[StructLayout(LayoutKind.Sequential)]
struct MIB_TCPROW_OWNER_PID {
public TcpState state;
public uint localAddr;
public byte localPort1;
public byte localPort2;
public byte localPort3;
public byte localPort4;
public uint remoteAddr;
public byte remotePort1;
public byte remotePort2;
public byte remotePort3;
public byte remotePort4;
public int owningPid;
}
Structure MIB_TCPROW_OWNER_PID
public TcpState state;
public uint localAddr;
public byte localPort1;
public byte localPort2;
public byte localPort3;
public byte localPort4;
public uint remoteAddr;
public byte remotePort1;
public byte remotePort2;
public byte remotePort3;
public byte remotePort4;
public int owningPid;
End Structure
None.
This table entry is specifically returned by a call to GetExtendedTcpTable with the TableClass parameter set to a TCP_TABLE_OWNER_PID_* value from the TCP_TABLE_CLASS enumeration and the ulAf parameter set to AF_INET4.
Ports are broken up by bytes. (This is the same as the standard library does it). High order by is returned first. Port 139 would be represented as localPort1 =0, localPort2=139, localPort3=0, localPort4=0, where as 5800 would be localPort1=22, localPort2=168, etc..., MSDN shows these as being DWORD.