312-49 · Question #248
Jack Smith is a forensics investigator who works for Mason Computer Investigation Services. He is investigating a computer that was infected by Ramen Virus. He runs the netstat command on the…
The correct answer is B. Those connections are in listening mode. In netstat output, when the local address shows 0.0.0.0 (or ) and the state is LISTENING, it means the service is bound to all available network interfaces and is waiting for incoming connections - it is not yet connected to any remote host. The foreign address also appears as…
Question
Jack Smith is a forensics investigator who works for Mason Computer Investigation Services. He is investigating a computer that was infected by Ramen Virus. He runs the netstat command on the machine to see its current connections. In the following screenshot, what do the 0.0.0.0 IP addresses signify?
Exhibit
Options
- AThose connections are established
- BThose connections are in listening mode
- CThose connections are in closed/waiting mode
- DThose connections are in timed out/waiting mode
How the community answered
(31 responses)- A3% (1)
- B94% (29)
- D3% (1)
Explanation
In netstat output, when the local address shows 0.0.0.0 (or ) and the state is LISTENING, it means the service is bound to all available network interfaces and is waiting for incoming connections - it is not yet connected to any remote host. The foreign address also appears as 0.0.0.0: for listening sockets because no remote endpoint is associated yet. ESTABLISHED connections would show specific IP addresses on both ends, not 0.0.0.0.
Topics
Community Discussion
No community discussion yet for this question.