[lmikle]

Не знаю, у меня работает.
Без фильтра:

976: 0.0.0.0:135 <=> 0.0.0.0:0
4: 0.0.0.0:445 <=> 0.0.0.0:0
4524: 0.0.0.0:3050 <=> 0.0.0.0:0
6700: 0.0.0.0:5040 <=> 0.0.0.0:0
4: 0.0.0.0:5357 <=> 0.0.0.0:0
764: 0.0.0.0:49664 <=> 0.0.0.0:0
672: 0.0.0.0:49665 <=> 0.0.0.0:0
1584: 0.0.0.0:49666 <=> 0.0.0.0:0
1332: 0.0.0.0:49667 <=> 0.0.0.0:0
3172: 0.0.0.0:49668 <=> 0.0.0.0:0
744: 0.0.0.0:49677 <=> 0.0.0.0:0
4: 0.0.0.0:50123 <=> 0.0.0.0:0
19264: 127.0.0.1:19293 <=> 0.0.0.0:0
4: 192.168.1.7:139 <=> 0.0.0.0:0
18004: 192.168.1.7:64404 <=> 172.183.7.194:443
18004: 192.168.1.7:64413 <=> 20.169.174.231:443
3764: 192.168.1.7:64421 <=> 172.183.7.194:443
18004: 192.168.1.7:64747 <=> 87.250.251.119:443
18004: 192.168.1.7:64752 <=> 87.250.250.119:443
18004: 192.168.1.7:64824 <=> 172.253.122.17:443
18004: 192.168.1.7:64825 <=> 142.251.163.83:443
0: 192.168.1.7:64826 <=> 142.251.111.95:443
0: 192.168.1.7:64827 <=> 142.250.31.95:443
18004: 192.168.1.7:64828 <=> 142.251.163.83:443
0: 192.168.1.7:64836 <=> 23.207.133.136:80

С фильтром (18004):

18004: 192.168.1.7:64404 <=> 172.183.7.194:443
18004: 192.168.1.7:64413 <=> 20.169.174.231:443
18004: 192.168.1.7:64747 <=> 87.250.251.119:443
18004: 192.168.1.7:64752 <=> 87.250.250.119:443
18004: 192.168.1.7:64824 <=> 172.253.122.17:443
18004: 192.168.1.7:64825 <=> 142.251.163.83:443
18004: 192.168.1.7:64828 <=> 142.251.163.83:443
18004: 192.168.1.7:64845 <=> 13.107.6.158:443

Поток:

Код:

unit Unit2;

interface

uses
  Windows, System.Classes, System.SyncObjs;

type
  TIpTableItem = record
    LocalAddr : String;
    RemoteAddr : String;
    pid : Cardinal;
  end;

  TConnectionListener = class(TThread)
  private
    { Private declarations }
    FIpTable : Array Of TIpTableItem;
    function GetItem(Index: Integer): TIpTableItem;
    function GetCount: Integer;
    procedure ListOpenTCPConnections;
  protected
    procedure Execute; override;
  public
    property Count : Integer read GetCount;
    property IpTable[Index : Integer] : TIpTableItem read GetItem;
  end;

var
  IpTableLocker : TCriticalSection;

implementation

uses
  IpHlpApi, TlHelp32, WinSock, SysUtils;

const
  TCP_TABLE_BASIC_CONNECTIONS = 1; // Table class for basic TCP connections
  TCP_TABLE_OWNER_PID_ALL = 5; // Table class for all TCP connections with PIDs
  AF_INET = 2; // IPv4
  AF_INET6 = 23; // IPv6

type
  MIB_TCPROW_OWNER_PID = record
    dwState: DWORD;
    dwLocalAddr: DWORD;
    dwLocalPort: DWORD;
    dwRemoteAddr: DWORD;
    dwRemotePort: DWORD;
    dwOwningPid: DWORD;
  end;

  PMIB_TCPTABLE_OWNER_PID = ^MIB_TCPTABLE_OWNER_PID;
  MIB_TCPTABLE_OWNER_PID = record
    dwNumEntries: DWORD;
    table: array[0..0] of MIB_TCPROW_OWNER_PID;
  end;

function GetExtendedTcpTable(pTcpTable: Pointer; var pdwSize: DWORD; bOrder: BOOL;
  ulAf: ULONG; TableClass: DWORD; Reserved: ULONG): DWORD; stdcall;
  external 'iphlpapi.dll';

{ TConnectionListener }

procedure TConnectionListener.Execute;
begin
  While Not Terminated Do
    Begin
      IpTableLocker.Enter;
      Try
        ListOpenTCPConnections;
      Finally
        IpTableLocker.Leave;
      End;
      Sleep(500);
    End;
end;

procedure TConnectionListener.ListOpenTCPConnections;
var
  TcpTable: PMIB_TCPTABLE_OWNER_PID;
  TableSize: DWORD;
  i: Integer;
begin
  TableSize := 0;
  // First call to get the required buffer size
  GetExtendedTcpTable(nil, TableSize, True, AF_INET, TCP_TABLE_OWNER_PID_ALL, 0);

  // Allocate memory for the table
  GetMem(TcpTable, TableSize);
  try
    // Retrieve the TCP table
    if GetExtendedTcpTable(TcpTable, TableSize, True, AF_INET, TCP_TABLE_OWNER_PID_ALL, 0) = NO_ERROR then
    begin
      SetLength(FIpTable,TcpTable.dwNumEntries);
      for i := 0 to TcpTable.dwNumEntries - 1 do
      begin
        with TcpTable.Table[i] do
        begin
          FIpTable[i].LocalAddr := Format('%d.%d.%d.%d:%d', [
            dwLocalAddr and $FF,
            (dwLocalAddr shr 8) and $FF,
            (dwLocalAddr shr 16) and $FF,
            (dwLocalAddr shr 24) and $FF,
            ntohs(dwLocalPort)
          ]);

          FIpTable[i].RemoteAddr := Format('%d.%d.%d.%d:%d', [
            dwRemoteAddr and $FF,
            (dwRemoteAddr shr 8) and $FF,
            (dwRemoteAddr shr 16) and $FF,
            (dwRemoteAddr shr 24) and $FF,
            ntohs(dwRemotePort)
          ]);

          FIpTable[i].pid := dwOwningPid;
        end;
      end;
    end
    else
      Begin
        SetLength(FIpTable,1);
        FIpTable[0].LocalAddr := 'Error';
        FIpTable[0].RemoteAddr := 'Error';
      End;
  finally
    FreeMem(TcpTable);
  end;
end;

function TConnectionListener.GetCount: Integer;
begin
  Result := Length(FIpTable);
end;

function TConnectionListener.GetItem(Index: Integer): TIpTableItem;
begin
  Result := FIpTable[Index];
end;

initialization
  IpTableLocker := TCriticalSection.Create;

finalization
  IpTableLocker.Free;

end.

Главное приложение:

Код:

unit Unit1;

interface

uses
  Winapi.Windows, Winapi.Messages, System.SysUtils, System.Variants, System.Classes, Vcl.Graphics,
  Vcl.Controls, Vcl.Forms, Vcl.Dialogs, Unit2, Vcl.ExtCtrls, Vcl.StdCtrls;

type
  TForm1 = class(TForm)
    edConnections: TMemo;
    edPid: TEdit;
    lbPid: TLabel;
    tmConnections: TTimer;
    procedure tmConnectionsTimer(Sender: TObject);
    procedure FormCreate(Sender: TObject);
    procedure FormDestroy(Sender: TObject);
  private
    { Private declarations }
    FThread : TConnectionListener;
  public
    { Public declarations }
  end;

var
  Form1: TForm1;

implementation

{$R *.dfm}

procedure TForm1.FormCreate(Sender: TObject);
begin
  FThread := TConnectionListener.Create(True);
  FThread.FreeOnTerminate := False;
  FThread.Start;
end;

procedure TForm1.FormDestroy(Sender: TObject);
begin
  FThread.Terminate;
  FThread.WaitFor;
  FThread.Free;
end;

procedure TForm1.tmConnectionsTimer(Sender: TObject);
var
  I : Integer;
  iPid : Cardinal;
begin
  tmConnections.Enabled := False;
  IpTableLocker.Enter;
  iPid := StrToIntDef(edPid.Text,0);
  edConnections.Lines.BeginUpdate;
  Try
    edConnections.Lines.Clear;
    for I := 0 to FThread.Count-1 do
      if (iPid = 0) Or (iPid = FThread.IpTable[i].pid) then
        edConnections.Lines.Add(Format('%d: %s <=> %s',[FThread.IpTable[i].pid, FThread.IpTable[i].LocalAddr,FThread.IpTable[i].RemoteAddr]));
  Finally
    edConnections.Lines.EndUpdate;
    IpTableLocker.Leave;
    tmConnections.Enabled := True;
  End;
end;

end.