Why does this "netstat -tln" output show entries for "0.0.0.0:22" and "127.0.0.1:3306" [closed]

Question

When I run the command netstat -tln I see the following output:

Active Internet connections (only servers)
Proto Recv-Q Send-Q Local Address           Foreign Address         State      
tcp        0      0 127.0.0.1:3306          0.0.0.0:*               LISTEN     
tcp        0      0 0.0.0.0:22              0.0.0.0:*               LISTEN     
tcp6       0      0 :::8000                 :::*                    LISTEN     
tcp6       0      0 :::80                   :::*                    LISTEN     
tcp6       0      0 :::22                   :::*                    LISTEN     
tcp6       0      0 :::443                  :::*                    LISTEN  

I understand all the entries except 0.0.0.0:22 and 127.0.0.1:3306; why are these entries there?

I am using iptables as my firewall tool and want to know if I need to disable this and how this entry showed up in the first place.

I know that 3306 is for mysql. But why are there specific IP addresses for SSH and Mysql but not for the other servers?

Answer 1

0.0.0.0:22

The above means you are listening on port 22 (ssh) all ip addresses

127.0.0.1:3306

The above means you are listening on port 3306 (mysql) for local loopback only

The reason the first two look different than the others is because these are IPv4 addresses while the others are IPv6 addresses as evidenced from the Proto column showing either tcp or tcp6

For the lines with IPv6 addresses (tcp6) it is listening on ::: all ip addresses, the equivalent of IPv4's 0.0.0.0

---

update

Thanks but why am I getting IPv6 addresses when I have disabled ipV6 as evidenced by output of 1 when I run "cat /proc/sys/net/ipv6/conf/all/disable_ipv6"? I am not doing anything special (or so I think) in starting the http, https, mysql and ssh servers. I would have expected similar entries for all of them, for both IPv6 and IPv4. I understand the output broadly but I am having difficulties in understanding it precisely. I need this to tie this back to my iptables rules. – Sam 7 mins ago

You have disabled IPv6 on the network interfaces but that does not remove IPv6 from the system; to do that you would need to disable the IPv6 kernel module.