Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

You shouldn't use loopback to block hostnames but instead use 0.0.0.0


Can you please explain why?


0.0.0.0 is a completely invalid destination IP, and any attempts to establish a connection to it will fail long before any packets are sent. 127.0.0.1 is still valid so you depend on the network stack to either receive a RST sent to itself, or time out.

At least on Windows, the former is much faster to return with an error.

It also avoids potential conflicts if you happen to need to run a server on port 80 for any reason.


This isn't true on non-windows OSes, where 0.0.0.0 (or simply 0) means all interfaces, not nothing. ssh to a web server and do curl 0 ; it's a super-useful shortcut.

Further reading: http://serverfault.com/questions/78048/whats-the-difference-...

http://en.m.wikipedia.org/wiki/0.0.0.0


When I ping 0.0.0.0, I get replies from 69.41.141.1. I don't know but expect that's earthlink's router.


That's odd... on Windows, pinging 0.0.0.0 results in "Destination specified is invalid."

On *nix, the behaviour is slightly different and is supposed to ping localhost instead (confirmed on one of my Linux machines):

http://unix.stackexchange.com/questions/99336/how-does-ping-...


Do the RFCs have anything to say about 0.0.0.0?

Perhaps it is left up to the implementation, in which case both Windows and *NIX would be, strictly speaking, correct.


When I ping 0.0.0.0, I get replies from 127.0.0.1 (running Ubuntu 14.04).


I understand that 0.0.0.0 is the local subnet broadcast address. Is that really the case?

I've puzzled over using 127.0.0.2. What I really want to get is an RST immediately upon sending a SYN.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: