netstat 0.0.0.0:80

I have a question about how netstat displays the netstat -na results. On
some server w2k/2wk3 I do a netstat -na I see that port 80 is displayed as
0.0.0.0:80 and on other systems it show as the acutal ip... ie 12.12.12.12:80.
This occurs even if IIS is set the same way. Where is the difference coming
from. Where does netstat actually get is info... from the registry?
Thanks in advanced.

"Justwhatingtoknow" <(E-Mail Removed)> wrote in
message news:8CB03499-2254-4858-BA28-(E-Mail Removed)...
>I have a question about how netstat displays the netstat -na results. On
> some server w2k/2wk3 I do a netstat -na I see that port 80 is displayed as
> 0.0.0.0:80 and on other systems it show as the acutal ip... ie
> 12.12.12.12:80.
> This occurs even if IIS is set the same way. Where is the difference
> coming
> from. Where does netstat actually get is info... from the registry?
> Thanks in advanced.

0.0.0.0 means it's listening on all interfaces. Maybe not waht you want.
MS now has a port query tool and a parser to view the results. Also
sysinternals has tcpview. I like tcpview becuase it's graphical.

Matt
MCT, MCSE

The machine that displays the actual address may only have one static
address configured, and the other may have addresses aliased, or have
multiple interfaced (multihomed).

That would make the netstat report that it is listening on 0.0.0.0:80 (all
active interfaces)

-Mike
"Matt Anderson" <(E-Mail Removed)> wrote in message
news:(E-Mail Removed)...
>
> "Justwhatingtoknow" <(E-Mail Removed)> wrote in
> message news:8CB03499-2254-4858-BA28-(E-Mail Removed)...
>>I have a question about how netstat displays the netstat -na results. On
>> some server w2k/2wk3 I do a netstat -na I see that port 80 is displayed
>> as
>> 0.0.0.0:80 and on other systems it show as the acutal ip... ie
>> 12.12.12.12:80.
>> This occurs even if IIS is set the same way. Where is the difference
>> coming
>> from. Where does netstat actually get is info... from the registry?
>> Thanks in advanced.
>
> 0.0.0.0 means it's listening on all interfaces. Maybe not waht you want.
> MS now has a port query tool and a parser to view the results. Also
> sysinternals has tcpview. I like tcpview becuase it's graphical.
>
> Matt
> MCT, MCSE
>