Well, i was not going to comment on this but ...
You have
Api Monitor and you recorded a report, but you missed few details so i will try again to explain few things, and expand on your last post:
1) Bind : it does what say, it does bind a socket to a port, (local port) and prepare the socket for listening, bind is not essential for Listen to success, and calling listen without it will work except it will be on an arbitrary port, so bind allow you to specify the port to listen for, hence it plays a role in detecting if the port is busy, and by busy i don't mean it is in listening state but, it means port is already bound to a socket and can't be used for this socket, hence listen should not be called or will pick an arbitrary port.
2) Listen is the actual ... well listening, as a term it is means opening the port for incoming connections in case of
TCP.
3) if Listen is success as you showed in
API monitor log then and to my knowledge NetStat and
TCP View should show the port in listening state, there is no Firewall that will prevent this as it will break any application, FireWalls will allow the listening port but will not allow any packet or event on it in blocking mode, so again if Listen is success then
TCP View should report a listening port.
4) What can be a reason for Listen to succeed but there is no opened (listening state) socket, i can think of two cases
A) The socket had been closed !!!, aka in that report there should be CloseSocket, you didn't mention if that happen, so please try to check what operation did happen on these socket handles after Listen.
B) From you last post, you listed few Network interfaces and this raise a completely different questions, for that i will go back for bind and expand on it, Bind will not select the
IP it will only assign port for an already created Socket, that created socket already had an
IP !!, this is very important form here, that
IP address will decide where the listening state will happen, i mean on which network interface, when that
IP belongs to an
IP provided by an interface then Listen will be applied and valid for incoming connections for that
IP only on that network interface, many network interface are virtual ones, means they are not even real and emulated by a driver, to listen to all network interfaces you should assign the zero
IP address for that socket "0.0.0.0", other wise listen will be limited, so..
Suggestion:
How about you check (A) for CloseSocket if being called, also check what are you listening to, i don't mean the port but the
IP, the local one that will define and scope the
IP range, some virtual interfaces are protected and here i don't mean protected by firewall, because they can be hidden form the firewall to begin with, in that case they can be protected/hidden TCPView ... this case i can imagine might happen when such interface is configured to allow communication between virtual guests excluding the host, like some security feature or something similar.
ps: what i discussed above apply for IPv4, there is small differences in handling for IPv6, in IPv6 there is no subnet masks provided by interfaces, the masks functionality are already with in the
IP and its provider over the wire (or the virtual one) and how the network interface configured, this for privacy and simplification standardized for IPv6.