Search code examples
networkingnetstat

How do I interpret 'netstat -a' output

Some things look strange to me:

  • What is the distinction between 0.0.0.0, 127.0.0.1, and [::]?
  • How should each part of the foreign address be read (part1:part2)?
  • What does a state Time_Wait, Close_Wait mean?
  • etc.

Could someone give a quick overview of how to interpret these results?

Solution

  • 0.0.0.0 usually refers to stuff listening on all interfaces. 127.0.0.1 = localhost (only your local interface) I'm not sure about [::]

    TIME_WAIT means both sides have agreed to close and TCP must now wait a prescribed time before taking the connection down.

    CLOSE_WAIT means the remote system has finished sending and your system has yet to say it's finished.