How can I access netstat-like Ethernet statistics from a Windows program

Question

How can I access Ethernet statistics from C/C++ code like netstat -e?

Interface Statistics

                       Received            Sent

Bytes                      21010071        15425579
Unicast packets               95512           94166
Non-unicast packets           12510               7
Discards                          0               0
Errors                            0               3
Unknown protocols                 0

Cyclo

Answer 1

A good place to start for network statistics would be the GetIpStatistics call in the Windows IPHelper functions.

There are a couple of other approaches that are possibly more portable:-

• SNMP. Requires SNMP to be enabled on the computer, but can obviously be used to retrieve statistics for remote computers also.
• Pipe the output of 'netstat' into your application, and unpick the values from the text.

Flasher

The output of netstat is locale-specific and version-specific. Good look with that. :-D – Lolly

Hehe. Well, it might still be easier than getting SNMP to work right... ;-) – Flasher

Answer 2

The WMI will provide those readings:

SELECT * FROM Win32_PerfFormattedData_Tcpip_IP
SELECT * FROM Win32_PerfFormattedData_Tcpip_TCP
SELECT * FROM Win32_PerfFormattedData_Tcpip_UDP
SELECT * FROM Win32_PerfFormattedData_Tcpip_ICMP
SELECT * FROM Win32_PerfFormattedData_Tcpip_Networkinterface

These classes are available on Windows XP or newer. You may have to resign to the matching "Win32_PerfRawData" classes on Windows 2000, and do a little bit more of math before you can display the output.

Find documentation on all of them in the MSDN.

Lolly

I looked through the documentation, and it's not clear to me how to use this functionality. Do you know any good examples in C or C++ using the classes you listed? – Intrigante

MSDN always is a good starting point. WMI C++ Application Examples. (I think you could have found that yourself.) – Lolly

I did see that, but it was not very clear to me. I'll look at it again. Thanks. – Intrigante

Answer 3

Let me answer to myself, as I asked the same on another forum.

WMI is good, but it's easier to use IpHlpApi instead:

#include <winsock2.h>
#include <iphlpapi.h>

int main(int argc, char *argv[])
{

PMIB_IFTABLE pIfTable;
MIB_IFROW ifRow;
PMIB_IFROW pIfRow = &ifRow;
DWORD dwSize = 0;

// first call returns the buffer size needed
DWORD retv = GetIfTable(pIfTable, &dwSize, true);
if (retv != ERROR_INSUFFICIENT_BUFFER)
    WriteErrorAndExit(retv);
pIfTable = (MIB_IFTABLE*)malloc(dwSize);

retv = GetIfTable(pIfTable, &dwSize, true);
if (retv != NO_ERROR)
    WriteErrorAndExit(retv);

// Get index
    int i,j;
    printf("\tNum Entries: %ld\n\n", pIfTable->dwNumEntries);
    for (i = 0; i < (int) pIfTable->dwNumEntries; i++)
    {
        pIfRow = (MIB_IFROW *) & pIfTable->table[i];
        printf("\tIndex[%d]:\t %ld\n", i, pIfRow->dwIndex);
        printf("\tInterfaceName[%d]:\t %ws", i, pIfRow->wszName);
        printf("\n");
        printf("\tDescription[%d]:\t ", i);
        for (j = 0; j < (int) pIfRow->dwDescrLen; j++)
            printf("%c", pIfRow->bDescr[j]);
        printf("\n");
        ...

Cyclo

That's what I suggested earlier. You'll then need to call GetIpStatistics to get the stats you want. – Flasher

@Flasher no, the stats from "netstat -e" needs only calling GetIfTable, +1 for Denes – Safeconduct

Answer 4

Szia,

from http://en.wikipedia.org/wiki/Netstat

On the Windows platform, netstat information can be retrieved by calling the GetTcpTable and GetUdpTable functions in the IP Helper API, or IPHLPAPI.DLL. Information returned includes local and remote IP addresses, local and remote ports, and (for GetTcpTable) TCP status codes. In addition to the command-line netstat.exe tool that ships with Windows, there are GUI-based netstat programs available. On the Windows platform, this command is available only if the Internet Protocol (TCP/IP) protocol is installed as a component in the properties of a network adapter in Network Connections.

MFC sample at CodeProject: http://www.codeproject.com/KB/applications/wnetstat.aspx

Mika

Answer 5

You might find a feasable WMI performance counter, e.g. Win32_PerfRawData_Tcpip_NetworkInterface.

Poppas

Answer 6

See Google Groups, original netstats source code has been posted many times (win32 api)

Outclass

Answer 7

As above answers suggest, WMI performance counters contains some data. Just be aware that in later versions of windows the perf counters are broken down in v4 vs v6 so the queries are:

SELECT * FROM Win32_PerfFormattedData_Tcpip_IPv4

SELECT * FROM Win32_PerfFormattedData_Tcpip_TCPv4

SELECT * FROM Win32_PerfFormattedData_Tcpip_UDPv4

SELECT * FROM Win32_PerfFormattedData_Tcpip_ICMP

SELECT * FROM Win32_PerfFormattedData_Tcpip_IPv6

SELECT * FROM Win32_PerfFormattedData_Tcpip_TCPv6

SELECT * FROM Win32_PerfFormattedData_Tcpip_UDPv6

SELECT * FROM Win32_PerfFormattedData_Tcpip_ICMPv6

Linctus