Here's the output of netsat -tupn
on my Debian Jessie server:
Active Internet connections (w/o servers)
Proto Recv-Q Send-Q Local Address Foreign Address State PID/Program name
tcp 0 0 10.0.0.12:445 10.0.0.20:49729 ESTABLISHED 26277/smbd
tcp 0 0 10.0.0.12:443 10.0.0.21:44162 ESTABLISHED 1400/nginx: worker
tcp 0 0 10.0.0.12:445 10.0.0.21:46650 ESTABLISHED 23039/smbd
tcp 0 0 10.0.0.12:443 10.0.0.20:54584 ESTABLISHED 1400/nginx: worker
tcp 0 0 10.0.0.12:139 10.0.0.225:10425 ESTABLISHED 23701/smbd
tcp 0 0 10.0.0.12:445 10.0.0.217:49179 ESTABLISHED 21535/smbd
tcp 0 0 10.0.0.12:445 10.0.0.217:49178 ESTABLISHED 21534/smbd
tcp 0 0 10.0.0.12:445 10.0.0.20:64636 ESTABLISHED 21470/smbd
tcp 0 0 10.0.0.12:443 10.0.0.21:44198 ESTABLISHED 1400/nginx: worker
tcp 0 0 10.0.0.12:2049 10.0.0.16:752 ESTABLISHED -
tcp 0 0 10.0.0.12:222 10.0.0.21:55514 ESTABLISHED 23111/sshd: redacted
tcp6 0 0 10.0.0.12:4243 10.0.0.20:64702 ESTABLISHED 31307/java
tcp6 0 0 10.0.0.12:48932 162.222.40.93:443 ESTABLISHED 31307/java
tcp6 0 0 10.0.0.12:49093 216.17.8.47:443 ESTABLISHED 31307/java
PID 31307 is the CrashPlan backup engine, Java version 1.7.0_45
. The two non-RFC1918 IPv4 addresses are CrashPlan's servers and 10.0.0.20:64702
is my computer running the client.
Why do the last three connections show as tcp6 even though they're IPv4 addresses?
Best Answer
This is happening because by default, AF_INET6 sockets will actually work for both IPv4 and IPv6. See section 3.7 - Compatibility with IPv4 Nodes of RFC 3493 - Basic Socket Interface Extensions for IPv6
Here is a short example of code that can produce this sort of situation:
The output on my Ubuntu machine is:
tcp6 LISTEN
entry is for the socket listening on port 5555. Note that it is an AF_INET6 socket, so it will accept both IPv4 and IPv6 incoming connections.tcp ESTABLISHED
entry is the result of connecting an AF_INET4 socket to the listener (active connection).tcp6 ESTABLISHED
entry is for the passive connection spawned from the listener socket. It shows up astcp6
, since it is spawned from atcp6
listener; however it represents a connection from an IPv4.Its worth noting the following: