1.\" $OpenBSD: netstat.1,v 1.98 2023/01/04 19:12:34 jmc Exp $ 2.\" $NetBSD: netstat.1,v 1.11 1995/10/03 21:42:43 thorpej Exp $ 3.\" 4.\" Copyright (c) 1983, 1990, 1992, 1993 5.\" The Regents of the University of California. All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. Neither the name of the University nor the names of its contributors 16.\" may be used to endorse or promote products derived from this software 17.\" without specific prior written permission. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" from: @(#)netstat.1 8.8 (Berkeley) 4/18/94 32.\" 33.Dd $Mdocdate: January 4 2023 $ 34.Dt NETSTAT 1 35.Os 36.Sh NAME 37.Nm netstat 38.Nd show network status 39.Sh SYNOPSIS 40.Nm 41.Op Fl AaBln 42.Op Fl M Ar core 43.Op Fl N Ar system 44.Op Fl p Ar protocol 45.Op Fl T Ar rtable 46.Nm 47.Fl W Ar interface 48.Nm 49.Fl m 50.Nm 51.Fl I Ar interface | Fl i 52.Op Fl bdehnq 53.Nm 54.Fl w Ar wait 55.Op Fl bdehnq 56.Op Fl c Ar count 57.Op Fl I Ar interface 58.Nm 59.Fl s 60.Op Fl gru 61.Op Fl f Ar address_family 62.Op Fl p Ar protocol 63.Nm 64.Fl g 65.Op Fl lnu 66.Op Fl f Ar address_family 67.Nm 68.Fl R 69.Nm 70.Fl r 71.Op Fl AFu 72.Op Fl f Ar address_family 73.Op Fl M Ar core 74.Op Fl N Ar system 75.Op Fl T Ar rtable 76.Nm 77.Fl P Ar pcbaddr 78.Op Fl v 79.Op Fl M Ar core 80.Op Fl N Ar system 81.Sh DESCRIPTION 82The 83.Nm 84command shows various aspects of network status. 85The default display shows information about 86all active network connections and sockets. 87.Pp 88The first form of the command displays a list of active sockets for 89each protocol. 90The second form displays per-interface statistics for 91the specified wireless (802.11) device. 92The third form displays statistics related to memory use. 93The fourth form displays per-interface statistics. 94The fifth form continuously displays the information regarding packet 95traffic on the configured network interfaces. 96The sixth form displays per-protocol statistics. 97The seventh form shows information related to multicast routing. 98The eighth form displays information about routing domains. 99The ninth form displays information about routing tables. 100The final form displays internals of the protocol control block (PCB) 101and the socket structure. 102The forms are shown in order of precedence: 103for example, if 104.Fl rg 105is specified, 106then 107.Fl r 108is ignored in favour of 109.Fl g . 110.Pp 111The options are as follows: 112.Bl -tag -width Ds 113.It Fl A 114Show the address of any protocol control blocks associated with sockets; 115useful for debugging e.g. with the 116.Fl P 117flag. 118When used with the 119.Fl r 120flag, it shows the internal addresses of the routing table. 121Only the super-user can see these addresses; 122unprivileged users will see them as 0x0. 123.It Fl a 124With the default display, 125show the state of all sockets; normally sockets used by 126server processes are not shown. 127.It Fl B 128With the default display, 129show buffer sizes for TCP sockets. 130This includes the send window size, receive window size and congestion 131window size. 132.It Fl b 133With the interface display (options 134.Fl I 135or 136.Fl i ) , 137show bytes in and out, instead of packet statistics. 138.It Fl c Ar count 139Display 140.Ar count 141updates, then exit. 142This option has no effect unless 143.Fl w 144is specified as well. 145.It Fl d 146With either the interface display (options 147.Fl I 148or 149.Fl i ) 150or an interval (option 151.Fl w ) , 152show only the number of dropped packets. 153.It Fl e 154With either the interface display (options 155.Fl I 156or 157.Fl i ) 158or an interval (option 159.Fl w ) , 160show only the number of errors on the interface. 161.It Fl F 162When showing routes, only show routes whose gateway are in the 163same address family as the destination. 164.It Fl f Ar address_family 165Limit statistics or address control block reports to those 166of the specified 167.Ar address_family . 168.Pp 169The following address families are recognized: 170.Bl -column "Address Family" AF_INET6 Description -offset indent 171.It Sy Address Family Ta Sy Constant Ta Sy Description 172.It Cm inet Ta Dv AF_INET Ta IP Version 4 173.It Cm inet6 Ta Dv AF_INET6 Ta IP Version 6 174.It Cm local Ta Dv AF_UNIX Ta Alias for Cm unix 175.It Cm mpls Ta Dv AF_MPLS Ta MPLS 176.It Cm unix Ta Dv AF_UNIX Ta Local to Host (i.e., pipes) 177.El 178.It Fl h 179Use unit suffixes to reduce the number of digits shown with the 180.Fl b 181and 182.Fl w 183options. 184.It Fl g 185Show information related to multicast (group address) routing. 186By default, show the IP multicast virtual-interface and routing tables. 187If the 188.Fl s 189option is also present, show multicast routing statistics. 190.It Fl I Ar interface 191Show information about the specified 192.Ar interface ; 193used with a 194.Ar wait 195interval as described below. 196.It Fl i 197Show the state of interfaces which have been auto-configured 198(interfaces statically configured into a system but not 199located at boot-time are not shown). 200.It Fl l 201With the default display, 202show only listening sockets. 203With the 204.Fl g 205option, display wider fields for the IPv6 multicast routing table 206.Qq Origin 207and 208.Qq Group 209columns. 210.It Fl M Ar core 211Extract values associated with the name list from the specified core 212instead of the running kernel. 213.It Fl m 214Show statistics recorded by the memory management routines 215(the network manages a private pool of memory buffers). 216.It Fl N Ar system 217Extract the name list from the specified system instead of the running kernel. 218.It Fl n 219Show network addresses as numbers (normally 220.Nm 221interprets addresses and attempts to display them 222symbolically). 223This option may be used with any of the display formats. 224.It Fl P Ar pcbaddr 225Display the contents of the protocol control block (PCB) 226located at the kernel virtual address 227.Ar pcbaddr . 228PCB addresses can be obtained using the 229.Fl A 230flag. 231When used with the 232.Fl v 233option, also print socket, domain and protocol specific structures. 234Only the super-user can use the 235.Fl P 236option. 237.Pp 238The 239.Fl P 240option requires the ability to open 241.Pa /dev/kmem 242which may be restricted based upon the value of the 243.Ar kern.allowkmem 244.Xr sysctl 8 . 245.It Fl p Ar protocol 246Restrict the output to 247.Ar protocol , 248which is either a well-known name for a protocol or an alias for it. 249Some protocol names and aliases are listed in the file 250.Pa /etc/protocols . 251The program will complain if 252.Ar protocol 253is unknown. 254If the 255.Fl s 256option is specified, the per-protocol statistics are displayed. 257Otherwise the states of the matching sockets are shown. 258.It Fl q 259Only show interfaces that have seen packets (or bytes if 260.Fl b 261is specified). 262.It Fl R 263List all rdomains with associated interfaces and routing tables. 264.It Fl r 265Show the routing tables. 266The output is explained in more detail below. 267If the 268.Fl s 269option is also specified, show routing statistics instead. 270When used with the 271.Fl v 272option, also print routing labels. 273.It Fl s 274Show per-protocol statistics. 275If this option is repeated, counters with a value of zero are suppressed. 276.It Fl T Ar rtable 277Select an alternate routing table to query. 278The default is to use the current routing table. 279.It Fl u 280Limit statistics or address control block reports to the 281.Dv AF_UNIX 282address family. 283.It Fl v 284Show extra (verbose) detail for the routing tables 285.Pq Fl r , 286or avoid truncation of long addresses. 287When used with the 288.Fl P 289option, also print socket, domain and protocol specific structures. 290.It Fl W Ar interface 291(IEEE 802.11 devices only) 292Show per-interface IEEE 802.11 wireless statistics. 293.It Fl w Ar wait 294Show network interface statistics at intervals of 295.Ar wait 296seconds. 297.El 298.Pp 299Address formats are of the form 300.Dq host.port 301or 302.Dq network.port 303if a socket's address specifies a network but no specific host address. 304When known, the host addresses are displayed symbolically 305according to the 306.Xr hosts 5 307database. 308If a symbolic name for an address is unknown, or if the 309.Fl n 310option is specified, the address is printed numerically, according 311to the address family. 312.Pp 313For more information regarding the Internet 314.Dq dot format , 315refer to 316.Xr inet_ntop 3 . 317Unspecified or 318.Dq wildcard 319addresses and ports appear as a single 320.Sq * . 321If a local port number is registered as being in use for RPC by 322.Xr portmap 8 , 323its RPC service name or RPC service number will be printed in 324.Dq [] 325immediately after the port number. 326.Pp 327The interface display provides a table of cumulative 328statistics regarding packets transferred, errors, and collisions. 329The network addresses of the interface 330and the maximum transmission unit (MTU) are also displayed. 331.Pp 332The routing table display indicates the available routes and their status. 333Each route consists of a destination host or network and 334a gateway to use in forwarding packets. 335If the destination is a 336network in numeric format, the netmask (in /24 style format) is appended. 337The flags field shows a collection of information about 338the route stored as binary choices. 339The individual flags are discussed in more detail in the 340.Xr route 8 341and 342.Xr route 4 343manual pages. 344.Pp 345Direct routes are created for each interface attached to the local host; 346the gateway field for such entries shows the address of the outgoing interface. 347The refcnt field gives the current number of active uses of the route. 348Connection oriented protocols normally hold on to a single route for the 349duration of a connection while connectionless protocols obtain a route while 350sending to the same destination. 351The use field provides a count of the number of packets sent using that route. 352The MTU entry shows the MTU associated with that route. 353This MTU value is used as the basis for the TCP maximum segment size (MSS). 354The 355.Sq L 356flag appended to the MTU value indicates that the value is 357locked, and that path MTU discovery is turned off for that route. 358A 359.Sq - 360indicates that the MTU for this route has not been set, and a default 361TCP maximum segment size will be used. 362The interface entry indicates the network interface utilized for the route. 363.Pp 364When 365.Nm 366is invoked with the 367.Fl w 368option and a 369.Ar wait 370interval argument, it displays a running count of statistics related to 371network interfaces 372(an obsolescent version of this option used a numeric parameter 373with no option, and is currently supported for backward compatibility). 374The display consists of a column for the primary interface (the first 375interface found during autoconfiguration) and a column summarizing 376information for all interfaces. 377The primary interface may be replaced with another interface with the 378.Fl I 379option. 380The first line of each screen of information contains a summary since the 381system was last rebooted. 382Subsequent lines of output show values accumulated over the preceding interval. 383.Sh SEE ALSO 384.Xr fstat 1 , 385.Xr nfsstat 1 , 386.Xr ps 1 , 387.Xr systat 1 , 388.Xr tcpbench 1 , 389.Xr top 1 , 390.Xr inet_ntop 3 , 391.Xr netintro 4 , 392.Xr route 4 , 393.Xr hosts 5 , 394.Xr protocols 5 , 395.Xr services 5 , 396.Xr iostat 8 , 397.Xr portmap 8 , 398.Xr pstat 8 , 399.Xr route 8 , 400.Xr tcpdrop 8 , 401.Xr trpt 8 , 402.Xr vmstat 8 403.Sh HISTORY 404The 405.Nm 406command appeared in 407.Bx 4.2 . 408IPv6 support was added by the WIDE/KAME project. 409.Sh BUGS 410The notion of errors is ill-defined. 411