The NETSTAT Command Incorrectly Shows Ports in Listening States (331078)


The information in this article applies to:

  • Microsoft Windows 2000 Advanced Server
  • Microsoft Windows 2000 Server
  • Microsoft Windows 2000 Professional
  • Microsoft Windows NT 4.0
This article was previously published under Q331078

SYMPTOMS

When you use the netstat -an command to see the ports that are being used on your computer, some of the ports that are shown as being in a listening state are not really in this state. This behavior occurs when you start a connection to another computer. The source port that is used for this connection is displayed as listening on the address 0.0.0.0. If you try to connect to your computer from another computer by using this specific port, this port is not really in a listening state.

STATUS

This behavior is by design. This behavior changes in Microsoft Windows Server 2003 to prevent ports that are not really listening to be shown as listening.

MORE INFORMATION

Steps to Reproduce the Behavior

To reproduce this behavior, follow these steps.

Note In this example, 10.0.0.1 is your Internet Protocol (IP) address, and 10.0.0.255 is the IP address of the computer that you are connecting to.
  1. From your computer, start a Telnet connection to another computer.
  2. Run the netstat -an command, and verify the port that is used for this connection.

    The following entries are displayed:

    Active Connections
    Proto Local Address Foreign Address State
    TCP 0.0.0.0:2745 0.0.0.0:0 LISTENING
    TCP 10.0.0.1:2745 10.0.0.255:1066 ESTABLISHED

  3. Try to connect to your computer from the other computer by using port 2745. The port is not really in a listening state.
Modification Type:MinorLast Reviewed:11/2/2004
Keywords:kbinfo KB331078
©2004 Microsoft Corporation. All rights reserved.