Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

How do I interpret 'netstat -a' output

Some things look strange to me:

  • What is the distinction between 0.0.0.0, 127.0.0.1, and [::]?
  • How should each part of the foreign address be read (part1:part2)?
  • What does a state Time_Wait, Close_Wait mean?
  • etc.

Could someone give a quick overview of how to interpret these results?

like image 655
Dane O'Connor Avatar asked Aug 21 '08 19:08

Dane O'Connor


People also ask

What output does netstat show?

The netstat command generates displays that show network status and protocol statistics. You can display the status of TCP and UDP endpoints in table format, routing table information, and interface information.

How do you explain netstat?

The network statistics ( netstat ) command is a networking tool used for troubleshooting and configuration, that can also serve as a monitoring tool for connections over the network. Both incoming and outgoing connections, routing tables, port listening, and usage statistics are common uses for this command.

What does *:* mean in netstat output?

The second *, in *:* , means connections can come from any IP address. The third *, in *:* , means the connection can originate from any port on the remote machine.


1 Answers

0.0.0.0 usually refers to stuff listening on all interfaces. 127.0.0.1 = localhost (only your local interface) I'm not sure about [::]

TIME_WAIT means both sides have agreed to close and TCP must now wait a prescribed time before taking the connection down.

CLOSE_WAIT means the remote system has finished sending and your system has yet to say it's finished.

like image 76
ScArcher2 Avatar answered Sep 21 '22 14:09

ScArcher2