Get COM/DCOM Connections?

Question

I'd like to figure out what IP address a DCOM client is connecting from. I have an OPC server, and from the context of the COM/DCOM code, there is no way to get the client IP that I can find. This article appears to confirm that (http://blogs.msdn.com/b/sanpil/archive/2004/03/01/82302.aspx).

I tried using a C++ library that netstat uses (iphlpapi.lib, GetExtendedTcpTable) to get open connections with no luck. It looks like COM/DCOM defaults to UDP.

The only other thing I can think of is using WireShark pcap to try and capture inbound traffic on port 135?

Does anyone have any clever ideas?

Answer 1

It's said "Using DCOM through firewalls becomes problematic because it dynamically allocates one port per process (configurable through the registry) and requires UPD and TCP ports 135-139 to be open. ".