[GLLUG] Can anyone explain this netstat output?

[Henrik Morsing]

Hi,

netstat has been broken for years. Mine does what you are showing as well, and has for several iterations of Debian.

I once mentioned it in a Linux friendly place (here?) but just got a sarcastic comment.

Someone should really log a bug report I suppose :-)

Thanks
Henrik


> On 30 Jun 2019, at 11:50, John Winters via GLLUG <gllug at mailman.lug.org.uk> wrote:
> 
> I've just been experimenting with Syncthing on a Raspberry Pi 4.  As it's headless, I had change it to listen on 0.0.0.0:8384 instead of 127.0.0.1:8384.
> 
> When I checked the result with netstat I got the following:
> 
> john at pi4:~ $ netstat -l
> Active Internet connections (only servers)
> Proto Recv-Q Send-Q Local Address           Foreign Address State
> tcp        0      0 0.0.0.0:ssh             0.0.0.0:* LISTEN
> tcp6       0      0 [::]:22000              [::]:* LISTEN
> tcp6       0      0 [::]:ssh                [::]:* LISTEN
> tcp6       0      0 [::]:8384               [::]:*                  LISTEN
> ...
> 
> I've cut out everything after the tcp stuff.
> 
> Oh drat I thought, why's it only listening for IPv6 connections?  Then I discovered it wasn't.  I can still connect using IPv4, even though there is no apparent listen.
> 
> After a bit of use, I can see this:
> 
> john at pi4:~ $ netstat -an | grep 8384
> tcp6       0      0 :::8384                 :::* LISTEN
> tcp6       0      0 10.3.1.40:8384          10.3.0.80:51806 ESTABLISHED
> tcp6       0      0 10.3.1.40:8384          10.3.0.80:51814 ESTABLISHED
> tcp6       0      0 10.3.1.40:8384          10.3.0.80:51864 ESTABLISHED
> tcp6       0      0 10.3.1.40:8384          10.3.0.80:51810 ESTABLISHED
> tcp6       0      0 10.3.1.40:8384          10.3.0.80:51804 ESTABLISHED
> tcp6       0      0 10.3.1.40:8384          10.3.0.80:51812 ESTABLISHED
> tcp6       0      0 10.3.1.40:8384          10.3.0.80:51808 TIME_WAIT
> john at pi4:~ $
> 
> A TCP connection over IPv6 from 10.3.0.80 to 10.3.1.40?  WTF?
> 
> Is this an error in netstat, or something odd about the way Syncthing does its listens?
> 
> Note the entries for sshd show two listens - one for IPv4 and one for IPv6 which is more what I would expect.
> 
> Cheers,
> John
> 
> -- 
> Xronos Scheduler - https://xronos.uk/
> All your school's schedule information in one place.
> Timetable, activities, homework, public events - the lot
> Live demo at https://schedulerdemo.xronos.uk/
> 
> -- 
> GLLUG mailing list
> GLLUG at mailman.lug.org.uk
> https://mailman.lug.org.uk/mailman/listinfo/gllug