0

By writing in my shell the instruction that displays all the connections that my computer has, I realize that some IPs are displayed like this: 0.0.0.0, *:*, [::], [::1] and even stranger, on some ports no port is specified or all simply zero... If there is no port or just no IP, why does the computer display this to me as a connection ?

3

I am guessing that the instruction is some form of netstat command. (Please include the actual command, however. We're not mind readers.)

  1. Connections to [::1] are normal: it is the IPv6 address of localhost, equal to 127.0.0.1 in IPv4. Many programs use such loopback connections internally, for communication between their own components.

  2. Both [::] and 0.0.0.0 are "wildcard" addresses and mean the address isn't known yet. This means the line does not actually represent an active connection.

    Netstat doesn't just show connections; it also shows sockets which are listening – that is, waiting to receive an incoming connection. Such sockets don't have a remote address because they don't know what host will connect in the future.

    Therefore the all-zeros ("any" or "null" or "unspecified") remote address is shown instead. (But many netstat-like programs just show a blank field instead.)

  3. For 'listening' sockets, the local address may be all-zero for the same reason.

    A computer may have multiple IP addresses (indeed most have at least two: the loopback address and the LAN address), and a 'listening' socket may be configured to wait for connections made either to any of those addresses, or just a specific address. (That is, bound to a specific local address.)

    Most listening sockets aren't bound to any specific local address; they'll accept all connections. Because the local address is unspecified, it is shown as all-zeros as well.

| improve this answer | |
  • Thank you for your answer, so if I understand correctly, if netstat displays a line with an empty IP it just means that it is a socket that is not yet connected, and therefore it has port zero. 127.0.0.0.1 is equal to [::], that's fine, however what's the difference between *:* and [::]:0 ? The first one doesn't even have a port number. – user945590 Sep 19 '18 at 12:03
  • @Tao: Same thing. Sometimes the empty address is shown as *, sometimes as [::]/0.0.0.0, depending on what tool you use (Windows netstat isn't the same as Linux netstat, which isn't the same as FreeBSD netstat...) Likewise, the remote port might show up as * or 0 when it's unknown. – user1686 Sep 19 '18 at 12:12
  • Note that while TCP requires connections to be esablished before transferring data UDP can hapilly exchange data over a socket that is only bound to a local port. – plugwash Sep 19 '18 at 14:06
  • @plugwash : So these sockets, not having an address obviously established by internal programs, that "netstat" displayed me necessarily worked in UDP? – user945590 Sep 21 '18 at 17:19
  • No. They could still have been TCP 'listening' sockets. "Can be" is not the same as "will necessarily be". – user1686 Sep 21 '18 at 18:10

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy