When I do netstat -ntlp there is a column called Local Address:

  • sometimes it would output IP address as
  • and sometimes

What's the implications of both notations?

Does specific IP address act like a filter for incoming connections? E.g. for it will only accept connections from localhost on port 9001?

5 Answers 5


I think you've answered your own question.

As an example, apache has it's Listen option which tells it which address and port to listen on. Depending on how this is set, apache will listen on any IP address, a specific address:-

Listen *:80

The above options show up as:-


and translate to:-

  • Listen on any IP address (IPv4 or IPv6)
  • Listen on any IPv4 address on that server
  • Listen on IPv4 localhost only
  • Listen on external IPv4 address

You could configure your service to listen on only the localhost interface if you don't want anyone external to access it. For example, if you're running a LAMP server you'd have apache listening on all IP addresses (so that your users can access it) while a mysql database could be configured to be accessible only from localhost (using it's bind= directive). This way php running on the same server will be able to access the database while external (and untrusted) users will not be able to access it.

16 and means local interface or loopback address. Only accessible from your localhost. is a wildcard address for every interface.

On netstat -ntlp Local Address means "Print active listening tcp connections, show IPs as numeric values and show the PID and name of the program that uses this connection."

Difference by example

E.g. if I have

Proto Recv-Q Send-Q Local Address           Foreign Address         State       PID/Program name                 
tcp        0      0  *               LISTEN      1189/prog1
tcp        0      0  *               LISTEN      1188/prog2

that means:

The service prog1 with PID 1189 listens on port 53 with protocol tcp. It is only accessible from your localhost.

The service prog2 with PID 1189 listens on port 6666 with protocol tcp. Access to this port is allowed from any other computer on all networks the computer is part of.

Sources: 1 2 3

3 means the process is bound to all interfaces. means the process is bound only to the interface (loopback).

If you had other interfaces you might have x.y.z.a entries indicating the process was bound to those specific interfaces.

A process will only be told if traffic arrives on the interfaces to which it is bound, so yes, it's kind of a filter, although it's not usually described in those terms.


The "local address" is the address to which the socket in question is bound. This is the address which it receives connections on. The addresses you're asking about are "special addresses". According to the manual page for the Linux IPv4 protocol:

There are several special addresses: INADDR_LOOPBACK ( always refers to the local host via the loopback device; INADDR_ANY ( means any address for binding; INADDR_BROADCAST ( means any host and has the same effect on bind as INADDR_ANY for historical reasons.

What this means for the address is that the socket can receive connections for any address on the system, on any interface.


As you told, the IP of localhost only accept connections to those ports locally while the IP refers to ports that are open to all.

For example


To all    HTTP   SKYPE

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .