首先看看ms 的netstat -ano
 Proto  Local Address          Foreign Address        State           PID
 TCP    0.0.0.0:135            0.0.0.0:0              LISTENING       1392
 TCP    0.0.0.0:445            0.0.0.0:0              LISTENING       4
 TCP    0.0.0.0:1110           0.0.0.0:0              LISTENING       420
 TCP    127.0.0.1:1110         127.0.0.1:3112         ESTABLISHED     420
 TCP    127.0.0.1:3112         127.0.0.1:1110         ESTABLISHED     848
 TCP    192.168.1.48:139       0.0.0.0:0              LISTENING       4
 TCP    192.168.1.48:1605      81.177.31.146:443      CLOSE_WAIT      420
 TCP    192.168.1.48:3113      58.251.62.15:80        ESTABLISHED     420
 TCP    192.168.1.48:3194      192.168.1.118:7499     ESTABLISHED     4
 UDP    0.0.0.0:445            *:*                                    4
 UDP    0.0.0.0:500            *:*                                    1152
 UDP    0.0.0.0:2645           *:*                                    848
 UDP    0.0.0.0:2646           *:*                                    848
 UDP    0.0.0.0:2647           *:*                                    848
 UDP    0.0.0.0:2648           *:*                                    848
 UDP    0.0.0.0:2686           *:*                                    848
 UDP    0.0.0.0:4500           *:*                                    1152
 UDP    127.0.0.1:1606         *:*                                    1988
 UDP    127.0.0.1:2657         *:*                                    848
 UDP    127.0.0.1:3156         *:*                                    2320
 UDP    192.168.1.48:137       *:*                                    4
 UDP    192.168.1.48:138       *:*                                    4
pid为848的有7个吧,我的im
然后看看我自己的代码.//分配空间,来获取真的tcp连接表.
      GetMem(pBuf,adwSize);
      dResult:=GetExtendedTcpTable(PMIB_TCPTABLE_OWNER_PID(pBuf),@adwSize,True,2,5,0);
      if dResult<>NO_ERROR then
      begin
        FErrorInfo:='获取TCP列表出错';
        doError;
      end
      else
      begin
        num:=PMIB_TCPTABLE_OWNER_PID(pBuf)^.dwNumEntries;
        if num>0 then
        begin
          Inc(pBuf,SizeOf(DWORD));
          for I := 1 to num do
          begin
            tcpRow:=PMIB_TCP_ROw(pBuf)^;
            with tcpRow do
            if (dwOwningPid=PID) then
              FUDPFilter.Append(Port2Str(dwLocalPort));
            Inc(pBuf,SizeOf(MIB_TCPROW_OWNER_PID));
          end;
        end;  
      end;
      Dec(pBuf,SizeOf(dword)+ num* SizeOf(MIB_TCPROW_OWNER_PID));
      FreeMem(pBuf);
    end;
这是tcp的,下面是udp的
try
        GetMem(pBuf,adwSize);
        dResult:=GetExtendedUdpTable(PMIB_UDPTABLE_OWNER_PID(pbuf),@adwsize,False,2,UDP_TABLE_OWNER_PID,0);
        if dResult=NO_ERROR then
        begin
          num:=PMIB_UDPTABLE_OWNER_PID(pbuf)^.dwNumEntries;
          if num>0 then
          begin
            FUDPFilter.Clear;
            Inc(pBuf,SizeOf(DWORD));
            for I := 1 to num do
            begin
              udpRow:=PMIB_UDPROW_OWNER_PID(pBuf)^;
              if (udpRow.dwOwningPid=self.FShowPID) then
                FUDPFilter.Append(Port2Str(udpRow.dwLocalPort));
              Inc(pBuf,SizeOf(MIB_TCPROW_OWNER_PID));
            end;
          end
          else
            Exit; 
        end ;
      finally
        Dec(pBuf,SizeOf(dword)+ num* SizeOf(MIB_TCPROW_OWNER_PID));
        FreeMem(pBuf);
      end;
      FConnections.Clear;
      ShowMessage(FUDPFilter.Text);
最后只有2个..太欺负人了
我用的getExtendedTcpTable和getExtendedUDPTable.
是不是这个里面有猫腻呀