Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss

what does "::ffff" mean in netstat output?

16,154 views
Skip to first unread message

Bennett Haselton

unread,
Jan 27, 2010, 3:16:16 PM1/27/10
to
When I run "netstat" on my machine I get some lines like:

tcp 0 0 ::ffff:69.72.177.140:80 ::ffff:<remote ip
address> TIME_WAIT

I've read through the netstat man page, and several pages of Google
hits for "netstat output", and I can't find an answer to this: What
does the "::ffff" mean in front of an IP address in the netstat
output?

Some lines list a connection and its state, with the "::ffff" in front
of the source and destination IP, and some list connections without
the "::ffff". I just want to know what the difference is between the
lines that have it and the lines that don't.

Thanks!

Bennett

David W. Hodgins

unread,
Jan 27, 2010, 3:29:35 PM1/27/10
to
On Wed, 27 Jan 2010 15:16:16 -0500, Bennett Haselton <ben...@peacefire.org> wrote:

> hits for "netstat output", and I can't find an answer to this: What
> does the "::ffff" mean in front of an IP address in the netstat

That's an ipv6 address, rather then an ipv4 address.

Regards, Dave Hodgins

--
Change nomail.afraid.org to ody.ca to reply by email.
(nomail.afraid.org has been set up specifically for
use in usenet. Feel free to use it yourself.)

Rick Jones

unread,
Jan 27, 2010, 5:48:04 PM1/27/10
to

::ffff is the IPv6 prefix for an IPv4 address mapped into IPv6 space
(something along those lines).

--
the road to hell is paved with business decisions...
these opinions are mine, all mine; HP might not want them anyway... :)
feel free to post, OR email to rick.jones2 in hp.com but NOT BOTH...

Pascal Hambourg

unread,
Jan 28, 2010, 6:50:21 AM1/28/10
to
Hello,

Rick Jones a ᅵcrit :


> Bennett Haselton <ben...@peacefire.org> wrote:
>> When I run "netstat" on my machine I get some lines like:
>
>> tcp 0 0 ::ffff:69.72.177.140:80 ::ffff:<remote ip
>> address> TIME_WAIT
>

> ::ffff is the IPv6 prefix for an IPv4 address mapped into IPv6 space
> (something along those lines).

And it means that it is an IPv6 socket that is used for IPv4
communication. Application and socket-wise, it is IPv6 but network and
packet-wise it is IPv4. This is allowed as a transition mechanism if
net.ipv6.bindv6only=0 and the application didn't set the socket option
IPV6_V6ONLY.

It seems that some recent OSes disable this option by default so that
IPv6 sockets can handle only real IPv6 communications.

Rayleen rios

unread,
Sep 16, 2022, 8:42:09 PM9/16/22
to
TjddidododuddmdodpodydmdkdddodydmdldpdReeryiln😋😎😂😁😁😃🐒🐯🐶🐅🍈🍑🍉Happy birthday to you melodia Makes all also Susan xoxo
0 new messages