1.\" $NetBSD: netstat.1,v 1.36 2002/09/30 11:09:07 grant Exp $ 2.\" 3.\" Copyright (c) 1983, 1990, 1992, 1993 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. All advertising materials mentioning features or use of this software 15.\" must display the following acknowledgement: 16.\" This product includes software developed by the University of 17.\" California, Berkeley and its contributors. 18.\" 4. Neither the name of the University nor the names of its contributors 19.\" may be used to endorse or promote products derived from this software 20.\" without specific prior written permission. 21.\" 22.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 23.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 24.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 25.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 26.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 27.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 28.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 29.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 30.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 31.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 32.\" SUCH DAMAGE. 33.\" 34.\" @(#)netstat.1 8.8 (Berkeley) 4/18/94 35.\" 36.Dd December 13, 1999 37.Dt NETSTAT 1 38.Os 39.Sh NAME 40.Nm netstat 41.Nd show network status 42.Sh SYNOPSIS 43.Nm 44.Op Fl Aan 45.Op Fl f Ar address_family 46.Op Fl M Ar core 47.Op Fl N Ar system 48.Nm "" 49.Op Fl bdgiLmnqrsSv 50.Op Fl f Ar address_family 51.Op Fl M Ar core 52.Op Fl N Ar system 53.Nm "" 54.Op Fl dn 55.Op Fl I Ar interface 56.Op Fl M Ar core 57.Op Fl N Ar system 58.Op Fl w Ar wait 59.Nm "" 60.Op Fl p Ar protocol 61.Op Fl M Ar core 62.Op Fl N Ar system 63.Nm "" 64.Op Fl p Ar protocol 65.Op Fl M Ar core 66.Op Fl N Ar system 67.Fl P Ar pcbaddr 68.Nm "" 69.Op Fl p Ar protocol 70.Op Fl i 71.Op Fl I Ar Interface 72.Nm "" 73.Op Fl s 74.Op Fl f Ar address_family 75.Op Fl i 76.Op Fl I Ar Interface 77.Sh DESCRIPTION 78The 79.Nm 80command symbolically displays the contents of various network-related 81data structures. 82There are a number of output formats, 83depending on the options for the information presented. 84The first form of the command displays a list of active sockets for 85each protocol. 86The second form presents the contents of one of the other network 87data structures according to the option selected. 88Using the third form, with a 89.Ar wait 90interval specified, 91.Nm 92will continuously display the information regarding packet 93traffic on the configured network interfaces. 94The fourth form displays statistics about the named protocol. 95The fifth and sixth forms display per interface statistics for 96the specified protocol or address family. 97.Pp 98The options have the following meaning: 99.Bl -tag -width flag 100.It Fl A 101With the default display, 102show the address of any protocol control blocks associated with sockets; used 103for debugging. 104.It Fl a 105With the default display, 106show the state of all sockets; normally sockets used by 107server processes are not shown. 108.It Fl b 109With the interface display (option 110.Fl i ) , 111show bytes in and out, instead of packets in and out. 112.It Fl d 113With either interface display (option 114.Fl i 115or an interval, as described below), 116show the number of dropped packets. 117.It Fl f Ar address_family 118Limit statistics or address control block reports to those 119of the specified 120.Ar address family . 121The following address families 122are recognized: 123.Ar inet , 124for 125.Dv AF_INET ; 126.Ar inet6 , 127for 128.Dv AF_INET6 ; 129.Ar arp , 130for 131.Dv AF_ARP ; 132.Ar ns , 133for 134.Dv AF_NS ; 135.Ar iso , 136for 137.Dv AF_ISO ; 138.Ar atalk , 139for 140.Dv AF_APPLETALK ; 141and 142.Ar local 143or 144.Ar unix , 145for 146.Dv AF_LOCAL . 147.It Fl g 148Show information related to multicast (group address) routing. 149By default, show the IP Multicast virtual-interface and routing tables. 150If the 151.Fl s 152option is also present, show multicast routing statistics. 153.It Fl I Ar interface 154Show information about the specified interface; 155used with a 156.Ar wait 157interval as described below. 158If the 159.Fl f Ar address_family 160option (with the 161.Fl s 162option) or the 163.Fl p Ar protocol 164option is present, show per-interface statistics on the 165.Ar interface 166for the specified 167.Ar address_family 168or 169.Ar protocol , 170respectively. 171.It Fl i 172Show the state of interfaces which have been auto-configured 173(interfaces statically configured into a system, but not 174located at boot time are not shown). 175If the 176.Fl a 177options is also present, multicast addresses currently in use are shown 178for each Ethernet interface and for each IP interface address. 179Multicast addresses are shown on separate lines following the interface 180address with which they are associated. 181If the 182.Fl f Ar address_family 183option (with the 184.Fl s 185option) or the 186.Fl p Ar protocol 187option is present, show per-interface statistics on all interfaces 188for the specified 189.Ar address_family 190or 191.Ar protocol , 192respectively. 193.It Fl L 194Don't show link-level routes (e.g., IPv4 ARP or IPv6 neighbour cache). 195.It Fl M 196Extract values associated with the name list from the specified core 197instead of the default 198.Pa /dev/kmem . 199.It Fl m 200Show statistics recorded by the memory management routines 201(the network manages a private pool of memory buffers). 202.It Fl N 203Extract the name list from the specified system instead of the default 204.Pa /netbsd . 205.It Fl n 206Show network addresses and ports as numbers (normally 207.Nm 208interprets addresses and ports and attempts to display them 209symbolically). 210This option may be used with any of the display formats. 211.It Fl S 212Show network addresses as numbers (as with 213.Fl n ) 214but show ports symbolically). 215.It Fl P Ar pcbaddr 216Dump the contents of the protocol control block (PCB) located at kernel 217virtual address 218.Ar pcbaddr . 219This address may be obtained using the 220.Fl A 221flag. 222The default protocol is TCP, but may be overridden using the 223.Fl p 224flag. 225.It Fl p Ar protocol 226Show statistics about 227.Ar protocol , 228which is either a well-known name for a protocol or an alias for it. 229Some protocol names and aliases are listed in the file 230.Pa /etc/protocols . 231A null response typically means that there are no interesting numbers to 232report. 233The program will complain if 234.Ar protocol 235is unknown or if there is no statistics routine for it. 236.It Fl q 237Show software interrupt queue setting/statistics for all protocols. 238.It Fl s 239Show per-protocol statistics. 240If this option is repeated, counters with a value of zero are suppressed. 241.It Fl r 242Show the routing tables. 243When 244.Fl s 245is also present, show routing statistics instead. 246.It Fl v 247Show extra (verbose) detail for the routing tables 248.Pq Fl r , 249or avoid truncation of long addresses. 250.It Fl w Ar wait 251Show network interface statistics at intervals of 252.Ar wait 253seconds. 254.El 255.Pp 256The default display, for active sockets, shows the local 257and remote addresses, send and receive queue sizes (in bytes), protocol, 258and the internal state of the protocol. 259Address formats are of the form ``host.port'' or ``network.port'' 260if a socket's address specifies a network but no specific host address. 261When known the host and network addresses are displayed symbolically 262according to the data bases 263.Pa /etc/hosts 264and 265.Pa /etc/networks , 266respectively. 267If a symbolic name for an address is unknown, or if 268the 269.Fl n 270option is specified, the address is printed numerically, according 271to the address family. 272For more information regarding 273the Internet ``dot format,'' 274refer to 275.Xr inet 3 ) . 276Unspecified, 277or ``wildcard'', addresses and ports appear as ``*''. 278You can use the 279.Xr fstat 1 280to find out which process or processes hold references to a socket. 281.Pp 282The interface display provides a table of cumulative 283statistics regarding packets transferred, errors, and collisions. 284The network addresses of the interface 285and the maximum transmission unit (``mtu'') are also displayed. 286.Pp 287The routing table display indicates the available routes and 288their status. 289Each route consists of a destination host or network 290and a gateway to use in forwarding packets. 291The flags field shows 292a collection of information about the route stored as 293binary choices. 294The individual flags are discussed in more 295detail in the 296.Xr route 8 297and 298.Xr route 4 299manual pages. 300The mapping between letters and flags is: 301.Bl -column XXXX RTF_BLACKHOLE 3021 RTF_PROTO2 Protocol specific routing flag #1 3032 RTF_PROTO1 Protocol specific routing flag #2 304B RTF_BLACKHOLE Just discard pkts (during updates) 305C RTF_CLONING Generate new routes on use 306c RTF_CLONED Cloned routes (generated from RTF_CLONING) 307D RTF_DYNAMIC Created dynamically (by redirect) 308G RTF_GATEWAY Destination requires forwarding by intermediary 309H RTF_HOST Host entry (net otherwise) 310L RTF_LLINFO Valid protocol to link address translation. 311M RTF_MODIFIED Modified dynamically (by redirect) 312R RTF_REJECT Host or net unreachable 313S RTF_STATIC Manually added 314U RTF_UP Route usable 315X RTF_XRESOLVE External daemon translates proto to link address 316.El 317.Pp 318Direct routes are created for each 319interface attached to the local host; 320the gateway field for such entries shows the address of the outgoing interface. 321The refcnt field gives the 322current number of active uses of the route. 323Connection oriented 324protocols normally hold on to a single route for the duration of 325a connection while connectionless protocols obtain a route while sending 326to the same destination. 327The use field provides a count of the number of packets 328sent using that route. 329The mtu entry shows the mtu associated with 330that route. 331This mtu value is used as the basis for the TCP maximum 332segment size. 333The 'L' flag appended to the mtu value indicates that 334the value is locked, and that path mtu discovery is turned off for 335that route. 336A 337.Sq - 338indicates that the mtu for this route has not been set, and a default 339TCP maximum segment size will be used. 340The interface entry indicates 341the network interface utilized for the route. 342.Pp 343When 344.Nm 345is invoked with the 346.Fl w 347option and a 348.Ar wait 349interval argument, it displays a running count of statistics related to 350network interfaces. 351An obsolescent version of this option used a numeric parameter 352with no option, and is currently supported for backward compatibility. 353This display consists of a column for the primary interface (the first 354interface found during autoconfiguration) and a column summarizing 355information for all interfaces. 356The primary interface may be replaced with another interface with the 357.Fl I 358option. 359The first line of each screen of information contains a summary since the 360system was last rebooted. 361Subsequent lines of output show values 362accumulated over the preceding interval. 363.Sh SEE ALSO 364.Xr fstat 1 , 365.Xr nfsstat 1 , 366.Xr ps 1 , 367.Xr vmstat 1 , 368.Xr inet 3 , 369.Xr hosts 5 , 370.Xr networks 5 , 371.Xr protocols 5 , 372.Xr services 5 , 373.Xr iostat 8 , 374.Xr trpt 8 , 375.Xr trsp 8 376.Sh HISTORY 377The 378.Nm 379command appeared in 380.Bx 4.2 . 381IPv6 support was added by WIDE/KAME project. 382.\" .Sh FILES 383.\" .Bl -tag -width /dev/kmem -compact 384.\" .It Pa /netbsd 385.\" default kernel namelist 386.\" .It Pa /dev/kmem 387.\" default memory file 388.\" .El 389.Sh BUGS 390The notion of errors is ill-defined. 391