Netstat – Difference Between 0.0.0.0 and 127.0.0.1

netstatnetworkingports

When running netstat -a on my local machine, i see ports on the 0.0.0.0 address listening. I would assume that 0.0.0.0 is my local machine, except that i also see 127.0.0.1 listening to specific ports.

What is the 0.0.0.0 address? What is the difference between 0.0.0.0 and 127.0.0.1?

Below is an example of the output:

Proto  Local Address          Foreign Address        State
TCP    0.0.0.0:445            MyComputer1:0          LISTENING
TCP    0.0.0.0:49156          MyComputer1:0          LISTENING
TCP    0.0.0.0:49157          MyComputer1:0          LISTENING
TCP    127.0.0.1:6999         MyComputer1:0          LISTENING
TCP    127.0.0.1:6999         MyComputer1:49801      ESTABLISHED
TCP    127.0.0.1:6999         MyComputer1:57172      TIME_WAIT

Best Answer

Listening on 0.0.0.0 means that the program is listening on all IPv4 addresses assigned to the machine, whereas 127.0.0.1 is the loopback address, only accessible from the same machine.

Related Solutions

Networking – Meaning of Port 0 in Netstat Output

If you see this as the "Foreign" address, the meaning is slightly different – it's not about the interface; that would be the "Local" address.

All zeros in the "Foreign" column just mean that there is no remote address yet. The line represents a listening socket, which will accept connections from any address, any port. Those connections would be displayed as separate lines.

(From what I remember, in some early systems it used to be possible to create TCP sockets that would only accept connections from a specific host, a specific port, or both.)

Powershell one-liner to show process on same line as port using netstat issue

$p could be something like TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4 and $nar[-1] is string 4 so -replace operator takes all 4s:

TCP 0.0.0.0:445 0.0.0.0:0 LISTENING 4
            ↑↑                      ↑

Force replacing only last occurrence of $nar[-1] using end of line anchor (escaped $):

$p -replace "$($nar[-1])`$","$ppath $pname"

Read as well Matt's answer to Replacing last occurrence of substring in string at stackoverflow.

BTW:

$ppath is not defined…
…and netstat -ano should suffice (note that -b option can be time-consuming and will fail unless you have sufficient permissions).

Best Answer

Related Solutions

Networking – Meaning of Port 0 in Netstat Output

Powershell one-liner to show process on same line as port using netstat issue

Related Question