In netstat output, what do 0.0.0.0 IP addresses indicate about the connections?

• A. Established
• B. Listening
• C. Timed Out/Waiting
• D. Closed/Waiting

Answer: (B)

The key idea is that 0.0.0.0 in netstat means the socket is bound to all IPv4 addresses on the local machine. When a port shows 0.0.0.0:port in the Local Address column and the state is listening, it means the service is waiting for incoming connections on any network interface. That’s why this indicates a listening service rather than a specific connection or a closed state. If you bound the service to a specific IP address, you’d see that IP instead of 0.0.0.0, meaning the service listens only on that interface. For contrast, an established connection would show a different state (ESTABLISHED), and states like TIME_WAIT or CLOSED relate to connection teardown, not listening. So the 0.0.0.0 address on a listening socket shows the port is open to accept connections from any network interface on the host. For example, a web server listening on all interfaces would appear as 0.0.0.0:80 with a listening state.