Take the 2-minute tour ×
Unix & Linux Stack Exchange is a question and answer site for users of Linux, FreeBSD and other Un*x-like operating systems.. It's 100% free, no registration required.

Local address on netstat output:

When I do netstat -ntlp there is a column called Local Address:

  • sometimes it would output IP address as 0.0.0.0:7180
  • and sometimes 127.0.0.1:9001

What's the implications of both notations?

Does specific IP address act like a filter for incoming connections? E.g. for 127.0.0.1:9001 it will only accept connections from localhost on port 9001?

Thanks in advance.

share|improve this question

5 Answers 5

0.0.0.0 means the process is bound to all interfaces.

127.0.0.1 means the process is bound only to the 127.0.0.1 interface (loopback).

If you had other interfaces you might have x.y.z.a entries indicating the process was bound to those specific interfaces.

A process will only be told if traffic arrives on the interfaces to which it is bound, so yes, it's kind of a filter, although it's not usually described in those terms.

share|improve this answer

I think you've answered your own question.

As an example, apache has it's Listen option which tells it which address and port to listen on. Depending on how this is set, apache will listen on any IP address, a specific address:-

Listen *:80
Listen 0.0.0.0:80
Listen 127.0.0.1:80
Listen 192.168.0.5:80

The above options show up as:-

:::80
0.0.0.0:80
127.0.0.1:80
192.168.0.5:80

and translate to:-

  • Listen on any IP address (IPv4 or IPv6)
  • Listen on any IPv4 address on that server
  • Listen on IPv4 localhost only
  • Listen on external IPv4 address 192.68.0.5

You could configure your service to listen on only the localhost interface if you don't want anyone external to access it. For example, if you're running a LAMP server you'd have apache listening on all IP addresses (so that your users can access it) while a mysql database could be configured to be accessible only from localhost (using it's bind=127.0.0.1 directive). This way php running on the same server will be able to access the database while external (and untrusted) users will not be able to access it.

share|improve this answer

As you told, the IP of localhost only accept connections to those ports locally while the IP 0.0.0.0 refers to ports that are open to all.

For example

Local

127.0.0.1:8307 VMWARE
127.0.0.1:25   MASTER

To all

0.0.0.0:80    HTTP
0.0.0.0:443   SKYPE
share|improve this answer

The "local address" is the address to which the socket in question is bound. This is the address which it receives connections on. The addresses you're asking about are "special addresses". According to the manual page for the Linux IPv4 protocol:

There are several special addresses: INADDR_LOOPBACK (127.0.0.1) always refers to the local host via the loopback device; INADDR_ANY (0.0.0.0) means any address for binding; INADDR_BROADCAST (255.255.255.255) means any host and has the same effect on bind as INADDR_ANY for historical reasons.

What this means for the address 0.0.0.0 is that the socket can receive connections for any address on the system, on any interface.

share|improve this answer

127.0.0.1 and 0.0.0.0

127.0.0.1 means local interface or loopback address. Only accessible from your localhost.

0.0.0.0 is a wildcard address for every interface.

On netstat -ntlp Local Address means "Print active listening tcp connections, show IPs as numeric values and show the PID and name of the program that uses this connection."


Difference by example

E.g. if I have

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name                 
tcp        0      0 127.0.1.1:53            0.0.0.0:*               LISTEN      1189/prog1
tcp        0      0 0.0.0.0:6666            0.0.0.0:*               LISTEN      1188/prog2

that means:

The service prog1 with PID 1189 listens on port 53 with protocol tcp. It is only accessible from your localhost.

The service prog2 with PID 1189 listens on port 6666 with protocol tcp. Access to this port is allowed from any other computer on all networks the computer is part of.

Sources: 1 2 3

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.