I am confused about following netstat output. There are two kind of local ports. The first is:


The second is:


I know that [::1] is a loopback address for IPv6. My question is:

What does [::] mean?

Thank you in advance for your help.

  • 6
    Just a remark: You are missing an additional colon before the port number, i.e. [::]:8100, not [::]8100. I cannot change it since it's only two characters to insert. – Dubu Feb 5 '20 at 9:56
  • Did any answer help you? If so, you should accept the answer so that the question doesn't keep popping up forever, looking for an answer. Alternatively, you can post and accept your own answer. – Ron Maupin Dec 17 '20 at 15:12

:: is the unspecified address (0:0:0:0:0:0:0:0), and it is only used in packets as the source address of a host that does not yet have an address and is trying to get an address assigned. What you see in the output means that a process is binding to port 8100 for all destination addresses in the host.

::1 is the loopback address (0:0:0:0:0:0:0:1), and anything sent to that address will loop back inside the host. What you see means a process is binding to port 8100 on the loopback address, and that means anything sent to the loopback address on that port will go the that process.

Neither address can be seen as a destination address on a network outside of the host, and the unspecified address can only be used as a source address for a host that has not yet been assigned an address but is looking for an address. The loopback address should never be used as a source address on a network outside of the host.

RFC 4219, IP Version 6 Addressing Architecture explains how the two addresses are compressed in section 2.2. Text Representation of Addresses:

  1. Due to some methods of allocating certain styles of IPv6 addresses, it will be common for addresses to contain long strings of zero bits. In order to make writing addresses containing zero bits easier, a special syntax is available to compress the zeros. The use of "::" indicates one or more groups of 16 bits of zeros. The "::" can only appear once in an address. The "::" can also be used to compress leading or trailing zeros in an address.

    For example, the following addresses

         2001:DB8:0:0:8:800:200C:417A   a unicast address
         FF01:0:0:0:0:0:0:101           a multicast address
         0:0:0:0:0:0:0:1                the loopback address
         0:0:0:0:0:0:0:0                the unspecified address

    may be represented as

         2001:DB8::8:800:200C:417A      a unicast address
         FF01::101                      a multicast address
         ::1                            the loopback address
         ::                             the unspecified address

It further goes on to explain both the unspecified and loopback addresses:

2.5.2. The Unspecified Address

The address 0:0:0:0:0:0:0:0 is called the unspecified address. It must never be assigned to any node. It indicates the absence of an address. One example of its use is in the Source Address field of any IPv6 packets sent by an initializing host before it has learned its own address.

The unspecified address must not be used as the destination address of IPv6 packets or in IPv6 Routing headers. An IPv6 packet with a source address of unspecified must never be forwarded by an IPv6 router.

2.5.3. The Loopback Address

The unicast address 0:0:0:0:0:0:0:1 is called the loopback address. It may be used by a node to send an IPv6 packet to itself. It must not be assigned to any physical interface. It is treated as having Link-Local scope, and may be thought of as the Link-Local unicast address of a virtual interface (typically called the "loopback interface") to an imaginary link that goes nowhere.

The loopback address must not be used as the source address in IPv6 packets that are sent outside of a single node. An IPv6 packet with a destination address of loopback must never be sent outside of a single node and must never be forwarded by an IPv6 router. A packet received on an interface with a destination address of loopback must be dropped.

  • If I've understood correctly the "Unspecified Address" usage is mainly used for DHCP and port binding. Most server prosesses allow binding to given port, e.g. in IPv4 and in that case the all zeros IP means "bind to all interfaces" meaning the port will be visible to possibly multiple interfaces connected to the system. – Mikko Rantalainen Aug 11 '20 at 14:10

"::" is the ipv6 "unspecified address" (the equivilent IPv4 address is ""). When binding a socket* it is used to indicate that the socket will listen on all local IPv6 addresses. Depending on the operating system and the socket options the socket may also listen on local IPv4 addresses.

"::1" is the ipv6 "loopback address" (the equivilent IPv4 address is ""). Used for local communication within a host only.

So when you see "::" in the "local address" column of the netstat output it means the socket* is listening on all IPv6 interfaces the system has, and possibly also all local IPv4 interfaces the system has. When you see "::1" it means it is only listening on local loopback and thus can only be accessed from the local system.

Neither of these addresses should appear as source or destination addresses for normal traffic. "::1" is specifically forbidden from appearing as either a source or destination. "::" is forbidden from appearing as a destination. It can appear as a source as part of an address assignment protocol. Specifically it is used in the "duplicate address detection" process.

* in the Berkeley sockets sense of the term.

  • 2
    +1 for comparing with IPv4. However, I would nitpick that loopback in IPv4 is a complete /8 network,, including the well-known address, whereas it's only the single address ::1 in IPv6. – Dubu Feb 5 '20 at 9:59

With IPv6, :: expands to the required amount of :0: words (short for :0000:) to fill up the 128-bit address. :: can only be used once in an address and needs to be unambiguous.

With netstat, the trailing :abcd refers to the transport-layer port number, so tcp6 ::1:80 means TCP port 80 on the ::1 loopback. tcp6 :::80 is a universal binding, the unspecified address, to all local IP addresses.


[::] is the Unspecified Address. Programs can bind to this address if they do not want to bind to a specific address but ANY address.

Here is the declaration in netinet/in.h

extern const struct in6_addr in6addr_any;        /* :: */ 

If you are interested you can create small test program using C sockets API. Alternate between binding to in6addr_any and [::1] or any other specified address. You will be able to replicate what you observed.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.