[GLLUG] Can anyone explain this netstat output?

[John Winters]

I've just been experimenting with Syncthing on a Raspberry Pi 4.  As 
it's headless, I had change it to listen on 0.0.0.0:8384 instead of 
127.0.0.1:8384.

When I checked the result with netstat I got the following:

john at pi4:~ $ netstat -l
Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address 
State
tcp        0      0 0.0.0.0:ssh             0.0.0.0:* 
LISTEN
tcp6       0      0 [::]:22000              [::]:* 
LISTEN
tcp6       0      0 [::]:ssh                [::]:* 
LISTEN
tcp6       0      0 [::]:8384               [::]:*                  LISTEN
...

I've cut out everything after the tcp stuff.

Oh drat I thought, why's it only listening for IPv6 connections?  Then I 
discovered it wasn't.  I can still connect using IPv4, even though there 
is no apparent listen.

After a bit of use, I can see this:

john at pi4:~ $ netstat -an | grep 8384
tcp6       0      0 :::8384                 :::* 
LISTEN
tcp6       0      0 10.3.1.40:8384          10.3.0.80:51806 
ESTABLISHED
tcp6       0      0 10.3.1.40:8384          10.3.0.80:51814 
ESTABLISHED
tcp6       0      0 10.3.1.40:8384          10.3.0.80:51864 
ESTABLISHED
tcp6       0      0 10.3.1.40:8384          10.3.0.80:51810 
ESTABLISHED
tcp6       0      0 10.3.1.40:8384          10.3.0.80:51804 
ESTABLISHED
tcp6       0      0 10.3.1.40:8384          10.3.0.80:51812 
ESTABLISHED
tcp6       0      0 10.3.1.40:8384          10.3.0.80:51808 
TIME_WAIT
john at pi4:~ $

A TCP connection over IPv6 from 10.3.0.80 to 10.3.1.40?  WTF?

Is this an error in netstat, or something odd about the way Syncthing 
does its listens?

Note the entries for sshd show two listens - one for IPv4 and one for 
IPv6 which is more what I would expect.

Cheers,
John

-- 
Xronos Scheduler - https://xronos.uk/
All your school's schedule information in one place.
Timetable, activities, homework, public events - the lot
Live demo at https://schedulerdemo.xronos.uk/