23

I used netstat (in Windows) to view the listened ports for TCP and UDP:

enter image description here

I noticed that in the Foreign Address column, UDP displays *:* instead of 0.0.0.0:0, do these two values represent the same thing? If so, then why does UDP display *:* instead of 0.0.0.0:0?

6
  • I believe *:* is IPv6 while 0.0.0.0:0 is IPv4.
    – LPChip
    Jul 1, 2016 at 14:23
  • I have also noticed the following: UDP 0.0.0.0:5355 *:*, does that mean that data can be sent between IPv4 and IPv6?
    – user612473
    Jul 1, 2016 at 14:37
  • look here: security.stackexchange.com/questions/13724/… Jul 1, 2016 at 14:37
  • 4
    the IPv6 equivalent of 0.0.0.0 is [::] Jul 1, 2016 at 14:39
  • 2
    @LPChip You are mistaken. *:* doesn't say anything about the IP version. However since the local address of that socket is IPv4 only, then the remote address has to be IPv4 as well.
    – kasperd
    Jul 1, 2016 at 20:41

4 Answers 4

12

It has been pointed out that my answer was in error. Since I cannot delete it, I will instead provide the correct one.

The expression *:* means "Any Address, Any port". All UDP listeners will display this signature. This is due to the connectionless nature of UDP.


Original (incorrect) answer. Yes and no. *:* refers to ANY IPv6 address. The distinction between an unknown/unspecified address is vague in IPv4, so we use 0.0.0.0/0 to represent any host on the network, but in IPv6 there is a subtle difference.

For the most part however, people use :: to represent a contiguous string of 0's.

In an IPv6 address, any sequence of contiguous zeros can be replaced with :: so:

  • 0.0.0.0/0 => 0000:0000:0000:0000:0000:0000:0000:0000 => :: => *:*
  • fe80:0000:0000:0000:2000:0aff:fea7:0f7c => fe80::2000:0aff:fea7:0f7c

The representation using wildcards however allows a finer control of address patterns. For instance, :: would not match fe80::2000:0aff:fea7:0f7c, but *:* will.

This difference isn't really meaningful to any device that isn't performing routing, but when it comes time to select optimal routes to aggregated address spaces, the wildcard notation allows more flexible selection of destination networks.

10
  • 5
    But you wrote in your answer that *:* refers to ANY IPv6 address Here you say any..address i.e.presumably IPv4 or IPv6. So which is it? Is *:* limiting itself to IPv6, or does it allow for IPv4 too?
    – barlop
    Jul 1, 2016 at 17:11
  • 2
    Both sockets mentioned in the question are IPv4-only. You can see that from the local address assigned to each socket. As such mentioning IPv6 is not relevant to the question.
    – kasperd
    Jul 1, 2016 at 20:47
  • 7
    IPv6 isn't relevant to this question at all.
    – hobbs
    Jul 2, 2016 at 5:02
  • 8
    This answer is totally wrong for the question asked.
    – Brad
    Jul 2, 2016 at 5:33
  • 3
    As kasperd's comment notes (and hobbs's comment too), IPv6 is unrelated to the question. The question is about what we see in the Foreign Address column, which corresponds to what is in the same row(s) in the Local Address column, which is IPv4. (Although, with some operating systems, listening on one address family/IP-version may typically auto-listen on another address family.)
    – TOOGAM
    Jul 2, 2016 at 6:04
15

The / refers to the subnet netmask, which is part of the IP Layer.

The : refers to a port which is part of the Transport Layer.

For TCP it makes sense that there is a remote end for a connection.

UDP, since it is connectionless, it doesn't make any sense for it to show a foreign address.

My gut feeling is that it would always show the wildcard for UDP and that it is potentially there to make parsing the output a little more friendly, or to show if you are using IPv4/6:

IPV4 "*:*" vs IPV6 "[::]:*"

1
  • I was just saying this to some friends. You could display listening PORTS, but to display actual remote sessions when there isn't one is likely the reason why its displayed as *:*for remote UDP non-existant sessions. I'm in agreement with you here. Jul 2, 2016 at 0:40
7

In both cases the information is basically meaningless, but indicates more-or-less the same thing.

Your first line is a TCP listen socket. The local address column indicates the address and port that it's accepting connections on, and the remote address column means nothing because a listen socket has no remote end of the connection yet. A connected TCP socket would show the address of the other end of the connection in that column, but for a listen socket it decides to display an all-zero address and port.

Your second line is a UDP socket. UDP is a connectionless protocol, meaning that it sends and receives packets without any notion of who connected to who, whether the packet is part of an existing conversation, or whether the data just arrived out of the blue. The local address column has the same meaning as it does for TCP, and the remote address column is meaningless because a UDP socket could have one peer, many peers, or no peers at any moment. (Actually POSIX has the notion of a "connected UDP socket" but that's getting a bit far afield).

Now the question: why do they display differently? It seems to be nothing more than a quirk of the Windows netstat code. Linux (net-tools) netstat displays 0.0.0.0:* for the remote end of both TCP listen sockets and UDP sockets (for IPv4; it displays :::* for IPv6), which is different from either example on Windows, but at least it's consistent within the same program. Perhaps Windows is going for a semantic distinction between "to be filled in later" in the case of TCP and "open to anything" in the case of UDP, but just as likely the two bits of code were written by two different people with no particular concern for consistency.

2
  • +1 for the start of the 4th paragraph. 0.0.0.0 has some documentation: An address of all zeros is the "unspecified" address (according to the IPv6 Addressing RFC 4291 sec 2.5.2), often applying to unknown addresses. RFC 1700 page 4 mentions "Can only be used as a source address", and RFC 1122#page-29 section "a" describes usage further. (my answer about ::: mentions 0.0.0.0)
    – TOOGAM
    Jul 2, 2016 at 6:35
  • Doesn't the 0.0.0.0:0 value in the Foreign Address column means that any IP address and port number can send data to this socket? and if this value was for example 127.0.0.0:12345, then this means that only the IP address 127.0.0.0 with the port number 12345 can send data to this socket and no one else?
    – Tom
    Jul 2, 2016 at 8:41
6

The difference is simply notational.

Netstat in Windows uses 0.0.0.0:0 to represent an abstract idea of "any remote address and port" for a local IPv4 TCP listener and *:* for a UDP listener. For IPv6, the remote address is denoted by [::]:0 for TCP and *:* for UDP.

In OS X, *.* is used for both TCP and UDP, whether IPv4 or IPv6 (note that OS X uses dots to separate address and port). Linux uses 0.0.0.0:* for IPv4 and :::* for IPv6, with the first two colons representing the abbreviation for all IPv6 address and the third colon the separator between the address and the port.

IIRC from something I heard or read long ago, I think UDP pairings can show up, but usually don't because they are torn down upon completion and UDP connections are usually very short, lasting milliseconds or less. I've never seen this myself, though, so it could be incorrect.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .