Yrurtj

$ sudo netstat -ap | grep postg

tcp        0      0 localhost:postgresql    0.0.0.0:*               LISTEN      1567/postgres       

udp        0      0 localhost:57504         localhost:57504         ESTABLISHED 1567/postgres       

unix  2      [ ACC ]     STREAM     LISTENING     27116    1567/postgres        /var/run/postgresql/.s.PGSQL.5432



$ sudo netstat -ap | grep mysql

tcp6       0      0 [::]:mysql              [::]:*                  LISTEN      23683/mysqld        

tcp6       0      0 [::]:33060              [::]:*                  LISTEN      23683/mysqld        

unix  2      [ ACC ]     STREAM     LISTENING     1169294  23683/mysqld         /var/run/mysqld/mysqld.sock

unix  2      [ ACC ]     STREAM     LISTENING     1169513  23683/mysqld         /var/run/mysqld/mysqlx.sock

unix  2      [ ]         DGRAM                    1169211  23683/mysqld  

What do 0.0.0.0:*, [::]:mysql, and [::]:* mean?

Does * mean all ports?

0.0.0.0 means ‘‘this network’’ or ‘‘this host’', according to Tanenbaum's Computer Network. When is it used for this network, and when is it for this host?

Thanks.

0.0.0.0:* typically appears at the remote side of listening sockets, and indicates that remote address and port fields have not been filled in yet... which is logical for a socket that is listening for incoming connections. It has one meaning though: it indicates that this socket will only accept IPv4 connections.

[::]:mysql appears at the local side of connections, and indicates that the socket is accepting incoming IPv6 connections (and possibly also IPv4) in any addresses this system may have, and the port number has been given the name mysql in /etc/services... i.e. the port number is 3306. Note that the left-most column also has tcp6 instead of just tcp to indicate that the program is using the IPv6-capable sockets.

[::]:* is the IPv6-capable equivalent of 0.0.0.0:*, i.e. it typically appears at the remote side of listening sockets, and indicates that the socket is dealing with IPv6 connections but the remote endpoint address & port information has not been filled in yet. However, this may include IPv4 too.

The entire IPv4 address space can be mapped as a subset of IPv6 address space: for example, an IPv4 address 1.2.3.4 can be mapped by the kernel into IPv6 address ::ffff:102:304 if the application uses IPv6 sockets API. That's why an IPv6-capable program has the option of just using IPv6-style address structures internally in everything at the TCP/UDP level, and having no need to treat IPv4 as a separate group unless specifically desired. (I think there are socket options or some other mechanism that a program can use to opt in/out of this mapping: some programs do open separate listening sockets for IPv4 and IPv6.)

However, many IPv6-capable utilities will show such IPv6-mapped IPv4 addresses in a more user-friendly form of ::ffff:1.2.3.4 to make the embedded IPv4 address easier to read.