CODEWITHSUNDEEP
c#socketsnetwork-programming
tanasi
tanasi

Reputation: 1804

Information about remote IP addresses

I want to track all IP addresses with which my computer is communicating. I am using C# and Visual Studio. There is one listBox in which I will put all remote IP address. I am new to network programming so I need some direction about that kind of problem.

My question is how to do this? How to get information about remote IP addresses which which my computer make connections?

Upvotes: 3

Views: 5822

Answers (4)

Mark H
Mark H

Reputation: 13907

On Windows, there's an IP helper library, iphlpapi, which can discover information about open connections on your machine. In particular, you want to look at the GetTcpTable and GetUdpTable functions.

The problem is this is a C API. To use these from C# requires you to use the P/Invoke API. It's a trivial task, but can take some time to do. Each of the C structs used need rewriting in C#, making use of the System.Runtime.InteropServices namespace to marshal them. Much of this can be automated, or done by decorating struct fields with the correct attributes, but there may be cases where you need to marshal a structure manually.

The C functions you import need marking with [DllImport("iphlpapi.dll")] with any other relevant attributes depending on the function you're importing. You can read more about PInvoke at msdn, and perhaps find some already written imports at the pinvoke wiki. In addition, there is a tool which can attempt to automate much of it for you, the Pinvoke interop assitant

Upvotes: 2

Tim Lloyd
Tim Lloyd

Reputation: 38494

You could leverage the netstat command to get information about which IP addresses and ports your machine is communicating with. You could run this command on a regular basis and parse the text output.

For example, the following command will list the state of all connections including local and remote connection details:

C:\Users\chibacity>netstat -a -n

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    10.0.0.107:32495       209.85.229.125:5222    ESTABLISHED
  TCP    10.0.0.107:32507       209.85.229.125:5222    ESTABLISHED
  TCP    10.0.0.107:32520       209.85.229.18:443      ESTABLISHED
  TCP    10.0.0.107:32755       209.85.227.109:993     ESTABLISHED
  //etc...

Or if you have admin privilleges you can get executable details too:

PS C:\Windows\system32> netstat -a -n -b

Active Connections

  Proto  Local Address          Foreign Address        State
  TCP    10.0.0.107:32495       209.85.229.125:5222    ESTABLISHED
 [googletalk.exe]
  TCP    10.0.0.107:32507       209.85.229.125:5222    ESTABLISHED
 [chrome.exe]
  TCP    10.0.0.107:32520       209.85.229.18:443      ESTABLISHED
 [chrome.exe]
  TCP    10.0.0.107:32755       209.85.227.109:993     ESTABLISHED
  //etc...

You can call this command from .Net using System.Diagnostics.Process and parse the text output, e.g:

http://msdn.microsoft.com/en-us/library/system.diagnostics.process.standardoutput.aspx

Upvotes: 3

chubbsondubs
chubbsondubs

Reputation: 38885

Most socket programming applications talk to the TCP socket API that's roughly standardized between operating systems. If you just want to write a simple server and visualize the clients talking to your server running in your process that's pretty easy. However, your process can't see the socket connections talking to other processes on your machine with the typical socket API.

If you want to get access to all IPs the entire machine is talking too you'll have to use a lower level API. That's not standardized between OS. For Windows I'd look at Winsock API to see if you can find how to look at the tcp/ip stack of the OS. It gets more complex because TCP connections ride on top of IP packets. At what level do you want to look at? Just TCP, or all protocols that also ride on top of IP. ARP, UDP, TCP, ICMP to name a view standard ones.

If you're just learning then doing just a simple server, and all the connections talking to that server in your process is much simpler. Going lower is going to be jumping into the deep end quickly. Not that I'm saying you shouldn't this. Would you like to keep it simple and stay with the connections your process is talking to, or would you like to go into the deep dark Window's forest? Choose your adventure.

Edit: Better option for lower level access is WinPcap with a C# wrapper. That will let you get the raw packet information. Even let you put your PC in promiscuous mode and sniff all traffic on your subnet not just your PC.

Upvotes: 2

veljkoz
veljkoz

Reputation: 8512

Assuming you have ObservableCollection<string> mAccessInfo somewhere in your code as a publicly visible variable bound to your list, you could place this in the part of the code where you listen for connections:

Socket socketForClient = tcpListener.AcceptSocket( );

if (socketForClient.Connected)
{
    mAccessInfo.Add(socketForClient.RemoteEndPoint.ToString());
    //do other stuff...
}

Since it's ObservableCollection, on each new connection that enters the list, the list you're bound to is updated.

Edit: As Cody Gray pointed out, this won't work if you have IP's in between as proxy/router/NAT etc...

Upvotes: 1

Related Questions