[GLLUG] Can anyone explain this netstat output?

[Chris Bell]

On Sunday, 30 June 2019 12:47:35 BST Henrik Morsing via GLLUG wrote:
> Hi,
> 
> netstat has been broken for years. Mine does what you are showing as well,
> and has for several iterations of Debian.
> 
> I once mentioned it in a Linux friendly place (here?) but just got a
> sarcastic comment.
> 
> Someone should really log a bug report I suppose :-)
> 
> Thanks
> Henrik
> 
> > On 30 Jun 2019, at 11:50, John Winters via GLLUG
> > <gllug at mailman.lug.org.uk> wrote:
> > 
> > I've just been experimenting with Syncthing on a Raspberry Pi 4.  As it's
> > headless, I had change it to listen on 0.0.0.0:8384 instead of
> > 127.0.0.1:8384.
> > 
> > When I checked the result with netstat I got the following:
> > 
> > john at pi4:~ $ netstat -l
> > Active Internet connections (only servers)
> > Proto Recv-Q Send-Q Local Address           Foreign Address State
> > tcp        0      0 0.0.0.0:ssh             0.0.0.0:* LISTEN
> > tcp6       0      0 [::]:22000              [::]:* LISTEN
> > tcp6       0      0 [::]:ssh                [::]:* LISTEN
> > tcp6       0      0 [::]:8384               [::]:*                  LISTEN
> > ...
> > 
> > I've cut out everything after the tcp stuff.
> > 
> > Oh drat I thought, why's it only listening for IPv6 connections?  Then I
> > discovered it wasn't.  I can still connect using IPv4, even though there
> > is no apparent listen.
> > 
> > After a bit of use, I can see this:
> > 
> > john at pi4:~ $ netstat -an | grep 8384
> > tcp6       0      0 :::8384                 :::* LISTEN
> > tcp6       0      0 10.3.1.40:8384          10.3.0.80:51806 ESTABLISHED
> > tcp6       0      0 10.3.1.40:8384          10.3.0.80:51814 ESTABLISHED
> > tcp6       0      0 10.3.1.40:8384          10.3.0.80:51864 ESTABLISHED
> > tcp6       0      0 10.3.1.40:8384          10.3.0.80:51810 ESTABLISHED
> > tcp6       0      0 10.3.1.40:8384          10.3.0.80:51804 ESTABLISHED
> > tcp6       0      0 10.3.1.40:8384          10.3.0.80:51812 ESTABLISHED
> > tcp6       0      0 10.3.1.40:8384          10.3.0.80:51808 TIME_WAIT
> > john at pi4:~ $
> > 
> > A TCP connection over IPv6 from 10.3.0.80 to 10.3.1.40?  WTF?
> > 
> > Is this an error in netstat, or something odd about the way Syncthing does
> > its listens?
> > 
> > Note the entries for sshd show two listens - one for IPv4 and one for IPv6
> > which is more what I would expect.
> > 
> > Cheers,
> > John
Unless you specify an IPv4 address as /24 the system does sometimes assume /16

-- 
Chris Bell
Website http://chrisbell.org.uk