0

By writing in my shell the instruction that displays all the connections that my computer has, I realize that some IPs are displayed like this: 0.0.0.0, *:*, [::], [::1] and even stranger, on some ports no port is specified or all simply zero... If there is no port or just no IP, why does the computer display this to me as a connection ?

  • 2
    Possible duplicate of [What's the difference between 127.0.0.1 and 0.0.0.0?](https://superuser.com/questions/949428/whats-the-difference-between-127-0-0-1-and-0-0-0-0) – Kamil Maciorowski Sep 19 '18 at 10:18
  • Not exactly, but thank you for the link, it's interesting. –  Sep 19 '18 at 12:06

1 Answers1

3

I am guessing that the instruction is some form of netstat command. (Please include the actual command, however. We're not mind readers.)

  1. Connections to [::1] are normal: it is the IPv6 address of localhost, equal to 127.0.0.1 in IPv4. Many programs use such loopback connections internally, for communication between their own components.

  2. Both [::] and 0.0.0.0 are "wildcard" addresses and mean the address isn't known yet. This means the line does not actually represent an active connection.

    Netstat doesn't just show connections; it also shows sockets which are listening – that is, waiting to receive an incoming connection. Such sockets don't have a remote address because they don't know what host will connect in the future.

    Therefore the all-zeros ("any" or "null" or "unspecified") remote address is shown instead. (But many netstat-like programs just show a blank field instead.)

  3. For 'listening' sockets, the local address may be all-zero for the same reason.

    A computer may have multiple IP addresses (indeed most have at least two: the loopback address and the LAN address), and a 'listening' socket may be configured to wait for connections made either to any of those addresses, or just a specific address. (That is, bound to a specific local address.)

    Most listening sockets aren't bound to any specific local address; they'll accept all connections. Because the local address is unspecified, it is shown as all-zeros as well.

u1686_grawity
  • 426,297
  • 64
  • 894
  • 966
  • Thank you for your answer, so if I understand correctly, if `netstat` displays a line with an empty IP it just means that it is a socket that is not yet connected, and therefore it has port zero. 127.0.0.0.1 is equal to `[::]`, that's fine, however what's the difference between `*:*` and `[::]:0` ? The first one doesn't even have a port number. –  Sep 19 '18 at 12:03
  • @Tao: Same thing. Sometimes the empty address is shown as `*`, sometimes as `[::]`/`0.0.0.0`, depending on what tool you use (Windows netstat isn't the same as Linux netstat, which isn't the same as FreeBSD netstat...) Likewise, the remote port might show up as `*` or `0` when it's unknown. – u1686_grawity Sep 19 '18 at 12:12
  • Note that while TCP requires connections to be esablished before transferring data UDP can hapilly exchange data over a socket that is only bound to a local port. – plugwash Sep 19 '18 at 14:06
  • @plugwash : So these sockets, not having an address obviously established by internal programs, that "netstat" displayed me necessarily worked in UDP? –  Sep 21 '18 at 17:19
  • No. They could still have been TCP 'listening' sockets. "Can be" is not the same as "will necessarily be". – u1686_grawity Sep 21 '18 at 18:10
  • Okay, so the only difference is that on TCP you have to establish a connection first? –  Sep 21 '18 at 23:11