0.0.0.0: this host, this network

0.0.0.0 has no single meaning. As a source address it means the sender has no address yet, which is how DHCP starts. As a bind address it means every local interface. As a route destination with a /0 mask it is the default route. RFC 1122 defines the address itself as “this host on this network”.

The three roles, kept apart

As a source address. RFC 1122 section 3.2.1.3 permits the all-zeros address as a source only during initialisation, before the host knows its own address. That is exactly the DHCP case: a client broadcasting DHCPDISCOVER sends it from 0.0.0.0 to 255.255.255.255, because it has nothing better to put in either field. Seeing it as a source address anywhere else is a sign of a spoofed or malformed packet, and most firewalls drop it.

As a bind address. In the sockets API, INADDR_ANY is 0.0.0.0, and binding a listener to it means “accept connections on any address this machine has”. This is where the address matters day to day.

As a route. 0.0.0.0/0 matches every possible destination with the shortest possible prefix, so it loses to every more specific route. That is the default gateway entry in route -n on Linux, netstat -rn on macOS, or route print on Windows.

When you see it

• In netstat -an or ss -tlnp output as 0.0.0.0:443, meaning a service listens on every IPv4 address.
• In Docker port mappings, where 0.0.0.0:8080->80/tcp means the container port is published on all host interfaces.
• In routing tables as the destination of the default route.
• In DHCP server logs as the source of a discovery packet.
• In /etc/hosts and blocklists, used to blackhole a domain.
• In a web server configuration file, as the value of listen or bind_address.

The bind decision that gets people fired

bind 0.0.0.0 on a database, a Redis instance, a Kubernetes dashboard, or a debug endpoint means the service answers on the public interface as well as the loopback one. Every year brings a fresh set of breaches from exactly this: a service that was meant to be internal, bound to all interfaces, on a host whose firewall did not cover the port.

The safe default is 127.0.0.1 for anything that only local processes need, and an explicit private address for anything that other machines on the same network need. Reserve 0.0.0.0 for services that genuinely should be reachable from everywhere, and pair it with a firewall rule you have tested from outside using /port-check.

The 0.0.0.0 day browser bug

In August 2024 researchers at Oligo Security described a class of attack they called “0.0.0.0 day”. A malicious web page could send requests to 0.0.0.0 and, on macOS and Linux, reach services listening on the local machine, because browsers treated the address as neither public nor local and let it through their private network protections. Chrome, Safari, and Firefox all shipped changes to block requests to 0.0.0.0 as a result. It is a good illustration of how an address with three meanings ends up with three sets of assumptions about it.

What it is not

0.0.0.0 is not a real destination you can send traffic to, and pinging it does not test anything useful. It is not an IP address you can be assigned, and it is not the same as 127.0.0.1, although both appear in blocklists. In IPv6 the equivalent unspecified address is ::, and the equivalent default route is ::/0.