<p>Some things look strange to me:</p>

<ul>
<li>What is the distinction between 0.0.0.0, 127.0.0.1, and [::]?</li>
<li>How should each part of the foreign address be read (part1:part2)?</li>
<li>What does a state Time_Wait, Close_Wait mean?</li>
<li>etc.</li>
</ul>

<p>Could someone give a quick overview of how to interpret these results?</p>

[{'answer_id': 20894, 'author': 'ScArcher2', 'author_id': 1310, 'author_profile': 'https://Stackoverflow.com/users/1310', 'pm_score': 5, 'selected': True, 'text': "<p>0.0.0.0 usually refers to stuff listening on all interfaces.\n127.0.0.1 = localhost (only your local interface)\nI'm not sure about [::]</p>\n\n<p>TIME_WAIT means both sides have agreed to close and TCP\nmust now wait a prescribed time before taking the connection\ndown.</p>\n\n<p>CLOSE_WAIT means the remote system has finished sending\nand your system has yet to say it's finished. </p>\n"}, {'answer_id': 20947, 'author': 'Kev', 'author_id': 419, 'author_profile': 'https://Stackoverflow.com/users/419', 'pm_score': 3, 'selected': False, 'text': '<p>127.0.0.1 is your loopback address also known as \'localhost\' if set in your HOSTS file. See here for more info: <a href="http://en.wikipedia.org/wiki/Localhost" rel="noreferrer">http://en.wikipedia.org/wiki/Localhost</a></p>\n\n<p>0.0.0.0 means that an app has bound to all ip addresses using a specific port. MS info here: <a href="http://support.microsoft.com/default.aspx?scid=kb;en-us;175952" rel="noreferrer">http://support.microsoft.com/default.aspx?scid=kb;en-us;175952</a></p>\n\n<p>\'::\' is ipv6 shorthand for ipv4 0.0.0.0.</p>\n'}, {'answer_id': 31645, 'author': 'Mark Borgerding', 'author_id': 3343, 'author_profile': 'https://Stackoverflow.com/users/3343', 'pm_score': 2, 'selected': False, 'text': '<p>Send-Q is the amount of data sent by the application, but not yet acknowledged by the other side of the socket.  </p>\n\n<p>Recv-Q is the amount of data received from the NIC, but not yet consumed by the application.</p>\n\n<p>Both of these queues reside in kernel memory.\nThere are <a href="http://www.speedguide.net/read_articles.php?id=121" rel="nofollow noreferrer">guides</a> to help you tweak these kernel buffers, if you are so inclined.  Although, you may find the default params do quite well.</p>\n'}, {'answer_id': 31658, 'author': 'garethm', 'author_id': 2219, 'author_profile': 'https://Stackoverflow.com/users/2219', 'pm_score': 3, 'selected': False, 'text': "<p>What is the distinction between 0.0.0.0, 127.0.0.1, and [::]?</p>\n\n<ul>\n    <li>0.0.0.0 indicates something that is listening on all interfaces on the machine.</li>\n    <li>127.0.0.1 indicates your own machine.</li>\n    <li>[::] is the IPv6 version of 0.0.0.0</li>\n    <li>My machine also shows *:\\* for UDP which shows that UDP connections don't really have a foreign address - they receive packets from any where. That is the nature of UDP.</li></ul>\n\n<p></li>\n <p>How should each part of the foreign address be read (part1:part2)?</p>\n     <li>part1 is the hostname or IP address</li><li>part2 is the port</li></p>\n"}, {'answer_id': 31700, 'author': 'jaredg', 'author_id': 153, 'author_profile': 'https://Stackoverflow.com/users/153', 'pm_score': 0, 'selected': False, 'text': "<p>For those seeing [::] in their netstat output, I'm betting your machine is running IPv6; that would be equivalent to 0.0.0.0, i.e. listen on any IPv6 address.  </p>\n"}, {'answer_id': 2247948, 'author': 'PlanetUnknown', 'author_id': 179521, 'author_profile': 'https://Stackoverflow.com/users/179521', 'pm_score': 2, 'selected': False, 'text': '<p><a href="http://support.microsoft.com/kb/137984" rel="nofollow noreferrer">This link has helped me a lot to interpret netstat -a</a></p>\n\n<p>A copy from there -</p>\n\n<p><code>TCP Connection States</code><br>\nFollowing is a brief explanation of this handshake. In this context the "client" is the peer requesting a connection and the "server" is the peer accepting a connection. Note that this notation does not reflect Client/Server relationships as an architectural principal. </p>\n\n<p><strong>Connection Establishment</strong>   </p>\n\n<p>The client sends a SYN message which contains the server\'s port and the client\'s Initial Sequence Number (ISN) to the server (active open).<br>\nThe server sends back its own SYN and ACK (which consists of the client\'s ISN + 1).<br>\nThe Client sends an ACK (which consists of the server\'s ISN + 1).    </p>\n\n<p><strong>Connection Tear-down (modified three way handshake).</strong>    </p>\n\n<p>The client sends a FIN (active close). This is a now a half-closed connection. The client no longer sends data, but is still able to receive data from the server. Upon receiving this FIN, the server enters a passive close state.<br>\nThe server sends an ACK (which is the clients FIN sequence + 1)<br>\nThe server sends its own FIN.<br>\nThe client sends an ACK (which is server\'s FIN sequence + 1). Upon receiving this ACK, the server closes the connection.<br>\nA half-closed connection can be used to terminate sending data while sill receiving data. Socket applications can call shutdown with the second argument set to 1 to enter this state.    </p>\n\n<p><strong>State explanations as shown in Netstat:</strong><br>\nState Explanation</p>\n\n<hr>\n\n<p><code>SYN_SEND</code> Indicates active open.</p>\n\n<p><code>SYN_RECEIVED</code> Server just received SYN from the client.</p>\n\n<p><code>ESTABLISHED</code> Client received server\'s SYN and session is established.</p>\n\n<p><code>LISTEN</code> Server is ready to accept connection.</p>\n\n<p>NOTE: See documentation for listen() socket call. TCP sockets in listening state are not shown - this is a limitation of NETSTAT. For additional information, please see the following article in the Microsoft Knowledge Base:\n134404\xa0 NETSTAT.EXE Does Not Show TCP Listen Sockets\nFIN_WAIT_1 Indicates active close.</p>\n\n<p><code>TIMED_WAIT</code> Client enters this state after active close.</p>\n\n<p><code>CLOSE_WAIT</code> Indicates passive close. Server just received first FIN from a client.</p>\n\n<p><code>FIN_WAIT_2</code> Client just received acknowledgment of its first FIN from the server.</p>\n\n<p><code>LAST_ACK</code> Server is in this state when it sends its own FIN.</p>\n\n<p><code>CLOSED</code> Server received ACK from client and connection is closed.</p>\n'}, {'answer_id': 14511485, 'author': 'Aravind Yarram', 'author_id': 127320, 'author_profile': 'https://Stackoverflow.com/users/127320', 'pm_score': 4, 'selected': False, 'text': "<p>I understand the answer has been accepted but here is some additional information:</p>\n\n<ul>\n<li>If it says <code>0.0.0.0</code> on the Local Address column, it means that port is listening on all 'network interfaces' (i.e. your computer, your modem(s) and your network card(s)).</li>\n<li>If it says <code>127.0.0.1</code> on the Local Address column, it means that port is ONLY listening for connections from your PC itself, not from the Internet or network. No danger there.</li>\n<li>If it displays your <code>online IP</code> on the Local Address column, it means that port is ONLY listening for connections from the Internet.</li>\n<li>If it displays your <code>local network IP</code> on the Local Address column, it means that port is ONLY listening for connections from the local network.</li>\n<li>Foreign Address - The IP address and port number of the remote computer to which the socket is connected. The names that corresponds to the IP address and the port are shown unless the -n parameter is specified. If the port is not yet established, the port number is shown as an asterisk (*). (from wikipedia)</li>\n</ul>\n"}]
['https://Stackoverflow.com/questions/20882', 'https://Stackoverflow.com', 'https://Stackoverflow.com/users/1946/']