< Chap 13: Index | Winsock 2 Main | Netstat: Retrieve TCP, UDP Tables & Protocol Statistics >

---

 

 

IP Helper Functions 13 Part 1

 

 

What do we have in this chapter 13 part 1?

1. Ipconfig

2. Releasing and Renewing IPv4 Addresses

3. Changing IPv4 Addresses

 

 

To retrieve IP configuration information, use the GetNetworkParams() function, which is defined as:

DWORD GetNetworkParams(PFIXED_INFO pFixedInfo, PULONG pOutBufLen);

The pFixedInfo parameter receives a pointer to a buffer that receives a FIXED_INFO data structure your application must provide to retrieve the IPv4 configuration information. The pOutBufLen parameter is a pointer to a variable that specifies the size of the buffer you passed in the pFixedInfo parameter. If your buffer is not large enough, GetNetworkParams() returns ERROR_BUFFER_ OVERFLOW and sets the pOutBufLen parameter to the required buffer size. The FIXED_INFO structure used in GetNetworkParams() is defined as:

 

typedef struct

{

    char            HostName[MAX_HOSTNAME_LEN + 4] ;

    char            DomainName[MAX_DOMAIN_NAME_LEN + 4];

    PIP_ADDR_STRING CurrentDnsServer;

    IP_ADDR_STRING  DnsServerList;

    UINT            NodeType;

    char            ScopeId[MAX_SCOPE_ID_LEN + 4];

    UINT            EnableRouting;

    UINT            EnableProxy;

    UINT            EnableDns;

} FIXED_INFO, *PFIXED_INFO;

 

The fields are defined as follows:

 

1. HostName: Represents your computer's name as recognized by DNS.
2. DomainName: Specifies the DNS domain your computer belongs to.
3. CurrentDnsServer: Contains the current DNS server's IPv4 address.
4. DnsServerList: Is a linked list containing the DNS servers that your machine uses.
5. NodeType: Specifies how the system resolves NetBIOS names over an IPv4 network. Table 16-1 contains the possible values.
6. ScopeId: Identifies a string value that is appended to a NetBIOS name to logically group two or more computers for NetBIOS communication over TCP/IP.
7. EnableRouting: Specifies whether the system will route IPv4 packets between the networks it is connected to.
8. EnableProxy: Specifies whether the system will act as a WINS proxy agent on a network. A WINS proxy agent answers broadcast queries for names that it has resolved through WINS and allows a network of b-node computers to connect to servers on other subnets registered with WINS.
9. EnableDns: Specifies whether NetBIOS will query DNS for names that cannot be resolved by WINS, broadcast, or the LMHOSTS file.

 

 

 

 

 

The DnsServerList field of a FIXED_INFO structure is an IP_ADDR_STRING structure that represents the beginning of a linked list of IPv4 addresses. This field is defined as:

 

typedef struct _IP_ADDR_STRING

{

    struct _IP_ADDR_STRING* Next;

    IP_ADDRESS_STRING       IpAddress;

    IP_MASK_STRING          IpMask;

    DWORD                   Context;

} IP_ADDR_STRING, *PIP_ADDR_STRING;

 

The Next field identifies the next DNS server IPv4 address in the list. If Next is set to NULL, it indicates the end of the list. The IpAddress field is a string of characters that represents an IPv4 address as a dotted decimal string. The IpMask field is a string of characters that represents the subnet mask associated with the IPv4 address listed in IpAddress. The final field, Context, identifies the IPv4 address with a unique value on the system.

The IPCONFIG.EXE utility is also capable of retrieving IP configuration information specific to a network interface. A network interface can be a hardware Ethernet adapter or even a RAS dial-up adapter. You can retrieve adapter information by calling GetAdaptersInfo(), which is defined as:

DWORD GetAdaptersInfo (PIP_ADAPTER_INFO pAdapterInfo, PULONG pOutBufLen);

Use the pAdapterInfo parameter to pass a pointer to an application-provided buffer that receives an ADAPTER_INFO data structure with the adapter configuration information. The pOutBufLen parameter is a pointer to a variable that specifies the size of the buffer you passed in the pAdapterInfo parameter. If your buffer is not large enough, GetAdaptersInfo() returns ERROR_BUFFER_ OVERFLOW and sets the pOutBufLen parameter to the required buffer size.

The IP_ADAPTER_INFO structure is actually a list of structures containing IPv4 configuration information specific to every network adapter available on your machine. IP_ADAPTER_INFO is defined as:

 

typedef struct _IP_ADAPTER_INFO

{

    struct _IP_ADAPTER_INFO* Next;

    DWORD           ComboIndex;

    char            AdapterName[MAX_ADAPTER_NAME_LENGTH + 4];

    char            Description[MAX_ADAPTER_DESCRIPTION_LENGTH + 4];

    UINT            AddressLength;

    BYTE            Address[MAX_ADAPTER_ADDRESS_LENGTH];

    DWORD           Index;

    UINT            Type;

    UINT            DhcpEnabled;

    PIP_ADDR_STRING CurrentIpAddress;

    IP_ADDR_STRING  IpAddressList;

    IP_ADDR_STRING  GatewayList;

    IP_ADDR_STRING  DhcpServer;

    BOOL            HaveWins;

    IP_ADDR_STRING  PrimaryWinsServer;

    IP_ADDR_STRING  SecondaryWinsServer;

    time_t          LeaseObtained;

    time_t          LeaseExpires;

} IP_ADAPTER_INFO, *PIP_ADAPTER_INFO;

 

The fields of the structure are defined as follows:

 

1. Next: Identifies the next adapter in the buffer. A NULL value indicates the end of the list.
2. ComboIndex: Is not used and will be set to 0.
3. AdapterName: Identifies the name of the adapter.
4. Description: Is a simple description of the adapter.
5. AddressLength: Identifies how many bytes make up the physical address of the adapter in the Address field.
6. Address: Identifies the physical address of the adapter.
7. Index: Identifies a unique internal index number of the network interface that this adapter is assigned to.
8. Type: Specifies the type of the adapter as a numeric value. Table 16-2 defines the most common adapter types. A full listing of the supported adapter types can be found in IPIFCONS.H.

 

 

9. DhcpEnabled: Specifies whether DHCP is enabled on this adapter.
10. CurrentIpAddress: Is not used and will be set to a NULL value.
11. IpAddressList: Specifies a list of IPv4 addresses assigned to the adapter.
12. GatewayList: Specifies a list of IPv4 addresses representing the default gateway.
13. DhcpServer: Specifies a list with only one element representing the IPv4 address of the DHCP server used.
14. HaveWins: Specifies whether the adapter uses a WINS server.
15. PrimaryWinsServer: Specifies a list with only one element representing the IPv4 address of the primary WINS server used.
16. SecondaryWinsServer: Specifies a list with only one element representing the IPv4 address of the secondary WINS server used.
17. LeaseObtained: Identifies when the lease for the IPv4 address was obtained from a DHCP server.
18. LeaseExpires: Identifies when the lease on the IPv4 address obtained from DHCP expires.

 

The GetAdaptersInfo() returns a great deal of information about the physical adapter and the IPv4 addresses assigned to it, but it does not return any IPv6 information. Instead, a new API GetAdaptersAddresses() has been introduced to fill this gap as it returns address information for both IPv4 and IPv6. The API is declared as:

 

DWORD WINAPI GetAdaptersAddresses(

                        ULONG Family,

                        DWORD Flags,

                        PVOID Reserved,

                        PIP_ADAPTER_ADDRESSES pAdapterAddresses,

                        PULONG pOutBufLen

);

 

The Family parameter indicates which address family should be enumerated. The valid values are: AF_INET, AF_INET6, or AF_UNSPEC, depending on whether you want IPv4, IPv6, or all IP information. The Flags parameter controls the type of addresses returned. Table 16-3 lists the possible values and their meaning. Note that more than one flag can be specified by ORing multiple flags together. By default, all addresses are returned. The last two parameters are the buffer that the IP information is returned in and the length of the buffer.

 

-----------------------------------------------------------

 

The IP information is returned in the form of an IP_ADAPTER_ADDRESSES structure. This structure is defined as:

 

typedef struct _IP_ADAPTER_ADDRESSES {

        union {

               ULONGLONG Alignment;

               struct {

                      ULONG Length;

                      DWORD IfIndex;

             }

         }

         struct _IP_ADAPTER_ADDRESSES *Next;

         PCHAR AdapterName;

         PIP_ADAPTER_UNICAST_ADDRESS     FirstUnicastAddress;

         PIP_ADAPTER_ANYCAST_ADDRESS     FirstAnycastAddress;

         PIP_ADAPTER_MULTICAST_ADDRESS   FirstMulticastAddress;

         PIP_ADAPTER_DNS_SERVER_ADDRESS  FirstDnsServerAddress;

         PWCHAR   DnsSuffix;

         PWCHAR   Description;

         PWCHAR   FriendlyName;

         BYTE     PhysicalAddress[MAX_ADAPTER_ADDRESS_LENGTH];

         DWORD    PhysicalAddressLength;

         DWORD                Flags;

         DWORD                Mtu;

         DWORD                IfType;

         IF_OPER_STATUS       OperStatus;

         DWORD                Ipv6IfIndex;

         DWORD                ZoneIndices[16];

         PIP_ADAPTER_PREFIX   FirstPrefix;

} IP_ADAPTER_ADDRESSES, *PIP_ADAPTER_ADDRESSES;

 

1. Length: Specifies the length of the structure.
2. IfIndex: Specifies the interface index that can be cross-referenced with the interface indices that GetAdaptersInfo returns.
3. Next Specifies: the next IP_ADAPTER_ADDRESSES structure returned.
4. AdapterName: Specifies the adapter name these addresses are assigned to.
5. FirstUnicastAddress: Pointer to a list of IP_ADAPER_UNICAST_ ADDRESS structures that contain information about each unicast address assigned to this adapter.
6. FirstAnycastAddress: Pointer to a list of IP_ADAPTER_ANYCAST_ ADDRESS structures that contain information about each anycast address assigned to this adapter.
7. FirstMulticastAddress: Pointer to a list of IP_ADAPTER_MULTICAST_ ADDRESS structures that contain information about each multicast address assigned to this adapter. This is extremely useful because it lists each multicast address joined on each physical interface.
8. FirstDnsServerAddress: Pointer to a list of IP_ADAPTER_DNS_ SERVER_ADDRESS structures that contain information about each DNS server assigned to this adapter.
9. DnsSuffix: Specifies the Unicode DNS suffix string associated with this adapter.
10. Description Contains a Unicode string description of the adapter.
11. FriendlyName: Contains a Unicode string description of the adapter that is usually more easily human readable than the Description field.
12. PhysicalAddress: Specifies the physical address of the adapter in an array of bytes. For an Ethernet adapter, this would specify the MAC address.
13. PhysicalAddressLength: Specifies the number of bytes that comprise the physical address contained in the PhysicalAddress field.
14. Flags: Indicates the state of the adapter with respect to DDNS, DNS, and DHCP. Table 16-4 lists the possible flags.

 

 

15. Mtu: Specifies the maximum transmission unit support on this adapter.
16. IfType: Specifies the type of adapter; see Table 16-2 for the possible values.
17. OperStatus: Specifies the operational status of the adapter. For more information about this field, see RFC 2863.
18. Ipv6IfIndex: Specifies the interface index of the adapter for the IPv6 addresses assigned to this interface. Note that this field should be used with IPv6 addresses and not the IfIndex field.
19. ZoneIndices: Specifies the scope-IDs for the 16 different scope levels. The most popular scope levels are defined in the enumerated type SCOPE_LEVEL. Consult RFC2373 for more information.
20. FirstPrefix: A linked list of IP_ADAPTER_PREFIX structures which contain the subnet prefixes which are on-link for this interface.

 

The last piece of the IP_ADAPTERS_ADDRESSES structure is the adapter structures. These four structures are very similar and for the most part contain the same kind of information. We'll discuss only the unicast version of the structure because the remaining address structures can be inferred from this one. The unicast structure is defined as:

 

typedef struct _IP_ADAPTER_UNICAST_ADDRESS {

        union {

              ULONGLONG Alignment;

              struct {

                     ULONG Length;

                     DWORD Flags;

              };

         };

         struct _IP_ADAPTER_UNICAST_ADDRESS *Next;

         SOCKET_ADDRESS      Address;

         IP_PREFIX_ORIGIN    PrefixOrigin;

         IP_SUFFIX_ORIGIN    SuffixOrigin;

         IP_DAD_STATE        DadState;

         ULONG               ValidLifetime;

         ULONG               PreferredLifeTime;

         ULONG               LeaseLifeTime;

} IP_ADAPTER_UNICAST_ADDRESS, *PIP_ADAPTER_UNICAST_ADDRESS;

 

• Length: Specifies the length of this structure in bytes.
• Flags: Specifies the type of address. Table 16-5 contains the possible flag values.

 

 

• Next: Specifies the next address structure in the link list.
• PrefixOrigin: Specifies how the network prefix was obtained. Table 16-6 lists the possible values, which are an enumerated type defined in IPTYPES.H.

 

 

• SuffixOrigin: Specifies how the host portion of the address was obtained. Table 16-7 lists these values, which are also an enumerated type.

 

 

• DadState: Indicates the state of the address. Duplicate address detection (DAD) is the process by which an address is validated. Table 16-8 lists the values and their meanings.

 

 

• ValidLifeTime: Specifies in seconds how long the address is valid. A value of 0xFFFFFFFF indicates the address does not expire.
• PreferredLifetime: Specifies in seconds how long the address is the preferred address. After the preferred lifetime expires, the address goes into the deprecated state. A value of 0xFFFFFFFF indicates the address does not expire.
• LeaseLifeTime: Specifies in seconds how long the DHCP lease is valid. A value of 0xFFFFFFFF indicates the lease does not expire.

 

 

 

 

Releasing and Renewing IPv4 Addresses

 

The IPCONFIG.EXE utility also features the ability to release and renew IPv4 addresses obtained from the DHCP server by specifying the /release and /renew command line parameters. If you want to programmatically release an IPv4 address, you can call the IPReleaseAddress() function, which is defined as:

DWORD IpReleaseAddress (PIP_ADAPTER_INDEX_MAP AdapterInfo);

If you want to renew an IP address, you can call the IPRenewAddress() function, which is defined as:

DWORD IpRenewAddress (PIP_ADAPTER_INDEX_MAP AdapterInfo);

Each of these two functions features an AdapterInfo parameter that is an IP_ADAPTER_INDEX_MAP structure, which identifies the adapter to release or renew the address for. The IP_ADAPTER_INDEX_MAP structure is defined as:

 

typedef struct _IP_ADAPTER_INDEX_MAP

{

    ULONG Index;

    WCHAR Name[MAX_ADAPTER_NAME];

}IP_ADAPTER_INDEX_MAP, *PIP_ADAPTER_INDEX_MAP;

 

The fields of this structure are defined as follows:

 

• Index: Identifies the internal index of the network interface that the adapter is assigned to.
• Name: Identifies the name of the adapter.

 

You can retrieve the IP_ADAPTER_INDEX_MAP structure for a particular adapter by calling the GetInterfaceInfo() function, which is defined as:

DWORD GetInterfaceInfo (IN PIP_INTERFACE_INFO pIfTable, OUT PULONG dwOutBufLen);

The pIfTable parameter is a pointer to an IP_INTERFACE_INFO application buffer that will receive interface information. The dwOutBufLen parameter is a pointer to a variable that specifies the size of the buffer you passed in the pIfTable parameter. If the buffer is not large enough to hold the interface information, GetInterfaceInfo() returns the error ERROR_INSUFFICIENT_BUFFER and sets the dwOutBufLen parameter to the required buffer size. The IP_INTERFACE_INFO structure is defined as:

 

typedef struct _IP_INTERFACE_INFO

{

    LONG                 NumAdapters;

    IP_ADAPTER_INDEX_MAP Adapter[1];

} IP_INTERFACE_INFO,*PIP_INTERFACE_INFO;

 

Its fields are defined as follows:

 

• NumAdapters: Identifies the number of adapters in the Adapter field.
• Adapter: Is an array of IP_ADAPTER_INDEX_MAP structures, defined on the preceding page.

 

Once you have obtained the IP_ADAPTER_INDEX_MAP structure for a particular adapter, you can release or renew the DHCP-assigned IPv4 address using the IPReleaseAddress() and IPRenewAddress() functions we just described.

 

Changing IPv4 Addresses

 

The IPCONFIG.EXE utility does not allow you to change an IP address for a network adapter (except in the case of DHCP). However, two functions will allow you to add or delete an IP address for a particular adapter: the AddIpAddress() and DeleteIpAddress() IP Helper functions. These require you to understand adapter index numbers and IP context numbers. In Windows, every network adapter has a unique index ID (which we described earlier), and every IP address has a unique context ID. Adapter index IDs and IP context numbers can be retrieved using GetAdaptersInfo(). The AddIpAddress() function is defined as:

 

DWORD AddIPAddress (

    IPAddr Address,

    IPMask IpMask,

    DWORD IfIndex,

    PULONG NTEContext,

    PULONG NTEInstance

);

 

The Address parameter specifies the IPv4 address to add as an unsigned long value. The IpMask parameter specifies the subnet mask for the IPv4 address as an unsigned long value. The IfIndex parameter specifies the adapter index to add the address to. The NTEContext parameter receives the context value associated with the IPv4 address added. The NTEInstance parameter receives an instance value associated with an IPv4 address.

If you want to programmatically delete an IPv4 address for an adapter, you can call DeleteIpAddress(), which is defined as:

DWORD DeleteIPAddress (ULONG NTEContext);

The NTEContext parameter identifies a context value associated with an IPv4 address. This value can be obtained from GetAdaptersInfo(), which we described earlier in the chapter.

Note that IPv4 addresses added via the AddIpAddress function are persistent only until reboot.

 

 

 

---

< Chap 13: Index | Winsock 2 Main | Netstat: Retrieve TCP, UDP Tables & Protocol Statistics >