1.\" Copyright (c) 1983, 1990, 1992, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" %sccs.include.redist.roff% 5.\" 6.\" @(#)netstat.1 8.4 (Berkeley) 01/04/94 7.\" 8.Dd 9.Dt NETSTAT 1 10.Os BSD 4.2 11.Sh NAME 12.Nm netstat 13.Nd show network status 14.Sh SYNOPSIS 15.Nm netstat 16.Op Fl Aan 17.Op Fl f Ar address_family 18.Op Fl M Ar core 19.Op Fl N Ar system 20.Nm netstat 21.Op Fl ghimnrs 22.Op Fl f Ar address_family 23.Op Fl M Ar core 24.Op Fl N Ar system 25.Nm netstat 26.Op Fl n 27.Op Fl I Op Ar interface 28.Op Fl M Ar core 29.Op Fl N Ar system 30.Op Fl w Ar wait 31.Nm netstat 32.Op Fl p Ar protocol 33.Op Fl M Ar core 34.Op Fl N Ar system 35.Sh DESCRIPTION 36The 37.Nm netstat 38command symbolically displays the contents of various network-related 39data structures. 40There are a number of output formats, 41depending on the options for the information presented. 42The first form of the command displays a list of active sockets for 43each protocol. 44The second form presents the contents of one of the other network 45data structures according to the option selected. 46Using the third form, with a 47.Ar wait 48interval specified, 49.Nm netstat 50will continuously display the information regarding packet 51traffic on the configured network interfaces. 52The fourth form displays statistics about the named protocol. 53.Pp 54The options have the following meaning: 55.Bl -tag -width flag 56.It Fl A 57With the default display, 58show the address of any protocol control blocks associated with sockets; used 59for debugging. 60.It Fl a 61With the default display, 62show the state of all sockets; normally sockets used by 63server processes are not shown. 64.It Fl d 65With either interface display (option 66.Fl i 67or an interval, as described below), 68show the number of dropped packets. 69.It Fl g 70Show information related to multicast (group address) routing. 71By default, show the IP Multicast virtual-interface and routing tables. 72If the 73.Fl s 74option is also present, show multicast routing statistics. 75.It Fl h 76Show the state of the 77.Tn IMP 78host table (obsolete). 79.It Fl i 80Show the state of interfaces which have been auto-configured 81(interfaces statically configured into a system, but not 82located at boot time are not shown). 83If the 84.Fl a 85options is also present, multicast addresses currently in use are shown 86for each Ethernet interface and for each IP interface address. 87Multicast addresses are shown on separate lines following the interface 88address with which they are associated. 89.It Fl I Ar interface 90Show information about the specified interface; 91used with a 92.Ar wait 93interval as described below. 94.It Fl M 95Extract values associated with the name list from the specified core 96instead of the default 97.Pa /dev/kmem . 98.It Fl m 99Show statistics recorded by the memory management routines 100(the network manages a private pool of memory buffers). 101.It Fl N 102Extract the name list from the specified system instead of the default 103.Pa /vmunix . 104.It Fl n 105Show network addresses as numbers (normally 106.Nm netstat 107interprets addresses and attempts to display them 108symbolically). 109This option may be used with any of the display formats. 110.It Fl p Ar protocol 111Show statistics about 112.Ar protocol , 113which is either a well-known name for a protocol or an alias for it. Some 114protocol names and aliases are listed in the file 115.Pa /etc/protocols . 116A null response typically means that there are no interesting numbers to 117report. 118The program will complain if 119.Ar protocol 120is unknown or if there is no statistics routine for it. 121.It Fl s 122Show per-protocol statistics. 123If this option is repeated, counters with a value of zero are suppressed. 124.It Fl r 125Show the routing tables. 126When 127.Fl s 128is also present, show routing statistics instead. 129.It Fl f Ar address_family 130Limit statistics or address control block reports to those 131of the specified 132.Ar address family . 133The following address families 134are recognized: 135.Ar inet , 136for 137.Dv AF_INET , 138.Ar ns , 139for 140.Dv AF_NS , 141and 142.Ar unix , 143for 144.Dv AF_UNIX . 145.It Fl w Ar wait 146Show network interface statistics at intervals of 147.Ar wait 148seconds. 149.El 150.Pp 151The default display, for active sockets, shows the local 152and remote addresses, send and receive queue sizes (in bytes), protocol, 153and the internal state of the protocol. 154Address formats are of the form ``host.port'' or ``network.port'' 155if a socket's address specifies a network but no specific host address. 156When known the host and network addresses are displayed symbolically 157according to the data bases 158.Pa /etc/hosts 159and 160.Pa /etc/networks , 161respectively. If a symbolic name for an address is unknown, or if 162the 163.Fl n 164option is specified, the address is printed numerically, according 165to the address family. 166For more information regarding 167the Internet ``dot format,'' 168refer to 169.Xr inet 3 ) . 170Unspecified, 171or ``wildcard'', addresses and ports appear as ``*''. 172.Pp 173The interface display provides a table of cumulative 174statistics regarding packets transferred, errors, and collisions. 175The network addresses of the interface 176and the maximum transmission unit (``mtu'') are also displayed. 177.Pp 178The routing table display indicates the available routes and 179their status. Each route consists of a destination host or network 180and a gateway to use in forwarding packets. The flags field shows 181the state of the route (``U'' if ``up''), whether the route 182is to a gateway (``G''), whether the route was created dynamically 183by a redirect (``D''), and whether the route has been modified 184by a redirect (``M''). Direct routes are created for each 185interface attached to the local host; 186the gateway field for such entries shows the address of the outgoing interface. 187The refcnt field gives the 188current number of active uses of the route. Connection oriented 189protocols normally hold on to a single route for the duration of 190a connection while connectionless protocols obtain a route while sending 191to the same destination. 192The use field provides a count of the number of packets 193sent using that route. The interface entry indicates the network 194interface utilized for the route. 195.Pp 196When 197.Nm netstat 198is invoked with the 199.Fl w 200option and a 201.Ar wait 202interval argument, it displays a running count of statistics related to 203network interfaces. 204An obsolescent version of this option used a numeric parameter 205with no option, and is currently supported for backward compatibility. 206This display consists of a column for the primary interface (the first 207interface found during autoconfiguration) and a column summarizing 208information for all interfaces. 209The primary interface may be replaced with another interface with the 210.Fl I 211option. 212The first line of each screen of information contains a summary since the 213system was last rebooted. Subsequent lines of output show values 214accumulated over the preceding interval. 215.Sh SEE ALSO 216.Xr iostat 1 , 217.Xr nfsstat 1 , 218.Xr ps 1 , 219.Xr vmstat 1 , 220.Xr hosts 5 , 221.Xr networks 5 , 222.Xr protocols 5 , 223.Xr services 5 , 224.Xr trpt 8 , 225.Xr trsp 8 226.Sh HISTORY 227The 228.Nm netstat 229command appeared in 230.Bx 4.2 . 231.\" .Sh FILES 232.\" .Bl -tag -width /dev/kmem -compact 233.\" .It Pa /vmunix 234.\" default kernel namelist 235.\" .It Pa /dev/kmem 236.\" default memory file 237.\" .El 238.Sh BUGS 239The notion of errors is ill-defined. 240