_GetAllConnections()

[Kip]

A better way to stop users using the internet, sorry JustinReno and Swift

A function to get all connections and info.

Per connection it will return:

$Return[n][0]Protocol: TCP/UDP

$Return[n][1]Process: Process-name ("explorer.exe",...)

$Return[n][2]PID: process identifier

$Return[n][3]Status: ESTABLISHED, SYN_SENT, SYN_RECV, FIN_WAIT1, FIN_WAIT2, TIME_WAIT, CLOSED, CLOSE_WAIT, LAST_ACK, LISTEN, CLOSING, or UNKNOWN

$Return[n][4]Local Host: Local Host ("127.0.0.1",@IPAddress1,...)

$Return[n][5]Remote Host: Remote Host ("google.com","yahoo.com",...)

$Return[0][0] contains the number of connections

Script: The five first includes/globals are required, RunErrorsFatal is optional.

expandcollapse popup

#include <Array.au3>
Opt("RunErrorsFatal", 0)

Global $WebUpdate = 1
Global $WebTotal
Global $WebPID
Global $WebNetstat = @ScriptDir& "\Netstat.exe"

$j = 0
While 1
    $j += 1
    $Connections = _GetAllConnections($WebNetstat)
    If IsArray($Connections) Then
        ToolTip("Loops between start and end: "& $j,10,10)
        _ArrayDisplay($Connections,"Current connections")
        ToolTip("")
        $j = 0
    EndIf
    
WEnd


Func _GetAllConnections($NetstatPath="netstat.exe")
    
    
    Switch $WebUpdate
        Case 1
            $WebPID = Run($NetstatPath &" -b","",@SW_HIDE,7)
            $WebTotal = StdoutRead($WebPID)
            $WebUpdate = 2
            Return 0
            
        Case 2
            
            If ProcessExists($WebPID) Then
                $WebTotal &= StdoutRead($WebPID)
            Else
                $WebUpdate = 3
            EndIf
            Return 0
            
        Case 3
            
            
            Local $Return[1][6]
                $Return[0][0] = 0
            
            
            $Split = StringSplit($WebTotal,@CRLF)
            $Connections = ""
            $GetName = 0
            For $i = 1 to $Split[0]
                If $Split[$i] Then
                    
                    $Isplit = StringSplit($Split[$i]," ")
                    if $Isplit[1] = "TCP" Then
                        
                        for $Tweede = 2 to $Isplit[0]
                            If $Isplit[$Tweede] Then ExitLoop
                        Next
                
                        for $Derde = $Tweede+1 to $Isplit[0]
                            If $Isplit[$Derde] Then ExitLoop
                        Next
                        
                        for $Vierde = $Derde+1 to $Isplit[0]
                            If $Isplit[$Vierde] Then ExitLoop
                        Next
                        
                        for $Vijfde = $Vierde+1 to $Isplit[0]
                            If $Isplit[$Vijfde] Then ExitLoop
                        Next
                        
                        
                        $Type = $Isplit[1]
                        $PID = $Isplit[$Vijfde]
                        $Status = $Isplit[$Vierde]
                        $Local = $Isplit[$Tweede]
                        $Remote = $Isplit[$Derde]
                        
                        if $PID = "0" Then
                            
                            $Ubound = UBound($Return)
                            ReDim $Return[$Ubound+1][6]
                            $Ubound = UBound($Return)
                                
                                $Return[$Ubound-1][0] = $Type
                                $Return[$Ubound-1][1] = 0
                                $Return[$Ubound-1][2] = $PID
                                $Return[$Ubound-1][3] = $Status
                                $Return[$Ubound-1][4] = $Local
                                $Return[$Ubound-1][5] = $Remote
                            
                                $Return[0][0] += 1
                            
                            
                            
                        Else
                            
                            $ProcessSplit = StringSplit($Split[$i+2],"")
                            $PIDname = ""
                            for $ii = 1 to $ProcessSplit[0]
                                If $ProcessSplit[$ii] And $ProcessSplit[$ii] <> "[" and $ProcessSplit[$ii] <> "]" and $ProcessSplit[$ii] <> " " Then
                                    $PIDname &= $ProcessSplit[$ii]
                                EndIf
                            Next
                            
                            $Ubound = UBound($Return)
                            ReDim $Return[$Ubound+1][6]
                            $Ubound = UBound($Return)
                                
                                $Return[$Ubound-1][0] = $Type
                                $Return[$Ubound-1][1] = $PIDname
                                $Return[$Ubound-1][2] = $PID
                                $Return[$Ubound-1][3] = $Status
                                $Return[$Ubound-1][4] = $Local
                                $Return[$Ubound-1][5] = $Remote
                            
                                $Return[0][0] += 1
                            
                        EndIf
                    EndIf
                    
                    
                    
                EndIf
            Next
            
            $WebUpdate = 1
            
            Return $Return
            
    EndSwitch
    
EndFunc

Edited May 20, 2008 by Kip

[MrCreatoR]

It's not work for me

Maybe you should parse the returned data in a different way?

Something like this:

expandcollapse popup

#include <Process.au3>

$aConnections = _GetAllConnections()

If IsArray($aConnections) Then
    $sMsg = ""
    
    For $i = 1 To $aConnections[0][0]
        $Protocol = $aConnections[$i][0]
        $Process = $aConnections[$i][1]
        $PID = $aConnections[$i][2]
        $Status = $aConnections[$i][3]
        $Local = $aConnections[$i][4]
        $Remote = $aConnections[$i][5]
        
        $sMsg &= $Protocol & " " & @TAB & $Process & " " & @TAB & $PID & " " & @TAB & _
            $Status & " " & @TAB & $Local & " " & @TAB & $Remote & @CRLF
    Next
    
    ConsoleWrite("Connections Info:" & @LF & @LF & $sMsg)
EndIf

Func _GetAllConnections()
    Local $iOld_Opt_REF = Opt("RunErrorsFatal", 0)
    
    Local $iPID = Run(@SystemDir & "\netstat.exe -b", "", @SW_HIDE, 2 + 4)
    Local $sConnections = "", $aReturn[1][6]
    Local $aSplit_Connections, $aData_Split, $sType, $sPID, $sProcName, $sStatus, $sLocal, $sRemote, $iUbound
    
    While ProcessExists($iPID)
        $sConnections &= StdoutRead($iPID)
    WEnd
    
    $aSplit_Connections = StringSplit($sConnections, @CRLF)
    If @error Then Return SetError(1, 0, "")
    
    For $i = 1 To $aSplit_Connections[0]
        If $aSplit_Connections[$i] = "" Then ContinueLoop
        
        $aSplit_Connections[$i] = StringStripWS($aSplit_Connections[$i], 7)
        
        $aData_Split = StringSplit($aSplit_Connections[$i], " ")
        If UBound($aData_Split) < 4 Or $aData_Split[1] <> "TCP" Then ContinueLoop
        
        $sType = $aData_Split[1]
        $sPID = $aData_Split[$aData_Split[0]]
        $sProcName = _ProcessGetName($sPID)
        $sStatus = $aData_Split[4]
        $sLocal = $aData_Split[2]
        $sRemote = $aData_Split[3]
        
        $aReturn[0][0] += 1
        $iUbound = $aReturn[0][0]
        
        ReDim $aReturn[$iUbound + 1][6]
        
        $aReturn[$iUbound][0] = $sType
        $aReturn[$iUbound][1] = $sProcName
        $aReturn[$iUbound][2] = $sPID
        $aReturn[$iUbound][3] = $sStatus
        $aReturn[$iUbound][4] = $sLocal
        $aReturn[$iUbound][5] = $sRemote
    Next
    
    Opt("RunErrorsFatal", $iOld_Opt_REF)
    
    Return $aReturn
EndFunc   ;==>_GetAllConnections

[martin]

It's not work for me

Nor me, but on my laptop with XP SP1 I don't have an option for the parameter -b with netstat. On my PC with XP Pro I do.

[CoderDunn]

Nor me, but on my laptop with XP SP1 I don't have an option for the parameter -b with netstat. On my PC with XP Pro I do.

You could download and install SP2 (or even SP3) on your laptop from the microsoft website ...

Back to the main topic, this could be very usefull! Maybe someday a fire wall will be written in autoit ...

Edited March 3, 2008 by Hallman

[SmOke_N]

You could download and install SP2 (or even SP3) on your laptop from the microsoft website ...

Back to the main topic, this is very usefull! Maybe someday a fire wall will be written in autoit ...

Doesn't work on my SP2 as well .

Edit:

Meant to add that mscreators modded version does however.

Edited March 3, 2008 by SmOke_N

[CoderDunn]

Doesn't work on my SP2 as well .

Edit:

Meant to add that mscreators modded version does however.

I was getting it mixed up then. He made it sound like it was becuase of SP1 that it didn't work. This isn't one of those XP Pro only functions right? Like the DOS command "taskkill" ...

Microsoft likes to make things easy ... (sarcasm)

Even so I would still recommend upgrading to SP2.

Edited March 3, 2008 by Hallman

[martin]

You could download and install SP2 (or even SP3) on your laptop from the microsoft website ...

Yes, I've tried upgrading twice, and each time my laptop won't start up once the upgrade is complete. After spending many hours each time following suggestions from posts at various websites on how to sort it out and failing I reinstalled from backups and I have continued using SP1.

[walle]

Yes, I've tried upgrading twice, and each time my laptop won't start up once the upgrade is complete. After spending many hours each time following suggestions from posts at various websites on how to sort it out and failing I reinstalled from backups and I have continued using SP1.

Get hold on an installation disk with sp2 built-in

[ptrex]

@all

The version of MSCreator works fine in XP SP2.

This is a nice addition to my Firewall Log Analyser.

I added the ArrayDisplay to it.

expandcollapse popup

#include <Process.au3>
#include <Array.au3>

$aConnections = _GetAllConnections()

_ArrayDisplay($aConnections,"Connection Info")


Func _GetAllConnections()
    Local $iOld_Opt_REF = Opt("RunErrorsFatal", 0)
    
    Local $iPID = Run(@SystemDir & "\netstat.exe -b", "", @SW_HIDE, 2 + 4)
    Local $sConnections = "", $aReturn[1][6]
    Local $aSplit_Connections, $aData_Split, $sType, $sPID, $sProcName, $sStatus, $sLocal, $sRemote, $iUbound
    
    While ProcessExists($iPID)
        $sConnections &= StdoutRead($iPID)
    WEnd
    
    $aSplit_Connections = StringSplit($sConnections, @CRLF)
    If @error Then Return SetError(1, 0, "")
    
    For $i = 1 To $aSplit_Connections[0]
        If $aSplit_Connections[$i] = "" Then ContinueLoop
        
        $aSplit_Connections[$i] = StringStripWS($aSplit_Connections[$i], 7)
        
        $aData_Split = StringSplit($aSplit_Connections[$i], " ")
        If UBound($aData_Split) < 4 Or $aData_Split[1] <> "TCP" Then ContinueLoop
        
        $sType = $aData_Split[1]
        $sPID = $aData_Split[$aData_Split[0]]
        $sProcName = _ProcessGetName($sPID)
        $sStatus = $aData_Split[4]
        $sLocal = $aData_Split[2]
        $sRemote = $aData_Split[3]
        
        $aReturn[0][0] += 1
        $iUbound = $aReturn[0][0]
        
        ReDim $aReturn[$iUbound + 1][6]
        
        $aReturn[$iUbound][0] = $sType
        $aReturn[$iUbound][1] = $sProcName
        $aReturn[$iUbound][2] = $sPID
        $aReturn[$iUbound][3] = $sStatus
        $aReturn[$iUbound][4] = $sLocal
        $aReturn[$iUbound][5] = $sRemote
    Next
    
    Opt("RunErrorsFatal", $iOld_Opt_REF)
    
    Return $aReturn
EndFunc   ;==>_GetAllConnections

thanks

ptrex

Edited March 4, 2008 by ptrex

[MrCreatoR]

Here is a version without a need of using _ProcessGetName()...

The «netstat» provide process name, we just need to do some more parsing of the Std Stream, and it's much faster then _ProcessGetName() (where another loop is used).

expandcollapse popup

#include <Array.au3>

$aConnections = _GetAllConnections()

_ArrayDisplay($aConnections, "Connection Info")

Func _GetAllConnections()
    Local $iOld_Opt_REF = Opt("RunErrorsFatal", 0)
    
    Local $iPID = Run(@SystemDir & "\netstat.exe -b", "", @SW_HIDE, 2 + 4)
    Local $sConnections = "", $aReturn[1][6]
    Local $aSplit_Connections, $aData_Split, $sType, $sPID, $sProcName, $sStatus, $sLocal, $sRemote, $iUbound
    
    While ProcessExists($iPID)
        $sConnections &= StdoutRead($iPID)
    WEnd
    
    $aSplit_Connections = StringSplit($sConnections, @CRLF)
    If @error Then Return SetError(1, 0, "")
    
    For $i = 1 To $aSplit_Connections[0]
        If $aSplit_Connections[$i] = "" Then ContinueLoop
        
        $aSplit_Connections[$i] = StringStripWS($aSplit_Connections[$i], 7)
        
        $aData_Split = StringSplit($aSplit_Connections[$i], " ")
        If UBound($aData_Split) < 4 Or $aData_Split[1] <> "TCP" Then ContinueLoop
        
        $sPID = $aData_Split[$aData_Split[0]]
        $sType = $aData_Split[1]
        $sLocal = $aData_Split[2]
        $sRemote = $aData_Split[3]
        $sStatus = $aData_Split[4]
        
        If $i+2 <= $aSplit_Connections[0] Then $sProcName = StringStripWS($aSplit_Connections[$i+2], 3)
        If Not StringRegExp($sProcName, "\[.*\]") Then $sProcName = StringStripWS($aSplit_Connections[$i+1], 3)
        $sProcName = StringRegExpReplace($sProcName, "\[(.*)\]", "\1")
        
        $aReturn[0][0] += 1
        $iUbound = $aReturn[0][0]
        
        ReDim $aReturn[$iUbound + 1][6]
        
        $aReturn[$iUbound][0] = $sType
        $aReturn[$iUbound][1] = $sProcName
        $aReturn[$iUbound][2] = $sPID
        $aReturn[$iUbound][3] = $sStatus
        $aReturn[$iUbound][4] = $sLocal
        $aReturn[$iUbound][5] = $sRemote
    Next
    
    Opt("RunErrorsFatal", $iOld_Opt_REF)
    
    Return $aReturn
EndFunc   ;==>_GetAllConnections

I hope this will not broke the “workability” of the function

[Kip]

@MsCreator: you use this:

While ProcessExists($iPID)
          $sConnections &= StdoutRead($iPID)
    WEnd

but that will pause the main loop for a while, and thats not usable when you have a GUI.

@Hallman:

This isn't one of those XP Pro only functions right?

No, it comes pre-installed with all WindowsNT versions, even Unix. (I Hope)

@Martin: does option 'Netstat -o' exist? And what if you download my Netstat.exe and replace @SystemDir & "\netstat.exe -b" by the path to the downloaded netstat.

Btw: does anyone know how to kill a connection?

Edit:

The options which all windows versions support are -a, -e, -n, -p, -r, -s.

But none of them show the process or PID.

netstat.exe

Edited March 4, 2008 by kip

[Kip]

I uploaded the new script. Adjust the path variable to your Netstat.

If it doesnt work, try to put Netstat.exe (post above) in the same directory as the script.

I also removed _ProcessGetName() and added a nice little tooltip

See first post for script.

Edited March 4, 2008 by kip

[MrCreatoR]

that will pause the main loop for a while, and thats not usable when you have a GUI.

I don't really get the idea of your function then. If you need to collect (get) some data, you collect it and show it (or whatever you need to do with it), i don't see why you need the function to get part of the connections data, and the way you do it is a little complicated (than it should be) . Edited March 8, 2008 by MsCreatoR

[Kip]

it takes a while before the function finishes. And if you have a gui then you can press a button but nothing happens (until the func ends).

So I splitted the func, so while getting the info from netstat, you can do a view Guigetmsg checks.

(i've got the feeling that, that's bad english )

[MrCreatoR]

it takes a while before the function finishes. And if you have a gui then you can press a button but nothing happens (until the func ends).

So I splitted the func, so while getting the info from netstat, you can do a view Guigetmsg checks.

I would use this trick than..

expandcollapse popup

#include <GuiConstants.au3>
#include <Array.au3>

$GUI = GUICreate("_GetAllConnections()", 300, 200)

$GetConnections_Button = GUICtrlCreateButton("Get Connections", 20, 10, 120, 20)

$Button = GUICtrlCreateButton("Some Button", 20, 40, 80, 20)

GUISetState(@SW_SHOW, $GUI)

While 1
    Switch GUIGetMsg()
        Case $GUI_EVENT_CLOSE
            Exit
        Case $GetConnections_Button
            Local $aConnections = _GetAllConnections($GUI, $Button, "_ButtonEvent")
            _ArrayDisplay($aConnections, "Connection Info")
        Case $Button
            ConsoleWrite("Ok, button pressed" & @LF)
    EndSwitch
WEnd

Func _GetAllConnections($hWnd=0, $iCtrlID=0, $sFuncToCall="")
    Local $iOld_Opt_REF = Opt("RunErrorsFatal", 0)
    
    Local $iPID = Run(@SystemDir & "\netstat.exe -b", "", @SW_HIDE, 2 + 4)
    Local $sConnections = "", $aReturn[1][6]
    Local $aSplit_Connections, $aData_Split, $sType, $sPID, $sProcName, $sStatus, $sLocal, $sRemote, $iUbound
    
    While ProcessExists($iPID)
        $sConnections &= StdoutRead($iPID)
        
        If IsHWnd($hWnd) Then
            $aCurInfo = GUIGetCursorInfo($hWnd)
            If $aCurInfo[2] = 1 And $aCurInfo[4] = $iCtrlID Then Call($sFuncToCall)
        EndIf
    WEnd
    
    $aSplit_Connections = StringSplit($sConnections, @CRLF)
    If @error Then Return SetError(1, 0, "")
    
    For $i = 1 To $aSplit_Connections[0]
        If $aSplit_Connections[$i] = "" Then ContinueLoop
        
        $aSplit_Connections[$i] = StringStripWS($aSplit_Connections[$i], 7)
        
        $aData_Split = StringSplit($aSplit_Connections[$i], " ")
        If UBound($aData_Split) < 4 Or $aData_Split[1] <> "TCP" Then ContinueLoop
        
        $sPID = $aData_Split[$aData_Split[0]]
        $sType = $aData_Split[1]
        $sLocal = $aData_Split[2]
        $sRemote = $aData_Split[3]
        $sStatus = $aData_Split[4]
        
        If $i+2 <= $aSplit_Connections[0] Then $sProcName = StringStripWS($aSplit_Connections[$i+2], 3)
        If Not StringRegExp($sProcName, "\[.*\]") Then $sProcName = StringStripWS($aSplit_Connections[$i+1], 3)
        $sProcName = StringRegExpReplace($sProcName, "\[(.*)\]", "\1")
        
        $aReturn[0][0] += 1
        $iUbound = $aReturn[0][0]
        
        ReDim $aReturn[$iUbound + 1][6]
        
        $aReturn[$iUbound][0] = $sType
        $aReturn[$iUbound][1] = $sProcName
        $aReturn[$iUbound][2] = $sPID
        $aReturn[$iUbound][3] = $sStatus
        $aReturn[$iUbound][4] = $sLocal
        $aReturn[$iUbound][5] = $sRemote
    Next
    
    Opt("RunErrorsFatal", $iOld_Opt_REF)
    
    Return $aReturn
EndFunc   ;==>_GetAllConnections

Func _ButtonEvent()
    ConsoleWrite("Ok, button pressed" & @LF)
EndFunc   ;==>_ButtonEvent

[Kip]

thats possible too.

[Mojo]

Sure in the windows\system32 dir, taskkill.exe is command line proggy to kill tasks

Taskkill kills a task, not a connection.

for example, you might want to close a single connection to a specific host, in let's say your Peer2Peer Client, but not close the process itself.

Huge difference.

[duckling78]

(Sorry for resurrecting an old topic)

"netstat -b" requires administrative privs. TcpView is a nice alternative to tracking process network usage and does not require admin privs.

On Vista if you do not have an elevated process while UAC is turned on, "netstat -b" will fail. Generally scripts will need #RequireAdmin keyword to get it to work with "netstat -b".

Here is an example script using TcpView:

http://www.autoitscript.com/forum/index.ph...mp;#entry599725

[madasraka]

so weird how lots of posted codes dont work with all OS's (speaking for my self)

Why not test them to make sure everyone can use/test it before saying "Woopty doo i made an app that works only on my computer so good luck fixing it"

I have Win7 64bit and none of the above examples worked for me but removing

lines with

Opt("RunErrorsFatal", 0,)

hepled. Edited October 27, 2010 by madasraka

[wraithdu]

Maybe when that code was posted, the then current version of AutoIt supported that particular Opt() directive. As the language has progressed, perhaps it has become a deprecated option. Perhaps you need to think a little harder and look at the date of the last post...