Understanding How the Linux Kernel Handles 0.0.0.0 (INADDR_ANY) Binding

Recently a reader asked how a server listening on 0.0.0.0 works internally; understanding this helps grasp Linux server behavior on multi‑NIC systems, so this article provides a detailed answer.

Below is a minimal C example that binds a socket to INADDR_ANY (which equals 0.0.0.0 ) to illustrate the concept (the code is for demonstration only and not runnable):

void main(){
  int fd = socket(AF_INET, SOCK_STREAM, IPPROTO_TCP);
  struct sockaddr_in addr;

  addr.sin_family = AF_INET;
  addr.sin_addr.s_addr = htonl(INADDR_ANY);
  addr.sinport = ...;

  // bind ip and port
  bind(fd, addr, ...);

  // listen
  listen(fd, ...);
}

INADDR_ANY is defined in include/uapi/linux/in.h as the zero IP address:

#define INADDR_ANY  ((unsigned long int) 0x00000000)

1. Bind Process

The core of the bind operation is the inet_bind function located in net/ipv4/af_inet.c . Only the parts relevant to this discussion are shown:

int inet_bind(struct socket *sock, struct sockaddr *uaddr, int addr_len){
  struct sockaddr_in *addr = (struct sockaddr_in *)uaddr;
  struct sock *sk = sock->sk;
  struct inet_sock *inet = inet_sk(sk);
  ...
  // set bound IP and port
  inet->inet_rcv_saddr = inet->inet_saddr = addr->sin_addr.s_addr;
  inet->inet_sport = htons(inet->inet_num);
  ...
}

During bind , the kernel stores the IP address (or zero for INADDR_ANY ) in inet_rcv_saddr and the port in inet_sport .

2. Responding to Handshake Requests

When a client packet arrives, the kernel enters tcp_v4_rcv (in net/ipv4/tcp_ipv4.c ) to read the TCP and IP headers and look up a listening socket:

int tcp_v4_rcv(struct sk_buff *skb){
  th = tcp_hdr(skb);
  iph = ip_hdr(skb);
  // find listening socket
  sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
  ...
}

The lookup eventually calls __inet_lookup_listener , which iterates over sockets in the same hash bucket and selects the best match using compute_score :

struct sock *__inet_lookup_listener(struct net *net,
    struct inet_hashinfo *hashinfo,
    const __be32 saddr, __be16 sport,
    const __be32 daddr, const unsigned short hnum,
    const int dif){
  unsigned int hash = inet_lhashfn(net, hnum);
  struct inet_listen_hashbucket *ilb = &hashinfo->listening_hash[hash];
  ...
  // compute_score decides the best socket
}

The compute_score function (in net/ipv4/inet_hashtables.c ) gives a positive score only when the socket’s stored inet_rcv_saddr matches the packet’s destination address, unless that stored address is zero (i.e., the socket was bound to INADDR_ANY ), in which case the IP check is skipped:

static inline int compute_score(struct sock *sk, struct net *net,
    const unsigned short hnum, const __be32 daddr,
    const int dif){
  int score = -1;
  struct inet_sock *inet = inet_sk(sk);
  if (net_eq(sock_net(sk), net) && inet->inet_num == hnum && !ipv6_only_sock(sk)){
    score = sk->sk_family == PF_INET ? 2 : 1;
    __be32 rcv_saddr = inet->inet_rcv_saddr;
    if (rcv_saddr){
      if (rcv_saddr != daddr)
        return -1;
      score += 4;
    }
    ...
  }
  return score;
}

Thus, when a socket is bound to 0.0.0.0 , the kernel does not require the incoming packet’s destination IP to match, allowing the service to be reachable via any of the host’s IP addresses.

3. Conclusion

Binding a service to 0.0.0.0 makes it accessible on all local IPs; binding to a specific IP restricts access to that address only. The underlying mechanism is that the kernel stores INADDR_ANY as zero and skips IP‑address comparison during the listen‑socket lookup.