Return to WWW.WARD.NU

GPL'ed RWho Daemon for Windows
Version 0.3, compiled with Delphi 4.03, tested with Windows 95/98
Written By Ward van Wanrooij (ward@ward.nu, http://www.ward.nu)

Copyright 2000, Ward van Wanrooij

Latest version can be obtained at http://www.ward.nu/computer/rwhodwin.


Return to WWW.WARD.NU


I thought it would be fun to see my Windows machines in the ruptime report on my Linux machine. So I started to search for an rwhod daemon for Windows. I was very amazed hoewever to see that no such program existed. Although I don't program in C and also am not a linux kernel hacker, I started to research the rwho protocol, rwhod.c and write an rwhod implementation for Windows. Surprisingly, I call the program RWhod for Windows. One more thing: I develop in Borland Delphi. So don't be shocked by seeing ObjectPascal code.

Table Of Contents


The source of rwhodwin is available under the GPL. If you make any modifications to the source code, I would be very happy to receive them. I am the current maintainer of rwhodwin.

It is highly recommended that you subscribe to the mailinglist to keep up-to-date about new releases.

Table Of Contents


22-05-2000 Removed TWSocket dependency, added TSock dependency, since I am the current maintainer of TSock.Shortened the code by a few lines. (0.30)
19-03-2000 Bugfix for two typos, added note about strange behaviour using WinSock1. (0.22)
19-02-2000 Bugfix for Microsoft registry awkwardness. See Why #1 in code. Released version 0.21.
05-02-2000 Complete rewrite of the code. The former code was more fficient, but this one is far more clean. This one is truly object oriented programmed. Released version 0.2.
02-02-2000 Release of version 0.1-pre.
01-02-2000 Development on rwhodwin started.

Table Of Contents

My Delphi implementation of the rwho protocol

A rwho message is normally sent via UDP from the current pc at the rwho port (513) to the rwho port of the broadcast-address. A single rwho message consists of one Twhod object, which in its turn consits of at least one Twhoent object. For every active console on the system, an extra Twhoent should be provided. If one user is active then two whoent structs should be provided!

length name/type/description example
  Toutmp = record  
08 out_line: array[0..7] of char;
Console name. I used the value pts/0 because I had to use *some* value.
70 74 73 2F 30 00 00 00
08 out_name: array[0..7] of char;
User name. I used the name windows to identify the packets.
77 69 6F 64 6F 77 73 00
01 out_time: cardinal;
Login time. I used the value of boottime, because the login-ime cannot be accessed in Windows. All cardinal values have to be transformed into network byte order before transmission. The function NetworkByteOrder(NBTIn: Cardinal): Cardinal; provides this functionality
38 88 4A E2
  Twhoent = record  
20 we_utmp: Toutmp;  
04 we_idle: cardinal;
The idle time in seconds for the console. If this time is greater than 1 hour, the user does not show up in rwho. So I used the value 1 hour, 1 minute to hide the windows user in rwho.
00 00 0E 4C
  Twhod = record  
01 wd_vers: char
Version number. This number should always be set to 01.
01 wd_type: char;
Status number. This number should always be set to 01, meaning up.
02 wd_fill: array[0..1] of char;
Two bytes used as fillers. These values should not be filled in.
00 00
04 wd_sendtime: cardinal;
The time at which the packet was sent. The time is coded in UTC in seconds since 01-01-1970, also known as the Epoch in the Unix world.
38 96 F6 92
04 wd_recvtime: cardinal;
The time at which the packet was received. The receiving operating system fills in this value.
00 00 00 00
32 wd_hostname[32]: array[0..31] of char;
The hostname of the sending machine. I use the API function GetHostname() to return the hostname.
72 6f 67 65 72 77 69 6C 63 6F 00 00 .. 00
12 wd_loadav[3]: array[0..2] of cardinal;
The load average in the last 1-, 5- and 15-minutes periods. I really do not know how the interpret the load-averages under Unix, and neither does anybody whom I have asked. rwhod for Windows sends the percentual usage of the primary CPU as the load average. The CPU usage is checked every 10 seconds. If anyone does have any information on the load average, then please contact me.
00 00 00 10 00 00 00 15 00 00 00 20
0.10 0.21 0.32
04 wd_boottime: cardinal;
The time the system booted.
38 88 4A E2
24 wd_we: array[0..41] of Twhoent;
The declaration of wd_we differs a little bit from its Unix cousin (wd_we[1024 / sizeof (struct whoent)]), but it is the same under this version of the rwho-protocol. You can recheck this yourself, if you want to.

Table Of Contents


Installation and configuration of rwhodwin is fairly simple. Just enter your desired values in the registry (or load rwhodwin.reg) and start rwhodwin.exe.

name/type/description example
HKEY_LOCAL_MACHINE\Software\Ward\rwhodwin\Port (string)
Port at which connection should be initiated from and to. Default value is rwho or 513.
HKEY_LOCAL_MACHINE\Software\Ward\rwhodwin\Subnetmask (string)
Subnet which should receive the UDP broadcast. Default value is

Table Of Contents

Bugs, known 'weird behaviour'

Table Of Contents