Difference between :: and ::1

Question

I am confused about following netstat output. There are two kind of local ports. The first is:

[::]8100

The second is:

[::1]8100

I know that [::1] is a loopback address for IPv6. My question is:

What does [::] mean?

Thank you in advance for your help.

Answer 1

:: is the unspecified address (0:0:0:0:0:0:0:0), and it is only used in packets as the source address of a host that does not yet have an address and is trying to get an address assigned. What you see in the output means that a process is binding to port 8100 for all destination addresses in the host.

::1 is the loopback address (0:0:0:0:0:0:0:1), and anything sent to that address will loop back inside the host. What you see means a process is binding to port 8100 on the loopback address, and that means anything sent to the loopback address on that port will go the that process.

Neither address can be seen as a destination address on a network outside of the host, and the unspecified address can only be used as a source address for a host that has not yet been assigned an address but is looking for an address. The loopback address should never be used as a source address on a network outside of the host.

RFC 4219, IP Version 6 Addressing Architecture explains how the two addresses are compressed in section 2.2. Text Representation of Addresses:

2. Due to some methods of allocating certain styles of IPv6 addresses, it will be common for addresses to contain long strings of zero bits. In order to make writing addresses containing zero bits easier, a special syntax is available to compress the zeros. The use of "::" indicates one or more groups of 16 bits of zeros. The "::" can only appear once in an address. The "::" can also be used to compress leading or trailing zeros in an address.

   For example, the following addresses

        2001:DB8:0:0:8:800:200C:417A   a unicast address
        FF01:0:0:0:0:0:0:101           a multicast address
        0:0:0:0:0:0:0:1                the loopback address
        0:0:0:0:0:0:0:0                the unspecified address
   

   may be represented as

        2001:DB8::8:800:200C:417A      a unicast address
        FF01::101                      a multicast address
        ::1                            the loopback address
        ::                             the unspecified address
   

It further goes on to explain both the unspecified and loopback addresses:

2.5.2. The Unspecified Address

The address 0:0:0:0:0:0:0:0 is called the unspecified address. It must never be assigned to any node. It indicates the absence of an address. One example of its use is in the Source Address field of any IPv6 packets sent by an initializing host before it has learned its own address.

The unspecified address must not be used as the destination address of IPv6 packets or in IPv6 Routing headers. An IPv6 packet with a source address of unspecified must never be forwarded by an IPv6 router.

2.5.3. The Loopback Address

The unicast address 0:0:0:0:0:0:0:1 is called the loopback address. It may be used by a node to send an IPv6 packet to itself. It must not be assigned to any physical interface. It is treated as having Link-Local scope, and may be thought of as the Link-Local unicast address of a virtual interface (typically called the "loopback interface") to an imaginary link that goes nowhere.

The loopback address must not be used as the source address in IPv6 packets that are sent outside of a single node. An IPv6 packet with a destination address of loopback must never be sent outside of a single node and must never be forwarded by an IPv6 router. A packet received on an interface with a destination address of loopback must be dropped.

Answer 2

"::" is the ipv6 "unspecified address" (the equivilent IPv4 address is "0.0.0.0"). When binding a socket* it is used to indicate that the socket will listen on all local IPv6 addresses. Depending on the operating system and the socket options the socket may also listen on local IPv4 addresses.

"::1" is the ipv6 "loopback address" (the equivilent IPv4 address is "127.0.0.1"). Used for local communication within a host only.

So when you see "::" in the "local address" column of the netstat output it means the socket* is listening on all IPv6 interfaces the system has, and possibly also all local IPv4 interfaces the system has. When you see "::1" it means it is only listening on local loopback and thus can only be accessed from the local system.

Neither of these addresses should appear as source or destination addresses for normal traffic. "::1" is specifically forbidden from appearing as either a source or destination. "::" is forbidden from appearing as a destination. It can appear as a source as part of an address assignment protocol. Specifically it is used in the "duplicate address detection" process.

* in the Berkeley sockets sense of the term.

Answer 3

With IPv6, :: expands to the required amount of :0: words (short for :0000:) to fill up the 128-bit address. :: can only be used once in an address and needs to be unambiguous.

With netstat, the trailing :abcd refers to the transport-layer port number, so tcp6 ::1:80 means TCP port 80 on the ::1 loopback. tcp6 :::80 is a universal binding, the unspecified address, to all local IP addresses.

Answer 4

[::] is the Unspecified Address. Programs can bind to this address if they do not want to bind to a specific address but ANY address.

Here is the declaration in netinet/in.h

extern const struct in6_addr in6addr_any;        /* :: */ 

If you are interested you can create small test program using C sockets API. Alternate between binding to in6addr_any and [::1] or any other specified address. You will be able to replicate what you observed.