Microsoft KB Archive/331078

= The NETSTAT Command Incorrectly Shows Ports in Listening States =

Article ID: 331078

Article Last Modified on 2/27/2007

-

APPLIES TO


 * Microsoft Windows 2000 Advanced Server
 * Microsoft Windows 2000 Server
 * Microsoft Windows 2000 Professional Edition
 * Microsoft Windows NT 4.0

-



This article was previously published under Q331078



SYMPTOMS
When you use the netstat -an command to see the ports that are being used on your computer, some of the ports that are shown as being in a listening state are not really in this state. This behavior occurs when you start a connection to another computer. The source port that is used for this connection is displayed as listening on the address 0.0.0.0. If you try to connect to your computer from another computer by using this specific port, this port is not really in a listening state.



STATUS
This behavior is by design. This behavior changes in Microsoft Windows Server 2003 to prevent ports that are not really listening to be shown as listening.



Steps to Reproduce the Behavior
To reproduce this behavior, follow these steps.

Note In this example, 10.0.0.1 is your Internet Protocol (IP) address, and 10.0.0.255 is the IP address of the computer that you are connecting to.  From your computer, start a Telnet connection to another computer. Run the netstat -an command, and verify the port that is used for this connection.

The following entries are displayed:

Active Connections

Proto Local Address Foreign Address State

TCP 0.0.0.0:2745 0.0.0.0:0 LISTENING

TCP 10.0.0.1:2745 10.0.0.255:1066 ESTABLISHED

 Try to connect to your computer from the other computer by using port 2745. The port is not really in a listening state.

Keywords: kbinfo KB331078

-

[mailto:TECHNET@MICROSOFT.COM Send feedback to Microsoft]

© Microsoft Corporation. All rights reserved.