From: Lee Dilkie (lee_dilkiemitel.com)
Date: Mon Jul 18 2005 - 09:08:18 CDT

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

How about a *much* simpler explanation...

a LISTENING socket has no "foreign address". It's not connected so how
could it? That column is meaningless for sockets not in a CONNECTED state.

-lee

Ron wrote:

>-----BEGIN PGP SIGNED MESSAGE-----
>Hash: SHA1
>
>Looks to me like it's not set. Because there's no active connection,
>there's no foreign address.
>
>A socket that's listening won't have a foreign address set, and a socket
>that's connected will.
>
>I noticed on Linux, it looks like this:
>iagodarkside:~$ netstat -a | grep LISTEN
>tcp 0 0 *:8001 *:* LISTEN
>tcp 0 0 *:3306 *:* LISTEN
>tcp 0 0 *:http *:* LISTEN
>tcp 0 0 *:ssh *:* LISTEN
>tcp 0 0 *:https *:* LISTEN
>
>Probably 0.0.0.0:0 is just Windows's way of saying "not set"?
>
>omibabagmail.com wrote:
>
>
>>Active Connections
>>
>> Proto Local Address Foreign Address State
>> TCP 0.0.0.0:135 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:445 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1025 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1028 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1054 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1307 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1344 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1445 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1447 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1452 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1453 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1455 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1460 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1465 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1466 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1469 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1491 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1496 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1498 0.0.0.0:0 LISTENING
>> TCP 0.0.0.0:1507 0.0.0.0:0 LISTENING
>>
>>Above is the output of netstat -an |more
>>
>>Guys / Gals Do you know what means port zero in Windoze Platform ? I know the answer but jst wanted to know anyone has a better explaination.
>>
>>In Unix Family port zero is used for socket programming but not the same in Windoze family.
>>
>>I have asked this question in many programs of mine in CEH - Certfied Ethical Hacking but still awaiting for answers. Lemme see if can get some answers for this post!!!!
>>
>>Ciao
>>
>>Baba
>>CEO
>>Appsec
>>
>>
>>
>>
>-----BEGIN PGP SIGNATURE-----
>Version: GnuPG v1.9.15 (GNU/Linux)
>Comment: Using GnuPG with Thunderbird - http://enigmail.mozdev.org
>
>iD8DBQFC2p3XfqSf2EkP4p4RAky6AJ4uVgpt37oxTENJ3wjd9luWH8Jb/wCeOqO5
>Sy6WrEhqEVR5SuOAQiQDgOM=
>=5KEZ
>-----END PGP SIGNATURE-----
>
>

• application/x-pkcs7-signature attachment: S/MIME Cryptographic Signature

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]