[sommainc]

Leaving this comment for records.

Even if you do not explicitly call the bind () function, windows binds the local port dynamically as described in MSDN, so you can find the information in the UDP extended table.

ref: https://docs.microsoft.com/en-us/windows/win32/api/winsock/nf-winsock-sendto

In previous tests, it was a simple coding mistake that we could not get a PID.
thanks for your help, Vadim Smirnov 🙂

[sommainc]

According to MSDN and my own test, the information that we can get from MIB_UDPTABLE_OWNER_MODULE or MIB_UDPTABLE_OWNER_PID (We can get those by GetExtendedUdpTable(..., UDP_TABLE_OWNER_MODULE, ...)) is only UDP listener process’s information.

https://docs.microsoft.com/en-us/windows/win32/api/udpmib/ns-udpmib-_mib_udptable_owner_pid

>> The MIB_UDPTABLE_OWNER_PID structure contains the User Datagram Protocol (UDP) listener table for IPv4 on the local computer. The table also includes the process ID (PID) that issued the call to the bind function for each UDP endpoint.

But I need process information that called UDP sendto(). Is there anything that I know wrong?

thanks.

[Author]

Posts