0

My cmd screen

How can I see all ports and their status on my pc using netsat? (All 2^16 ports) And how can I list apps that have an open port in transport layer of my computer with application name and it's port? For the second question I got this but not sure if it's true? Because I expect all IP addresses be 0.0.0.0 because my pc only cares about its ports and I don't understand what are other IPs. Thanks.

Gerald Schneider
  • 23,274
  • 8
  • 57
  • 89
m0ss
  • 105
  • 2

2 Answers2

1

For your first question:

To list the names of the executables, which were opening these connections just add the parameter "-b" like this: netstat -a -b There is also a parameter "-o", which shows yout the pid of the process associated with the network connection.

For your second question:

0.0.0.0 means all ip addresses on the local machine. Your netstat is showing this ip address, because you have services that are listening on all ipaddresses/network interfaces of your computer. However, there is also local the address 23.20.0.70, which is the source address your computer is using when communicating with peers itself. Since your computer establishes the connections with a specific source address, 0.0.0.0 wouldn't make any sense in this context as a source address.

Lorem ipsum
  • 892
  • 5
  • 15
  • Thanks. I don't understand what is 0.0.0.0. I mean I know I have a local machine which has a network card. But how is that possible that one IP address 0.0.0.0 means all other IP addresses on my local machine, while my local machine is supposed to have only one IP address. And if I'm not wrong, by 23.20.0.70 means my current global IP address when I'm communicating with the outside world? And one more question. What's the difference between 0.0.0.0 and 127.0.0.1. I have been told that the 127.0.0.1 is the local host. Thanks. – m0ss Sep 07 '20 at 14:54
  • just lookup this article: https://www.howtogeek.com/225487/what-is-the-difference-between-127.0.0.1-and-0.0.0.0/#:~:text=0.0%3F-,127.0.,particular%20address'%20place%20holder). You are right, with what you said about 23.20.0.70. Did "netstat -a -b" work for you?. Btw: It's not true, that your machine is supposed to have only one ip address. It can have multiple ip addresses. So take a webserver for example with multiple ip addresses. 0.0.0.0 In this case means he is listening on every ip address for incoming requests. But i don't know if your question fits serverfault, because it's educational – Lorem ipsum Sep 07 '20 at 15:28
  • Yes the netstat -a -b worked. Thanks. I also read the article and got somewhat illustrated. About my question, I first posted it on stackoverflow but someone just suggested to move it here and I did. Thank you. – m0ss Sep 07 '20 at 17:09
  • Oh by the way, is there any command netstat that lets me to see which applications (application names) are already using any port on my pc? I use netstat -a but not quite sure if it's true because for example I was using google chrome but there was no application named chrome or browser with that command. – m0ss Sep 08 '20 at 12:35
-1

You might have heard that everything in Linux is a file (of sorts). Network ports are the same. Most of the programs like netstat or ss go through respective directory under /proc to find ports that are being used by at least one process and get their state and info, so they don't provide info on unused ports.

This for example, will give you list of all ports that are being listened to by a local process:

netstat -lntp

more info about params in https://linux.die.net/man/8/netstat

Ali Sattari
  • 189
  • 4