Windows – Understanding the netstat command output

ipnetstatnetworkingwindows

I used netstat command recently, and the output is below.

netstat  -a    

proto  local address          foreign address       state

tcp    127.0.0.1:1107         avinash-pc:0          listening
tcp    0.0.0.0:134            avinash-pc:0          listening
tcp    226.178.166.149:1104   a60-274-182-61:https  close_wait
udp    0.0.0.0:566            *.*                   
udp    [::]:566               *.*

When I did netstat -n, there was no 0.0.0.0:134 in the output… why?
What is meant by the first and second entries(local and foreign address are both on my computer)
- i.e. why is my computer connecting to itself?
What is meant by . of 3rd entry and [::] of 4th entry?

Best Answer

from netstat -h:

-a            Displays all connections and listening ports.

As in both current connections and listening ports (half open).

-n            Displays addresses and port numbers in numerical form.

As in, do not resolve addresses to host names.

Your computer can and regularly does connect to itself, usually for IPC or administrative tasks.

*.* = All IPv4 addresses (it's listening, so accept connections from any IPv4)
[::] = All IPv6 addresses (same reason as the last).

Related Solutions

Windows – What’s the command-line utility in Windows to do a reverse DNS look-up

ping -a w.x.y.z

Should resolve the name from the IP address if the reverse lookup zone has been set up properly. If the reverse lookup zone does not have an entry for the record, the -a will just ping without a name.

Difference Between IP Address 0.0.0.0 and 127.0.0.1

The only thing is that you're not saying "all addresses should have access" -- that's done in your firewall(s) and/or the server software and/or other security layers like tcpwrappers.

0.0.0.0, in this context, means "all IP addresses on the local machine" (in fact probably, "all IPv4 addresses on the local machine"). So, if your webserver machine has two IP addresses, 192.168.1.1 and 10.1.2.1, and you allow a webserver daemon like apache to listen on 0.0.0.0, it will be reachable at both of those IP addresses. But only to what can contact those IP addresses and the web port(s).

Note that, in a different context (routing) 0.0.0.0 usually means the default route (the route to "the rest of" the internet, aside from routes in your local network etc.).

Best Answer

Related Solutions

Windows – What’s the command-line utility in Windows to do a reverse DNS look-up

Difference Between IP Address 0.0.0.0 and 127.0.0.1

Related Topic