Mysterious connections from 0.0.0.0

[LifeSteala]

Hi
I'm not sure if this is the right forum but I ran this netstat command to see a list of IP connections of my server. There's a bunch of 1 connected IPs which I removed but I am seeing 54 connections from 0.0.0.0.

I've not seen this before.

Does anyone know what 0.0.0.0 is?

[[email protected] ~]# netstat -anp |grep 'tcp\|udp' | awk '{print $5}' | cut -d: -f1 | sort | uniq -c | sort -n
      1 BUNCH OF IPs
      9 127.0.0.1
     25
     27 IP HERE
     54 0.0.0.0

 

[andrew.n]

0.0.0.0 is local connection. Do you know what is the port? My guess would be MySQL or something like that.

 

[cPanelLauren]

This wouldn't have just one port assignment. Local services connect over a port with 0.0.0.0 for internal connections. For example on my test server:

[[email protected] logs]# netstat -anp |grep '0.0.0.0' |awk '{print $4, $7}' |cut -d: -f2 |sort |uniq -c |sort -n
      1 110 3623/dovecot
      1 111
      1 111 502/rpcbind
      1 11211 1432/memcached
      1 143 3623/dovecot
      1 2077 33810/cpdavd
      1 2078 33810/cpdavd
      1 2082 1975/cpsrvd
      1 2083 1975/cpsrvd
      1 2086 1975/cpsrvd
      1 2087 1975/cpsrvd
      1 2095 1975/cpsrvd
      1 2096 1975/cpsrvd
      1 21 1436/pure-ftpd
      1 22 1445/sshd
      1 25 24623/exim
      1 443 20721/httpd
      1 465 24623/exim
      1 52223 4927/im360
      1 52224 4927/im360
      1 52227 4927/im360
      1 52228 4927/im360
      1 52229 4927/im360
      1 52230 4927/im360
      1 52231 4927/im360
      1 52232 4927/im360
      1 53
      1 53 1410/pdns_server
      1 587 24623/exim
      1 62311 33912/CalendarServe
      1 676
      1 783 3584/spamd
      1 80 20721/httpd
      1 953 1410/pdns_server
      1 993 3623/dovecot
      1 995 3623/dovecot
      2 5432 33708/postgres
      4 123