Netstat question: Identifying local host

[David A. Bandel]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

On Sun, 21 Mar 2004 17:53:29 -0500
Joel Hammer <joel at hammershome.com> wrote:

> Abbreviated output from netstat -an looks like this:
> 
> tcp        0      0 0.0.0.0:515             0.0.0.0:*              
> LISTEN tcp        0      0 192.168.1.11:53         0.0.0.0:*          
>     LISTEN
> tcp        0      0 127.0.0.1:53            0.0.0.0:*              
> LISTEN udp        0      0 0.0.0.0:111             0.0.0.0:*
> udp        0      0 192.168.1.11:123        0.0.0.0:*
> udp        0      0 127.0.0.1:123           0.0.0.0:*
> 
> My question is, why is the local host sometimes identified
> as 0.0.0.0, othertimes as 192.168.1.11 (its ip address),
> and other times as 127.0.0.1?

First, 0.0.0.0 isn't localhost.  This is shorthand for all IPs.  If you
have six interfaces on your system, it means it doesn't care which one,
all of them are bound by this port.

As for the different "localhost" IPs, only 127.0.0.1 is localhost.  The
others are other interfaces your system has.  Each interface (and
127.0.0.1 is an interface, the lo interface), can be bound or not by a
service daemon.  Sometimes you want a port to listen only to localhost,
sometimes not.  Here you see what is bound and what is not.

Some daemons, particularly those that can't be configured otherwise,
report 0.0.0.0:port.  Many of those that have options on which IPs (or
interfaces) you can bind show each IP they are binding individually. 
That's all.  Nothing to worry about.

Ciao,

David A. Bandel
- -- 
Focus on the dream, not the competition.
		Nemesis Racing Team motto
GPG key autoresponder:  mailto:david_key at pananix.com
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFAXsOAj31PLQNUbV4RAsEDAJ4jsnwGfTZfZHNbY5hGx3+G/gPxtACfUx4E
NLOXanv8KFPHW160fpoJsVs=
=Je3c
-----END PGP SIGNATURE-----