struct MIB_TCPROW_OWNER_PID {
public TcpState state;
public uint localAddr;
public byte localPort1;
public byte localPort2;
public byte localPort3;
public byte localPort4;
public uint remoteAddr;
public byte remotePort1;
public byte remotePort2;
public byte remotePort3;
public byte remotePort4;
public int owningPid;
}
Structure MIB_TCPROW_OWNER_PID
public TcpState state;
public uint localAddr;
public byte localPort1;
public byte localPort2;
public byte localPort3;
public byte localPort4;
public uint remoteAddr;
public byte remotePort1;
public byte remotePort2;
public byte remotePort3;
public byte remotePort4;
public int owningPid;
End Structure
None.
This table entry is specifically returned by a call to GetExtendedTcpTable with the TableClass parameter set to a TCP_TABLE_OWNER_PID_* value from the TCP_TABLE_CLASS enumeration and the ulAf parameter set to AF_INET4.
Ports are broken up by byes because of the way they are returned. (This is the same as the standard library does it).
High order by is returned first. Port 139 would be represented as localPort1 =0, localPort2=139, localPort3=0, localPort4=0,
where as 5800 would be localPort1=22, localPort2=168, etc..., MSDN shows these as being DWORD.