Transport Layer Protocol Statistics

The next layer of the TCP/IP stack for which you can use IPHelper to get statistical information is the transport layer. This layer, as described in Chapter 1, is used to transfer data between a source and a destination on the network through two protocols: TCP and UDP.

Transmission Control Protocol (TCP)

TCP is a connection-oriented protocol that provides you with a reliable, error-free data pipe between two endpoints that can send and receive streams of bytes back and forth, without data being lost or duplicated.

You can query the TCP protocol using IPHelper APIs for two different types of information: details about the currently connected TCP connections, and their transfer states. To do so, you retrieve the current TCP table by calling the following:

 DWORD GetTcpTable(MIB_TCPTABLE *pTcpTable, DWORD *pdwSize,    BOOL bOrder); 

The first parameter is a pointer to a MIB_TCPTABLE buffer that contains the TCP connection details. This is followed by the pointer pdwSize, which points to the size, in bytes, of the buffer that was allocated for pTcpTable. If this buffer is too small, GetTcpTable() will set this to the size it needs. The final parameter, bOrder, should be set to TRUE if you want the returned array to be sorted by local IP address.

The MIB_TCPTABLE structure contains the number of entries in the TCP table, along with a MIB_TCPROW array for each TCP connection. It is defined as follows:

 typedef struct _MIB_TCPTABLE {    DWORD dwNumEntries;    MIB_TCPROW table[ANY_SIZE]; } MIB_TCPTABLE, *PMIB_TCPTABLE; 

Finally, let's look at the actual TCP connection table structure, MIB_TCPROW:

 typedef struct _MIB_TCPROW {    DWORD dwState;    DWORD dwLocalAddr;    DWORD dwLocalPort;    DWORD dwRemoteAddr;    DWORD dwRemotePort; } MIB_TCPROW, *PMIB_TCPROW; 

The first field, dwState, specifies the current state of the connection. It can be one of the states specified in Table 3.6.

Table 3.6. TCP Connection State Values

State	Description
MIB_TCP_STATE_CLOSED	The TCP connection is closed.
MIB_TCP_STATE_LISTEN	The TCP connection is waiting for a remote connection.
MIB_TCP_STATE_SYN_SENT	The TCP connection is waiting for a connection request.
MIB_TCP_STATE_SYN_RCVD	The TCP connection is waiting for a confirmation request acknowledgment after a connection request has been established.
MIB_TCP_STATE_ESTAB	The TCP connection is open.
MIB_TCP_STATE_FIN_WAIT1	The TCP connection is waiting for a connection termination request, or acknowledgment of a previously transmitted termination request.
MIB_TCP_STATE_FIN_WAIT2	The TCP connection is waiting for a connection termination request.
MIB_TCP_STATE_CLOSE_WAIT	The TCP connection is waiting for a termination request from the local connection.
MIB_TCP_STATE_CLOSING	The TCP connection is waiting for a termination request acknowledgment from the remote connection.
MIB_TCP_STATE_LAST_ACK	The TCP connection is waiting for a previously sent termination request.
MIB_TCP_STATE_TIME_WAIT	The TCP connection is waiting to make sure that the remote connection has received acknowledgment of its termination request.
MIB_TCP_STATE_DELETE_TCP	The TCP connection is marked for deletion.

The next two fields, dwLocalAddr and dwLocalPort, define the local IP address and the local port for the connection. The last two fields, dwRemoteAddr and dwRemotePort, define the remote IP address and port, respectively.

You can also manually mark a TCP connection for deletion by using the SetTcpEntry() function:

 DWORD SetTcpEntry(MIB_TCPROW *pTcpRow); 

To use SetTcpEntry(), you must set the pTcpRow parameter to point to a MIB_TCPROW structure for the connection you want to delete. All the member fields of MIB_TCPROW should be populated, using the MIB_TCP_STATE_DELETE_TCP flag for the dwState parameter.

In addition to getting information about the active TCP connections, you can also use IPHelper to get general statistical information about the TCP protocol itself. To do so, call the GetTcpStatistics() function:

 DWORD GetTcpStatistics(MIB_TCPSTATS *pStats); 

The parameter pStats should point to a MIB_TCPSTATS structure, which is defined as follows:

 typedef struct _MIB_TCPSTATS {    DWORD dwRtoAlgorithm;    DWORD dwRtoMin;    DWORD dwRtoMax;    DWORD dwMaxConn;    DWORD dwActiveOpens;    DWORD dwPassiveOpens;    DWORD dwAttemptFails;    DWORD dwEstabResets;    DWORD dwCurrEstab;    DWORD dwInSegs;    DWORD dwOutSegs;    DWORD dwRetransSegs;    DWORD dwInErrs;    DWORD dwOutRsts;    DWORD dwNumConns; } MIB_TCPSTATS, *PMIB_TCPSTATS; 

Table 3.7 describes the fields of the MIB_TCPSTATS structure.

Table 3.7. MIB_TCPSTATS Field Descriptions

Member	Description
dwRtoAlgorithm	The current timeout algorithm being used. This can be MIB_TCP_RTO_CONSTANT, MIB_TCP_RTO_RSRE, MIB_TCP_RTO_VANJ, or MIB_TCP_RTO_OTHER.
dwRtoMin	The minimum retransmission timeout value in milliseconds.
dwRtoMax	The maximum retransmission timeout value in milliseconds.
dwMaxConn	The maximum number of TCP connections allowed on the device. This can also be set to -1 if a variable number of connections is allowed.
dwActiveOpens	The number of TCP connections opening connections to a server.
dwPassiveOpens	The number of TCP connections that are listening.
dwAttemptFails	The number of TCP connection attempts that have failed.
dwEstabResets	The number of TCP connections that have been reset after being established.
dwCurrEstab	The number of TCP connections that are currently active and established.
dwInSegs	The number of segments received.
dwOutSegs	The number of segments transmitted.
dwRetransSegs	The number of segments that have been retransmitted.
dwInErrs	The number of errors received.
dwOutRsts	The number of segments transmitted that were marked as "reset."
dwNumConns	The total number of connections.

By using the GetTcpStatistics() function, you can easily get some general information on TCP:

 MIB_TCPSTATS mibTcpStats; memset(&mibTcpStats, 0, sizeof(MIB_TCPSTATS)); GetTcpStatistics(&mibTcpStats); 

User Datagram Protocol (UDP)

In addition to TCP, the TCP/IP stack also supports connectionless data transfer through the UDP protocol. To look at the table of UDP sockets the device is currently using to listen for incoming UDP packets, you can use the GetUdpTable() function:

 DWORD GetUdpTable(MIB_UDPTABLE *pUdpTable, DWORD *pdwSize,   BOOL bOrder); 

The first parameter, pUdpTable, points to a structure that will be populated with a MIB_UDPTABLE structure when the function returns. Next, pdwSize points to a DWORD value that specifies the size of the buffer allocated for pUdpTable. If the buffer is not large enough, GetUdpTable() will fill this in with the correct size needed when it returns. Finally, if you want to sort the array of UDP connections by IP address, you can set the bOrder parameter to TRUE.

The MIB_UDPTABLE structure looks like the following:

 typedef struct _MIB_UDPTABLE {    DWORD dwNumEntries;    MIB_UDPROW table[ANY_SIZE]; } MIB_UDPTABLE, *PMIB_UDPTABLE; 

The structure contains the number of entries in the table, dwNumEntries, which is followed by an array of MIB_UDPROW structures that define the UDP connection table. The MIB_UDPROW structure is defined as follows:

 typedef struct _MIB_UDPROW {    DWORD dwLocalAddr;    DWORD dwLocalPort; } MIB_UDPROW, *PMIB_UDPROW; 

As you can see, each MIB_UDPROW structure simply contains the local address and local port for each UDP connection currently active on the device.

Finally, if you want to get more general statistical information about UDP itself, you can call the following function:

 DWORD GetUdpStatistics(MIB_UDPSTATS *pStats); 

The GetUdpStatistics() function takes a single parameter, pStats, which is a pointer to a MIB_UDPSTATS structure. The structure receives the current UDP statistics for the device, and looks like the following:

 typedef struct _MIB_UDPSTATS {    DWORD dwInDatagrams;    DWORD dwNoPorts;    DWORD dwInErrors;    DWORD dwOutDatagrams;    DWORD dwNumAddrs; } MIB_UDPSTATS,*PMIB_UDPSTATS; 

The dwInDatagrams field specifies the total number of UDP datagrams that the device has received. This is followed by dwNoPorts, which is the total number of datagrams that UDP has discarded because the port number was bad. It is followed by the total number of erroneous datagrams that were received in the dwInErrors field. The dwOutDatagrams field indicates the total number of datagrams transmitted, and is followed by the total number of UDP entries in the table that can be retrieved using the GetUdpTable() function.