*--首先感謝網友dkfdtf對GetTcpTable方法的編寫，才使我輕意的寫成了GetExtendedTcpTable
*--API-GetTcpTable：結果含有遠程地址爲空的記錄，但不含有PID(進程ID)
Clear
#Define ERROR_INSUFFICIENT_BUFFER 122
Declare Long GetTcpTable In Iphlpapi String @pTcpTable,Long @pdwSize,Long Border
Declare String inet_ntoa In wsock32 Long inn
m.pTcpTable=''
m.pdwSize=0
m.iResult=GetTcpTable(@m.pTcpTable,@m.pdwSize,1)
If (ERROR_INSUFFICIENT_BUFFER!=m.iResult)
?'錯誤,Windows 錯誤代碼:',m.iResult
Return
Endif
m.pTcpTable=Replicate(Chr(0),m.pdwSize)
m.iResult=GetTcpTable(@m.pTcpTable,@m.pdwSize,1)
If (0!=m.iResult)
?'錯誤,Windows 錯誤代碼:',m.iResult
Return
Endif
m.iCount=CToBin(Left(m.pTcpTable,4),'rs')
m.pTcpTable=Substr(m.pTcpTable,5)
?"API-GetTcpTable：結果含有遠程地址爲空的記錄，但不含有PID(進程ID)"
?Padr('LocalAddr',18)+Padr('LocalPort',15)+Padr('RemoteAddr',18)+Padr('RemotePort',15),'State'
?'------------------------------------------------------------------------'
For m.ii=1 To m.iCount
m.cMIB_TCPROW=Substr(m.pTcpTable,1+(m.ii-1)*20,20)
m.iState=CToBin(Substr(m.cMIB_TCPROW,1,4),'rs')
m.iLocalAddr=CToBin(Substr(m.cMIB_TCPROW,5,4),'rs')
m.iLocalPort=CToBin(Substr(m.cMIB_TCPROW,9,4),'rs')
m.iRemoteAddr=CToBin(Substr(m.cMIB_TCPROW,13,4),'rs')
m.iRemotePort=CToBin(Substr(m.cMIB_TCPROW,17,4),'rs')
?Padr(inet_ntoa(m.iLocalAddr),18);
+Padr(Int(m.iLocalPort/256+(m.iLocalPort%256)*256),15);
+Padr(inet_ntoa(m.iRemoteAddr),18);
+Padr(Int(m.iRemotePort/256+(m.iRemotePort%256)*256),15),;
Icase(m.iState=1,'CLOSED',m.iState=2,'LISTENING',m.iState=3,'SYN-SENT',m.iState=4,'SYN-RECEIVED',m.iState=5,'ESTABLISHED',m.iState=6,'FIN-WAIT-1',;
m.iState=7,'FIN-WAIT-2',m.iState=8,'CLOSE-WAIT',m.iState=9,'CLOSING',m.iState=10,'LAST-ACK',m.iState=11,'TIME-WAIT',m.iState=12,'DELETE-TCB','UNKNOWN')
Endfor
Clear Dlls
*--API-GetExtendedTcpTable：結果含有PID(進程ID)，但不含有遠程地址爲空的記錄。
*Clear
?'--------------------------------------------------------------------------------------'
#Define ERROR_INSUFFICIENT_BUFFER 122
#Define AF_INET 2
#Define TCP_TABLE_OWNER_PID_ALL 4
Declare Long GetExtendedTcpTable In Iphlpapi String @pTcpTable,Long @pdwSize,Long Border,Long ByVal,Long TableClass,Long ByVal
Declare String inet_ntoa In wsock32 Long inn
m.pTcpTable=''
m.pdwSize=0
m.iResult=GetExtendedTcpTable(@m.pTcpTable,@m.pdwSize,1,AF_INET,TCP_TABLE_OWNER_PID_ALL,0)
If (ERROR_INSUFFICIENT_BUFFER!=m.iResult)
?'錯誤,Windows 錯誤代碼:',m.iResult
Return
Endif
m.pTcpTable=Replicate(Chr(0),m.pdwSize)
m.iResult=GetExtendedTcpTable(@m.pTcpTable,@m.pdwSize,1,AF_INET,TCP_TABLE_OWNER_PID_ALL,0)
If (0!=m.iResult)
?'錯誤,Windows 錯誤代碼:',m.iResult
Return
Endif
m.iCount=CToBin(Left(m.pTcpTable,4),'rs')
m.pTcpTable=Substr(m.pTcpTable,5)
?"API-GetExtendedTcpTable：結果含有PID(進程ID)，但不含有遠程地址爲空的記錄。"
?Padr('LocalAddr',18)+Padr('LocalPort',15)+Padr('RemoteAddr',18)+Padr('RemotePort',15),Padr('State',15),'PID'
?'--------------------------------------------------------------------------------------'
For m.ii=1 To m.iCount
m.cMIB_TCPROW=Substr(m.pTcpTable,1+(m.ii-1)*24,24)
m.iState=CToBin(Substr(m.cMIB_TCPROW,1,4),'rs')
m.iLocalAddr=CToBin(Substr(m.cMIB_TCPROW,5,4),'rs')
m.iLocalPort=CToBin(Substr(m.cMIB_TCPROW,9,4),'rs')
m.iRemoteAddr=CToBin(Substr(m.cMIB_TCPROW,13,4),'rs')
m.iRemotePort=CToBin(Substr(m.cMIB_TCPROW,17,4),'rs')
m.iPID=CToBin(Substr(m.cMIB_TCPROW,21,4),'rs')
?Padr(inet_ntoa(m.iLocalAddr),18);
+Padr(Int(m.iLocalPort/256+(m.iLocalPort%256)*256),15);
+Padr(inet_ntoa(m.iRemoteAddr),18);
+Padr(Int(m.iRemotePort/256+(m.iRemotePort%256)*256),15),;
Padr(Icase(m.iState=1,'CLOSED',m.iState=2,'LISTENING',m.iState=3,'SYN-SENT',m.iState=4,'SYN-RECEIVED',m.iState=5,'ESTABLISHED',m.iState=6,'FIN-WAIT-1',;
m.iState=7,'FIN-WAIT-2',m.iState=8,'CLOSE-WAIT',m.iState=9,'CLOSING',m.iState=10,'LAST-ACK',m.iState=11,'TIME-WAIT',m.iState=12,'DELETE-TCB','UNKNOWN'),15);
+Transform(m.iPID)
Endfor
Clear Dlls
*!* 在這裏我們詳細介紹一下state的四種監聽方式:
*!* 第一個是listening:監聽
*!* 第二個是Estalished:已連接
*!* 第三個是Close_wait:連接已結束
*!* 以上三個是經常出現的,下面的這兩個一般情況下是不會出現的:
*!* Fin_Wait_1:是等待對方的fin報文
*!* Syn_sent:是客戶端已發送SYN報文
*!* LAST_ACK:這個有時也會出現。
*!* 有的地方介紹的不一樣，平時在這們電腦是不會出現這麼多選項的：
*!* LISTEN：偵聽來自遠方的TCp端口的連接請求
*!* SYN-SENT：再發送連接請求後等待匹配的連接請求
*!* SYN-RECEIVED：再收到和發送一個連接請求後等待對方對連接請求的確認
*!* ESTAbLISHED：代表一個打開的連接
*!* FIN-WAIT-1：等待遠程TCp連接中斷請求，或先前的連接中斷請求的確認
*!* FIN-WAIT-2：從遠程TCp等待連接中斷請求
*!* CLOSE-WAIT：等待從本地用戶發來的連接中斷請求
*!* CLOSING：等待遠程TCp對連接中斷的確認
*!* LAST-ACK：等待原來的發向遠程TCp的連接中斷請求的確認
*!* TIME-WAIT：等待足夠的時間以確保遠程TCp接收到連接中斷請求的確認
*!* CLOSED：沒有任何連接狀態