Welcome to HBH! If you have tried to register and didn't get a verification email, please using the following link to resend the verification email.

Need help understanding netstat please


ghost's Avatar
0 0

When you enter "netstat -an | less" in a linux terminal it shows the addresses and ports you are connected to on a remote server on the right side with well known ports delimited by : . And on the left it shows local connections, 0.0.0.0, 127.0.0.1 and 192.168.1.32 and the ports are anything over 1024. a few things that I do not get: Where is the address 0.0.0.0 coming from? and the sourced or initialized connections shown on the left side are those ports where I am receiving the traffic from a web server through? I thought I get http traffic through port 80, or is that just the server that allows connections on port 80?

wtf are those ports on the local addresses? is that just what port my computer is using to initialize a connection?


Infam0us's Avatar
Member
0 0

I believe the 0.0.0.0 is any address that your system is listening to. and the ports 1024 or higher on your local address are the the ports your computer used to start the connection with the remote computer..


ghost's Avatar
0 0

The only time you'll be receiving traffic on port 80 is if you're a web server. If you're communicating with a web server, you'll be sending your transmission over a random port over 1024 to a destination that will accept it on port 80.

I'm not entirely certain about 0.0.0.0, but I figure it goes something like this:

  1. Connections to 192.168.1.32 are from another system to yours
  2. Connections from 127.0.0.1 are from your system to itself
  3. Connections from 0.0.0.0 are normal network broadcasts

ghost's Avatar
0 0

thanks guys I understand now ;)