Copyright (c) 1987 Regents of the University of California.
All rights reserved.

Redistribution and use in source and binary forms are permitted
provided that the above copyright notice and this paragraph are
duplicated in all such forms and that any documentation,
advertising materials, and other materials related to such
distribution and use acknowledge that the software was developed
by the University of California, Berkeley. The name of the
University may not be used to endorse or promote products derived
from this software without specific prior written permission.
THIS SOFTWARE IS PROVIDED ``AS IS'' AND WITHOUT ANY EXPRESS OR
IMPLIED WARRANTIES, INCLUDING, WITHOUT LIMITATION, THE IMPLIED
WARRANTIES OF MERCHANTIBILITY AND FITNESS FOR A PARTICULAR PURPOSE.

@(#)fstat.1 5.7 (Berkeley) 06/22/90

C 4 fstat - file status fstat [ -u user ] [ -p pid ] [ filename... ] Fstat identifies open files. A file is considered open if a process has it open, if it is the working directory for a process, or if it is an active pure text file. If no options are specified, fstat reports on all open files.

Options:

6 -u Report all files open by the specified user.

6 -p Report all files open by the specified process.

6 filename... Restrict reports to the specified files. If the file is a block special file, fstat additionally reports on any open files on that device, treating it as a mounted file system.

The following fields are printed:

6 USER The username of the owner of the process.

6 CMD The command name of the process.

6 PID The process id.

6 FD The file number in the per-process open file table. The special names ``text'' and ``wd'' mean that the file is the pure text inode or the working directory for the process. If the file number is followed by an asterisk (``*''), then the file is not an inode, but is a socket or a FIFO or has an error of some kind. In this case the rest of the entry is in variable format, doesn't correspond to the rest of the headings, and is enclosed in parentheses. If the file resides on a remote filesystem, the device, inode, and size fields are replaced by the text ``from remote filesystem''.

6 DEVICE Major/minor number of the device this file exists on.

6 INODE The inode number of the file.

6 SIZE The size, in bytes, of the file.

6 TYPE The type of the file (see stat (2)).

The formating of open sockets depends on the protocol domain. In all cases the first field is the domain name, the second field is the socket type (stream, dgram, etc), and the third is the socket flags field (in hex). The remaining fields are protocol dependent. For tcp, it is the address of the tcpcb, and for udp, the inpcb (socket pcb). For unix domain sockets, its the address of the socket pcb and the address of the connected pcb (if connected). Otherwise the protocol number and address of the socket itself are printed. The attempt is to not duplicate netstat (1), but rather to make enough information available to permit further analysis.

For example, the addresses mentioned above are the addresses which the ``netstat -A'' command would print for tcp, udp, and unixdomain. Note that since pipes are implemented using sockets, a pipe appears as a connected unix domain stream socket. A unidirectional unix domain socket indicates the direction of flow with an arrow (``<-'' or ``->''), and a full duplex socket shows a double arrow (``<->'').

Since fstat takes a snapshot of the system, it is only correct for a very short period of time. netstat(1), ps(1), systat(1), stat(2), pstat(8)