of each connection represented as a MIB_TCPROW2 structure.
#include <winsock2.h>
#include <ws2tcpip.h>
#include <iphlpapi.h>
#include <stdio.h>
// Need to link with Iphlpapi.lib and Ws2_32.lib
#pragma comment(lib, "iphlpapi.lib")
#pragma comment(lib, "ws2_32.lib")
#define MALLOC(x) HeapAlloc(GetProcessHeap(), 0, (x))
#define FREE(x) HeapFree(GetProcessHeap(), 0, (x))
/* Note: could also use malloc() and free() */
int main()
{
// Declare and initialize variables
PMIB_TCPTABLE2 pTcpTable;
ULONG ulSize = 0;
DWORD dwRetVal = 0;
char szLocalAddr[128];
char szRemoteAddr[128];
struct in_addr IpAddr;
int i;
pTcpTable = (MIB_TCPTABLE2 *) MALLOC(sizeof (MIB_TCPTABLE2));
if (pTcpTable == NULL) {
printf("Error allocating memory\n");
return 1;
}
ulSize = sizeof (MIB_TCPTABLE);
// Make an initial call to GetTcpTable2 to
// get the necessary size into the ulSize variable
if ((dwRetVal = GetTcpTable2(pTcpTable, &ulSize, TRUE)) ==
ERROR_INSUFFICIENT_BUFFER) {
FREE(pTcpTable);
pTcpTable = (MIB_TCPTABLE2 *) MALLOC(ulSize);
if (pTcpTable == NULL) {
printf("Error allocating memory\n");
return 1;
}
}
// Make a second call to GetTcpTable2 to get
// the actual data we require
if ((dwRetVal = GetTcpTable2(pTcpTable, &ulSize, TRUE)) == NO_ERROR) {
printf("\tNumber of entries: %d\n", (int) pTcpTable->dwNumEntries);
for (i = 0; i < (int) pTcpTable->dwNumEntries; i++) {
printf("\n\tTCP[%d] State: %ld - ", i,
pTcpTable->table[i].dwState);
switch (pTcpTable->table[i].dwState) {
case MIB_TCP_STATE_CLOSED:
printf("CLOSED\n");
break;
case MIB_TCP_STATE_LISTEN:
printf("LISTEN\n");
break;
case MIB_TCP_STATE_SYN_SENT:
printf("SYN-SENT\n");
break;
case MIB_TCP_STATE_SYN_RCVD:
printf("SYN-RECEIVED\n");
break;
case MIB_TCP_STATE_ESTAB:
printf("ESTABLISHED\n");
break;
case MIB_TCP_STATE_FIN_WAIT1:
printf("FIN-WAIT-1\n");
break;
case MIB_TCP_STATE_FIN_WAIT2:
printf("FIN-WAIT-2 \n");
break;
case MIB_TCP_STATE_CLOSE_WAIT:
printf("CLOSE-WAIT\n");
break;
case MIB_TCP_STATE_CLOSING:
printf("CLOSING\n");
break;
case MIB_TCP_STATE_LAST_ACK:
printf("LAST-ACK\n");
break;
case MIB_TCP_STATE_TIME_WAIT:
printf("TIME-WAIT\n");
break;
case MIB_TCP_STATE_DELETE_TCB:
printf("DELETE-TCB\n");
break;
default:
wprintf(L"UNKNOWN dwState value: %d\n", pTcpTable->table[i].dwState);
break;
}
IpAddr.S_un.S_addr = (u_long) pTcpTable->table[i].dwLocalAddr;
strcpy_s(szLocalAddr, sizeof (szLocalAddr), inet_ntoa(IpAddr));
printf("\tTCP[%d] Local Addr: %s\n", i, szLocalAddr);
printf("\tTCP[%d] Local Port: %d \n", i,
ntohs((u_short)pTcpTable->table[i].dwLocalPort));
IpAddr.S_un.S_addr = (u_long) pTcpTable->table[i].dwRemoteAddr;
strcpy_s(szRemoteAddr, sizeof (szRemoteAddr), inet_ntoa(IpAddr));
printf("\tTCP[%d] Remote Addr: %s\n", i, szRemoteAddr);
printf("\tTCP[%d] Remote Port: %d\n", i,
ntohs((u_short)pTcpTable->table[i].dwRemotePort));
printf("\tTCP[%d] Owning PID: %d\n", i, pTcpTable->table[i].dwOwningPid);
printf("\tTCP[%d] Offload State: %ld - ", i,
pTcpTable->table[i].dwOffloadState);
switch (pTcpTable->table[i].dwOffloadState) {
case TcpConnectionOffloadStateInHost:
printf("Owned by the network stack and not offloaded \n");
break;
case TcpConnectionOffloadStateOffloading:
printf("In the process of being offloaded\n");
break;
case TcpConnectionOffloadStateOffloaded:
printf("Offloaded to the network interface control\n");
break;
case TcpConnectionOffloadStateUploading:
printf("In the process of being uploaded back to the network stack \n");
break;
default:
printf("UNKNOWN Offload state value\n");
break;
}
}
} else {
printf("\tGetTcpTable2 failed with %d\n", dwRetVal);
FREE(pTcpTable);
return 1;
}
if (pTcpTable != NULL) {
FREE(pTcpTable);
pTcpTable = NULL;
}
return 0;
}
Requirements
| Requirement | Value |
|---|---|
| Minimum supported client | Windows Vista [desktop apps only] |
| Minimum supported server | Windows Server 2008 [desktop apps only] |
| Header | tcpmib.h (include Iphlpapi.h) |