Take the 2-minute tour ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.

This is the output of netstat -tulpn that I get:

tcp        0      0 127.0.0.1:2208              0.0.0.0:*                   LISTEN      2055/hpiod
tcp        0      0 127.0.0.1:631               0.0.0.0:*                   LISTEN      2077/cupsd
tcp        0      0 127.0.0.1:25                0.0.0.0:*                   LISTEN      2138/sendmail: acce
tcp        0      0 127.0.0.1:2207              0.0.0.0:*                   LISTEN      2060/python
tcp        0      0 0.0.0.0:735                 0.0.0.0:*                   LISTEN      1825/rpc.statd
tcp        0      0 :::111                      :::*                        LISTEN      1781/rpcbind
tcp        0      0 :::80                       :::*                        LISTEN      2624/httpd
tcp        0      0 :::22                       :::*                        LISTEN      2096/sshd
udp        0      0 0.0.0.0:32768               0.0.0.0:*                               2398/avahi-daemon:
udp        0      0 0.0.0.0:68                  0.0.0.0:*                               1581/dhclient
udp        0      0 0.0.0.0:729                 0.0.0.0:*                               1825/rpc.statd
udp        0      0 0.0.0.0:732                 0.0.0.0:*                               1825/rpc.statd
udp        0      0 0.0.0.0:5353                0.0.0.0:*                               2398/avahi-daemon:
udp        0      0 0.0.0.0:631                 0.0.0.0:*                               2077/cupsd
udp        0      0 :::32769                    :::*                                    2398/avahi-daemon:
udp        0      0 :::684                      :::*                                    1781/rpcbind
udp        0      0 :::5353                     :::*                                    2398/avahi-daemon:
udp        0      0 :::111                      :::*                                    1781/rpcbind

I'm curious to know: what does ::: in Local Address mean? And what is 0.0.0.0:* and :::* in Foreign Address?

share|improve this question
3  
You can omit leading zeros in IPv6, so that just leaves the colon. –  Louis Oct 17 '13 at 13:42
    
Actually I spoke too soon. I don't know why there are three colons instead of two, +1. I guess the last one is indicating the port. –  Louis Oct 17 '13 at 14:05
    
Analogous IPv4: superuser.com/questions/386436/the-meaning-of-port-0-in-netstat-output –  Ciro Santilli Aug 25 at 18:47
    
Closely related: serverfault.com/questions/444554/… –  Ciro Santilli Aug 25 at 19:36

4 Answers 4

:::* Would be your localhost/loop back in IPv6 :)

Basically, you have services listening and connecting to services locally.

share|improve this answer
    
If I interpret tools.ietf.org/html/rfc4291#section-2.5.2 correctly, :: is not loopback: it is the unspecified address, and loopback is at ::1. –  Ciro Santilli Aug 25 at 17:56

It refers to the IPv6 address. In IPv6 we can condense a sequence of 0's using the :: modifier

For example,

0:0:0:0:0:0:0:1

can be written as

::1

But there are specific rules to be followed in this regard which you can look up on any Ipv6 tutorial

share|improve this answer

::1 is the localhost for IPv6, like 127.0.0.1 for IPv4.

:::* is the short version of 0:0:1:* (IPv6 0:0:0, port *), it is like IPv4 0.0.0.0:*. Both of these in the foreign address column mean that there is no foreign address column. In case of the listening sockets it is clear that there is not (yet) a connected foreign address. In case of the udp sockets you normally do not have connected foreign addresses, so these are also listed with 0.0.0.0:*.

share|improve this answer

As others said, it's the natural IPv6 notation for this context.

Let's cite and interpret the relevant standards:

:::* == 0000.0000.0000.0000.0000.0000.0000.0000:*

http://tools.ietf.org/html/rfc5952#section-4 says that the canonical (not just a possible shorthand) IPv6 addresses are:

  • written in hex with the characters a-f lowercase.
  • grouped every 2 bytes by :
  • leading 0's MUST be removed. 0000 becomes 0.
  • the longest sequence of :0:0:0: MUST be converted to ::. Can only be done once, or would lead to ambiguity.

So :::* means:

  • 0000:0000:0000:0000:0000:0000:0000 on any port (:*)
  • == 0:0:0:0:0:0:0 (trailing 0 removal)
  • == :: (consecutive zero contraction)

0000.0000.0000.0000.0000.0000.0000.0000:* == unspecified address

http://tools.ietf.org/html/rfc4291#section-2.5.2 defines the "unspecified address":

The address 0:0:0:0:0:0:0:0 is called the unspecified address. It must never be assigned to any node. It indicates the absence of an address. One example of its use is in the Source Address field of any IPv6 packets sent by an initializing host before it has learned its own address.

The unspecified address must not be used as the destination address of IPv6 packets or in IPv6 Routing headers. An IPv6 packet with a source address of unspecified must never be forwarded by an IPv6 router.

which makes it a good choice for a N/A column like in this case.

So :: is not localhost, which the same document says is at ::1.

On netstat 1.60, the protocols on the output read tcp6 and udp6 for IPv6, which show better what is going on, e.g.:

tcp6       0      0 :::22                   :::*                    LISTEN      1201/sshd
udp6       0      0 :::5353                 :::*                                1449/avahi-daemon:
share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.