The NETSTAT Command Incorrectly Shows Ports in Listening States

When you use the netstat -an command to see the ports that are being used on your computer, some of the ports that are shown as being in a listening state are not really in this state. This behavior occurs when you start a connection to another computer. The source port that is used for this connection is displayed as listening on the address 0.0.0.0. If you try to connect to your computer from another computer by using this specific port, this port is not really in a listening state.

This behavior is by design. This behavior changes in Microsoft Windows Server 2003 to prevent ports that are not really listening to be shown as listening.

Steps to Reproduce the Behavior

To reproduce this behavior, follow these steps.

Note In this example, 10.0.0.1 is your Internet Protocol (IP) address, and 10.0.0.255 is the IP address of the computer that you are connecting to.

1. From your computer, start a Telnet connection to another computer.
2. Run the netstat -an command, and verify the port that is used for this connection.
   
   The following entries are displayed:
   Active Connections
   Proto Local Address Foreign Address State
   TCP 0.0.0.0:2745 0.0.0.0:0 LISTENING
   TCP 10.0.0.1:2745 10.0.0.255:1066 ESTABLISHED
3. Try to connect to your computer from the other computer by using port 2745. The port is not really in a listening state.