why the UDP ports only have *:* listed for states?

---

Request for Question Clarification by sycophant-ga on 14 Feb 2003 00:49 PST

Can you give your question some context? I am not sure what you mean.

Where is this state listing you are referring to? And what do you
expect to see there?

Regards,
sycophant-ga

Expanding on the comment:

UDP is a connectionless protocol, so it *cannot* establish any
connections that will show up in a netstat report (which is what I
assume you are looking at.) As such, netstat is alerting you that
there are programs/processes that are listening for UDP information,
but since no connections can be tracked, they will always appear as
*:* in your list.

This is by design, and isn't a security risk. UDP is used for a lot of
things, including streaming audio and video, and several other
miscellaneous Internet services.

If you're still unclear on this or would like more information, feel
free to post a clarification request.

Thanks for the question!

/gleffler-ga

Search strategy:

'udp netstat'
'udp connectionless'

I assume you are using the command netstat -a to look at all the
connections on your system and you are wondering why the UDP show the
foreign host as *:*.

UDP is a connectionless protocol unlike TCP which is a connection
based protocol.  Whenever a TCP connection is established it is add to
a table that the operating system maintains.  When the connection is
torn down it is removed.

However there is no equivalent with UDP.  But if you have a progress
which is listening on a UDP port, then you have to have some way of
showing that.  So *:* is used to represent that the port is open to
receive a packet on a particular port, from any remote system on any
port.

Tcp & Udp are implemented by using sockets.Now for a tcp connection
these sockets  can have a variety of states which tell us about the
present condition of the tcp connection ie if the connection is in the
process of closing,or has it just started,or if any data transfer is
taking place etc.
Now this info is irrelevant for a Udp socket as Udp is a
connectionless oriented protocol.Thus it does't require info regarding
the state of a connection unlike Tcp.
The netstat command displays the state of all the sockets in a system
(Tcp & Udp sockets included).So for a tcp socket it displays the
state.But because the state info is irrelevant for a Udp socket it
displays a * as it's state.

For more info on Tcp socket states read chapter 2 of Unix Network
Programming by W.Richard Stevens.

Hope this helped.