Results 1 to 6 of 6

Thread: Winapi call to get ephemeral port range

  1. #1

    Thread Starter
    Member
    Join Date
    Jun 2013
    Posts
    43

    Winapi call to get ephemeral port range

    I have done quite a bit of searching and cannot find an API call to get this for me. I know I can do it with netsh but this is windows version dependent and I want to do it in code. Anyone have an idea?

  2. #2
    Frenzied Member
    Join Date
    Jun 2015
    Posts
    1,057

    Re: Winapi call to get ephemeral port range

    [...]
    Last edited by dz32; Apr 26th, 2019 at 11:17 AM.

  3. #3
    PowerPoster Zvoni's Avatar
    Join Date
    Sep 2012
    Location
    To the moon and then left
    Posts
    4,418

    Re: Winapi call to get ephemeral port range

    Last edited by Zvoni; Tomorrow at 31:69 PM.
    ----------------------------------------------------------------------------------------

    One System to rule them all, One Code to find them,
    One IDE to bring them all, and to the Framework bind them,
    in the Land of Redmond, where the Windows lie
    ---------------------------------------------------------------------------------
    People call me crazy because i'm jumping out of perfectly fine airplanes.
    ---------------------------------------------------------------------------------
    Code is like a joke: If you have to explain it, it's bad

  4. #4

    Thread Starter
    Member
    Join Date
    Jun 2013
    Posts
    43

    Re: Winapi call to get ephemeral port range

    So what I am doing in our monitoring system is building up a "map" kind of thing of what server talks to what other server so as to map out application connections across the landscape. The only way I could come up with to determine that a connection is MOST LIKELY outbound is if the local port is in the dynamic range. Trouble is that different windows implementations have different ranges and the upper limit can be set in the registry with MaxUserPort. The OS must know the range and I am looking for a version independent way of obtaining the range. I do understand that a custom app might be listening on a dynamic port and therefore my assumption about the port range will need some refining to get to 100% that this is an outbound connection.

    So that is what I am trying to achieve. Thanks for the input.

  5. #5
    PowerPoster Zvoni's Avatar
    Join Date
    Sep 2012
    Location
    To the moon and then left
    Posts
    4,418

    Re: Winapi call to get ephemeral port range

    Not withstanding that there really is an API for this:
    How about building a Lookup-Dictionary (or INI-File, small DB) with
    XP (and older) --> 1024 to 4999
    Vista (and newer) --> 49152 to 65535
    Of course, including the lookup in the registry first, if there is an entry changing the standard range
    Last edited by Zvoni; Tomorrow at 31:69 PM.
    ----------------------------------------------------------------------------------------

    One System to rule them all, One Code to find them,
    One IDE to bring them all, and to the Framework bind them,
    in the Land of Redmond, where the Windows lie
    ---------------------------------------------------------------------------------
    People call me crazy because i'm jumping out of perfectly fine airplanes.
    ---------------------------------------------------------------------------------
    Code is like a joke: If you have to explain it, it's bad

  6. #6

    Thread Starter
    Member
    Join Date
    Jun 2013
    Posts
    43

    Re: Winapi call to get ephemeral port range

    Quote Originally Posted by Zvoni View Post
    Not withstanding that there really is an API for this:
    How about building a Lookup-Dictionary (or INI-File, small DB) with
    XP (and older) --> 1024 to 4999
    Vista (and newer) --> 49152 to 65535
    Of course, including the lookup in the registry first, if there is an entry changing the standard range
    Unfortunately this logic is not reliable.

    XP and older can actually be 1024 - 65535 depending on the value of MaxUserPort

    Vista and newer is not always 49152 to 65535. It can be set with netsh.

    I can make some reasonable assumptions with the information I can get from OS version and registry (present or not present) but it would be nice to get a solid answer from the OS.

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  



Click Here to Expand Forum to Full Width