How does Windows "netstat -b" determine the name of the process that owns each socket? [closed]

Question

I'm looking for the underlying API calls that netstat -b is using to determine the owning processes for each socket. Any ideas?

Answer 1

You need to look at the IPHelper APIs, in this case specifically GetExtendedTcpTable and GetOwnerModuleFromTcpEntry