 |
|
服务器点击TOP10 |
 |
|
网络冲浪点击TOP10 |
|
|
|
|
| 在xp和2003下察看端口对应的进程 |
| 作者:我去下载 时间:2006-2-9 20:42:31 |
|
|
==========================================*/ 我们都知道fport.exe只能在2000下运行,那么有没有办法在xp和2003下察看端口对应的信息呢?答案是肯定的:) 首先让我们来熟悉几条命令和程序的用法吧: netstat -ano//这个命令是列出当前网络连接状况,并且列出端口对应程序的pid tlist.exe //在2000和xp安装盘的Support\Tools目录下,support.cab 压缩包自带的一个工具,可以查看指定pid对应的进程信息 让我们来看看运行效果吧 以下是netstat-ano在cmd中的运行结果:
Active Connections
ProtoLocal AddressForeign AddressState PID TCP0.0.0.0:42 0.0.0.0:0LISTENING 1524 TCP0.0.0.0:80 0.0.0.0:0LISTENING 1616 TCP0.0.0.0:1350.0.0.0:0LISTENING 660 TCP0.0.0.0:4450.0.0.0:0LISTENING 4 TCP0.0.0.0:1025 0.0.0.0:0LISTENING 496 TCP0.0.0.0:1026 0.0.0.0:0LISTENING 984 TCP0.0.0.0:1031 0.0.0.0:0LISTENING 1576 TCP0.0.0.0:1033 0.0.0.0:0LISTENING 1524 TCP0.0.0.0:1433 0.0.0.0:0LISTENING 1316 TCP0.0.0.0:1801 0.0.0.0:0LISTENING 1576 TCP0.0.0.0:2103 0.0.0.0:0LISTENING 1576 TCP0.0.0.0:2105 0.0.0.0:0LISTENING 1576 TCP0.0.0.0:2107 0.0.0.0:0LISTENING 1576 TCP0.0.0.0:3389 0.0.0.0:0LISTENING 724 TCP0.0.0.0:4899 0.0.0.0:0LISTENING 2860 TCP127.0.0.1:439580.0.0.0:0LISTENING 1476 TCP202.194.4.218:21 0.0.0.0:0LISTENING 1476 TCP202.194.4.218:80 202.194.4.218:3768 ESTABLISHED 4 TCP202.194.4.218:1433 211.233.12.64:8374 TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:8716 TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:9075 TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:9430 TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:9785 TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:10750TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:11091TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:11418TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:11739TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:12093TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:12452TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:15486TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:15851TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:16223TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:16580TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:16928TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:17283TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:17635TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:18005TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:18372TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:18746TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:19077TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:19453TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:19827TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:20199TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:20601TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:20951TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:21295TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:22194TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:22505TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:23517TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:23883TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:24245TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:24584TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:24920TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:25257TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:25676TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:26009TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:26345TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:26719TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:27724TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:28607TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:28950TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:29280TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:29582TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:29931TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:30299TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:30635TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:31003TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:31965TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:32317TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:33716TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:34076TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:34447TIME_WAIT 0 TCP202.194.4.218:1433 211.233.12.64:34735FIN_WAIT_11316 TCP202.194.4.218:3389 219.218.104.91:1065ESTABLISHED 724 TCP202.194.4.218:3768 202.194.4.218:80 ESTABLISHED 3172 TCP202.194.4.218:3771 66.94.230.51:80TIME_WAIT 0 TCP202.194.4.218:3772 66.94.230.37:80TIME_WAIT 0 UDP0.0.0.0:42 *:*1524 UDP0.0.0.0:445*:*4 UDP0.0.0.0:500*:*496 UDP0.0.0.0:1029 *:*860 UDP0.0.0.0:1030 *:*1576 UDP0.0.0.0:1032 *:*1524 UDP0.0.0.0:1434 *:*1316 UDP0.0.0.0:1645 *:*876 UDP0.0.0.0:1646 *:*876 UDP0.0.0.0:1812 *:*876 UDP0.0.0.0:1813 *:*876 UDP0.0.0.0:1837 *:*860 UDP0.0.0.0:1886 *:*860 UDP0.0.0.0:1887 *:*860 UDP0.0.0.0:1888 *:*860 UDP0.0.0.0:1889 *:*860 UDP0.0.0.0:1890 *:*860 UDP0.0.0.0:1891 *:*860 UDP0.0.0.0:1892 *:*860 UDP0.0.0.0:3527 *:*1576 UDP0.0.0.0:4000 *:*2840 UDP0.0.0.0:4500 *:*496 UDP0.0.0.0:6000 *:*2840 UDP0.0.0.0:6001 *:*2840 UDP127.0.0.1:123*:*876 UDP127.0.0.1:1027 *:*876 UDP127.0.0.1:1028 *:*876 UDP127.0.0.1:1180 *:*2496 UDP127.0.0.1:2920 *:*2476 UDP127.0.0.1:3546 *:*1904 UDP127.0.0.1:3798 *:*3400 UDP127.0.0.1:3877 *:*2312 UDP202.194.4.218:123*:*876
最后一列就是PID了 //--------------------------------------------------------------------------- 以下是tlist.exe的运行结果:tlist.exe的用法是:tlist.exe pid 譬如:tlist.exe 1524 其结果如下: 1524 wins.exe CWD: C:\WINDOWS\system32\ CmdLine: C:\WINDOWS\System32\wins.exe VirtualSize:77372 KB PeakVirtualSize:78212 KB WorkingSetSize:2604 KB PeakWorkingSetSize:6768 KB NumberOfThreads: 18 1528 Win32StartAddr:0x0101249a LastErr:0x000003e5 State:Waiting 1544 Win32StartAddr:0x77d7570d LastErr:0x000003e5 State:Waiting 1828 Win32StartAddr:0x69a6ef20 LastErr:0x00000000 State:Waiting 1832 Win32StartAddr:0x69a6ef20 LastErr:0x00000000 State:Waiting 1836 Win32StartAddr:0x69a6ef20 LastErr:0x00000000 State:Waiting 1840 Win32StartAddr:0x69a6ef20 LastErr:0x00000000 State:Waiting 1972 Win32StartAddr:0x01003e1a LastErr:0x00000000 State:Waiting 1976 Win32StartAddr:0x01003fc7 LastErr:0x00000000 State:Waiting 1980 Win32StartAddr:0x01007b95 LastErr:0x00000000 State:Waiting 1984 Win32StartAddr:0x0101d872 LastErr:0x00000000 State:Waiting 1988 Win32StartAddr:0x01020137 LastErr:0x00000000 State:Waiting 1996 Win32StartAddr:0x01014d48 LastErr:0x00000000 State:Waiting 2000 Win32StartAddr:0x01013a15 LastErr:0x00000000 State:Waiting 2004 Win32StartAddr:0x01006a10 LastErr:0x00000000 State:Waiting 2008 Win32StartAddr:0x77c30840 LastErr:0x00000102 State:Waiting 2012 Win32StartAddr:0x77c30840 LastErr:0x00000000 State:Waiting 2508 Win32StartAddr:0x06001cb7 LastErr:0x00000000 State:Waiting 2272 Win32StartAddr:0x00000000 LastErr:0x000003f0 State:Waiting 5.2.3790.99 shp0x01000000wins.exe 5.2.3790.0 shp0x77f30000ntdll.dll 5.2.3790.0 shp0x77e10000kernel32.dll 7.0.3790.0 shp0x77b70000msvcrt.dll 5.2.3790.0 shp0x77d60000ADVAPI32.dll 5.2.3790.137 shp0x77c20000RPCRT4.dll 5.2.3790.0 shp0x71ba0000NETAPI32.dll 5.2.3790.73 shp0x77cd0000USER32.dll 5.2.3790.0 shp0x77bd0000GDI32.dll 5.2.3790.0 shp0x71b60000WS2_32.dll 5.2.3790.0 shp0x71b50000WS2HELP.dll 5.2.3790.138 shp0x77150000ole32.dll 5.2.3790.0 shp0x5bb80000VSSAPI.DLL 3.5.2283.0 shp0x769c0000ATL.DLL 5.2.3790.0 shp0x770d0000OLEAUT32.dll 5.2.3790.0 shp0x76180000IMM32.DLL 5.2.3790.0 shp0x63090000LPK.DLL 1.421.3790.0 shp0x72ee0000USP10.dll 5.2.3790.0 shp0x71a80000mswsock.dll 5.2.3790.0 shp0x71a40000wshtcpip.dll 5.2.3790.0 shp0x76e30000DNSAPI.dll 5.2.3790.0 shp0x76ed0000winrnr.dll 5.2.3790.0 shp0x76e70000WLDAP32.dll 5.2.3790.0 shp0x76ee0000rasadhlp.dll 5.2.3790.0 shp0x699b0000esent.dll 5.2.3790.0 shp0x5d000000SAMLIB.dll 2001.12.4720.130 s0x76ef0000CLBCatQ.DLL 2001.12.4720.0 shp0x76f70000COMRes.dll 5.2.3790.0 shp0x77b60000VERSION.dll 2001.12.4720.130 s0x76a10000es.dll 5.2.3790.0 shp0x76eb0000secur32.dll 16.0.0.19 shp0x06000000ApiHook.dll 16.2.0.6 shp0x05000000MemMon.dll 很显然CmdLine:后面的就是程序的路径 到这里,聪明的你一定想到方法了,其实只要找到端口对应的进程的PID,再根据PID找到程序具体的路径就行了 我们所要实现的工作就是自动化而已 下面讲下大体思路: 首先我们执行以下两条命令: netstat -anofind "LISTENING">tcplisten.txt //获得TCP监听端口列表 netstat -anofind "UDP">udplisten.txt //获得UDP监听端口列表 //--------------------------------------------------------- 以下是netstat -anofind "LISTENING">tcplisten.txt执行结果,打开tcplisten.txt 可以看到: TCP0.0.0.0:42 0.0.0.0:0LISTENING 1524 TCP0.0.0.0:80 0.0.0.0:0LISTENING 1616 TCP0.0.0.0:1350.0.0.0:0LISTENING 660 TCP0.0.0.0:4450.0.0.0:0LISTENING 4 TCP0.0.0.0:1025 0.0.0.0:0LISTENING 496 TCP0.0.0.0:1026 0.0.0.0:0LISTENING 984 TCP0.0.0.0:1031 0.0.0.0:0LISTENING 1576 TCP0.0.0.0:1033 0.0.0.0:0LISTENING 1524 TCP0.0.0.0:1433 0.0.0.0:0LISTENING 1316 TCP0.0.0.0:1801 0.0.0.0:0LISTENING 1576 TCP0.0.0.0:2103 0.0.0.0:0LISTENING 1576 TCP0.0.0.0:2105 0.0.0.0:0LISTENING 1576 TCP0.0.0.0:2107 0.0.0.0:0LISTENING 1576 TCP0.0.0.0:3389 0.0.0.0:0LISTENING 724 TCP0.0.0.0:4899 0.0.0.0:0LISTENING 2860 TCP127.0.0.1:439580.0.0.0:0LISTENING 1476 TCP202.194.4.218:21 0.0.0.0:0LISTENING 1476 //-------------------------------------------------------- 以下是netstat -anofind "UDP">udplisten.txt 执行结果,打开udplisten.txt 可以看到: UDP0.0.0.0:42 *:*1524 UDP0.0.0.0:445*:*4 UDP0.0.0.0:500*:*496 UDP0.0.0.0:1029 *:*860 UDP0.0.0.0:1030 *:*1576 UDP0.0.0.0:1032 *:*1524 UDP0.0.0.0:1434 *:*1316 UDP0.0.0.0:1645 *:*876 UDP0.0.0.0:1646 *:*876 UDP0.0.0.0:1812 *:*876 UDP0.0.0.0:1813 *:*876 UDP0.0.0.0:1837 *:*860 UDP0.0.0.0:1886 *:*860 UDP0.0.0.0:1887 *:*860 UDP0.0.0.0:1888 *:*860 UDP0.0.0.0:1889 *:*860 UDP0.0.0.0:1890 *:*860 UDP0.0.0.0:1891 *:*860 UDP0.0.0.0:1892 *:*860 UDP0.0.0.0:3527 *:*1576 UDP0.0.0.0:4000 *:*2840 UDP0.0.0.0:4500 *:*496 UDP0.0.0.0:6000 *:*2840 UDP0.0.0.0:6001 *:*2840 UDP127.0.0.1:123*:*876 UDP127.0.0.1:1027 *:*876 UDP127.0.0.1:1028 *:*876 UDP127.0.0.1:1180 *:*2496 UDP127.0.0.1:2920 *:*2476 UDP127.0.0.1:3546 *:*1904 UDP127.0.0.1:3798 *:*3400 UDP127.0.0.1:3877 *:*2312 UDP202.194.4.218:123*:*876 //--------------------------------------------------------- 我们只要对这两个文件中的信息处理下就能提取到端口和PID的对应表了 定义如下结构体吧: //------------------------------- typedef struct _PORTTOPROCESS{ CString Port; CString Protocol; CString Pid; CString ProcName; CString ProcPath; }PORTTOPROCESS; //------------------------------- PORTTOPROCESS PortToProcess[100] //声明一百个结构体应该够用了 第一步通过处理上述两个文件来实例化PortToProcess数组中的Port,Protocol,Pid项,并返回总的PortNum; 第二步通过进程快照获得pid对应的程序名实例化结构体中的ProcName项; 第三步先按 tlist.exe pid1find "CmdLine:">>procinfo.txt tlist.exe pid2find "CmdLine:">>procinfo.txt tlist.exe pid3find "CmdLine:">>procinfo.txt . . . . 的格式写成一个bat文件,通过system()函数运行它,得到每个端口对应PID对应的进程信息 接着写个函数从procinfo.txt文件里把信息读出来实例化结构体中的ProcPath项;最后根据PortNum输出结果
原理就这么简单了,具体的看代码吧,附查看程序!在2003和xp下测试成功,vc6.0+2003的编译环境,代码中PcInfor类是个比较 全的类,可以获得系统的详细信息,只要把PcInfor.h和PcInfor.cpp拷贝到你的工程项目中就能用了
程序运行的时候会有CMD窗口弹出,这是因为调用了system()函数所致,在CMD窗口运行完之后程序会等待一段时间(大概20秒),是为了等待bat文件执行完,如果你的机子运行比较慢,可以把原代码的此处修改一下: void PcInfor::GetPortToProcessInfo() { int i; BornTcpListen(); BornUdpListen(); GetListenPort(); FindProcName(); FindProcPath(); for(i=0;i<20;i++) Sleep(1000); GetProcPath(); DeleteTempFile(); WriteProcinfo(); } 循环次数加多点,在重新编译以下就行了!
如果发现bug或者你修改了更好的请给我一份,本人不胜感激:)
//shadow 2004/10/26 //email:dreamshadow@mail.sdu.edu.cn //http:www.codehome.6600.org
|
分页:
|
相关文章:
|
|
|