1.\" Copyright (c) 1983, 1990, 1992, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" %sccs.include.redist.roff% 5.\" 6.\" @(#)netstat.1 8.1 (Berkeley) 06/12/93 7.\" 8.Dd 9.Dt NETSTAT 1 10.Os BSD 4.2 11.Sh NAME 12.Nm netstat 13.Nd show network status 14.Sh SYNOPSIS 15.Nm netstat 16.Op Fl ABan 17.Op Fl f Ar address_family 18.Op Ar system 19.Op Ar core 20.Nm netstat 21.Op Fl Bimnrs 22.Op Fl f Ar address_family 23.Op Fl M Ar core 24.Op Fl N Ar system 25.Nm netstat 26.Op Fl n 27.Op Fl I Op Ar interface 28.Op Fl M Ar core 29.Op Fl N Ar system 30.Op Fl w Ar wait 31.Nm netstat 32.Op Fl p Ar protocol 33.Op Fl M Ar core 34.Op Fl N Ar system 35.Sh DESCRIPTION 36The 37.Nm netstat 38command symbolically displays the contents of various network-related 39data structures. 40There are a number of output formats, 41depending on the options for the information presented. 42The first form of the command displays a list of active sockets for 43each protocol. 44The second form presents the contents of one of the other network 45data structures according to the option selected. 46Using the third form, with a 47.Ar wait 48interval specified, 49.Nm netstat 50will continuously display the information regarding packet 51traffic on the configured network interfaces. 52The fourth form displays statistics about the named protocol. 53.Pp 54The options have the following meaning: 55.Bl -tag -width flag 56.It Fl A 57With the default display, 58show the address of any protocol control blocks associated with sockets; used 59for debugging. 60.It Fl B 61With the default display, 62show the multicast routing tables. 63When 64.Fl s 65is also present, show multicast routing statistics instead. 66.It Fl a 67With the default display, 68show the state of all sockets; normally sockets used by 69server processes are not shown. 70.It Fl d 71With either interface display (option 72.Fl i 73or an interval, as described below), 74show the number of dropped packets. 75.It Fl i 76Show the state of interfaces which have been auto-configured 77(interfaces statically configured into a system, but not 78located at boot time are not shown). 79.It Fl I Ar interface 80Show information only about this interface; 81used with an 82.Ar wait 83interval as described below. 84.It Fl M 85Extract values associated with the name list from the specified core 86instead of the default 87.Pa /dev/kmem . 88.It Fl m 89Show statistics recorded by the memory management routines 90(the network manages a private pool of memory buffers). 91.It Fl N 92Extract the name list from the specified system instead of the default 93.Pa /vmunix . 94.It Fl n 95Show network addresses as numbers (normally 96.Nm netstat 97interprets addresses and attempts to display them 98symbolically). 99This option may be used with any of the display formats. 100.It Fl p Ar protocol 101Show statistics about 102.Ar protocol , 103which is either a well-known name for a protocol or an alias for it. Some 104protocol names and aliases are listed in the file 105.Pa /etc/protocols . 106A null response typically means that there are no interesting numbers to 107report. 108The program will complain if 109.Ar protocol 110is unknown or if there is no statistics routine for it. 111.It Fl s 112Show per-protocol statistics. 113.It Fl r 114Show the routing tables. 115When 116.Fl s 117is also present, show routing statistics instead. 118.It Fl f Ar address_family 119Limit statistics or address control block reports to those 120of the specified 121.Ar address family . 122The following address families 123are recognized: 124.Ar inet , 125for 126.Dv AF_INET , 127.Ar ns , 128for 129.Dv AF_NS , 130and 131.Ar unix , 132for 133.Dv AF_UNIX . 134.El 135.Pp 136The default display, for active sockets, shows the local 137and remote addresses, send and receive queue sizes (in bytes), protocol, 138and the internal state of the protocol. 139Address formats are of the form ``host.port'' or ``network.port'' 140if a socket's address specifies a network but no specific host address. 141When known the host and network addresses are displayed symbolically 142according to the data bases 143.Pa /etc/hosts 144and 145.Pa /etc/networks , 146respectively. If a symbolic name for an address is unknown, or if 147the 148.Fl n 149option is specified, the address is printed numerically, according 150to the address family. 151For more information regarding 152the Internet ``dot format,'' 153refer to 154.Xr inet 3 ) . 155Unspecified, 156or ``wildcard'', addresses and ports appear as ``*''. 157.Pp 158The interface display provides a table of cumulative 159statistics regarding packets transferred, errors, and collisions. 160The network addresses of the interface 161and the maximum transmission unit (``mtu'') are also displayed. 162.Pp 163The routing table display indicates the available routes and 164their status. Each route consists of a destination host or network 165and a gateway to use in forwarding packets. The flags field shows 166the state of the route (``U'' if ``up''), whether the route 167is to a gateway (``G''), whether the route was created dynamically 168by a redirect (``D''), and whether the route has been modified 169by a redirect (``M''). Direct routes are created for each 170interface attached to the local host; 171the gateway field for such entries shows the address of the outgoing interface. 172The refcnt field gives the 173current number of active uses of the route. Connection oriented 174protocols normally hold on to a single route for the duration of 175a connection while connectionless protocols obtain a route while sending 176to the same destination. 177The use field provides a count of the number of packets 178sent using that route. The interface entry indicates the network 179interface utilized for the route. 180.Pp 181When 182.Nm netstat 183is invoked with a 184.Ar wait 185interval argument, it displays a running count of statistics related to 186network interfaces. 187This display consists of a column for the primary interface (the first 188interface found during autoconfiguration) and a column summarizing 189information for all interfaces. 190The primary interface may be replaced with another interface with the 191.Fl I 192option. 193The first line of each screen of information contains a summary since the 194system was last rebooted. Subsequent lines of output show values 195accumulated over the preceding interval. 196.Sh SEE ALSO 197.Xr iostat 1 , 198.Xr nfsstat 1 , 199.Xr ps 1 , 200.Xr vmstat 1 , 201.Xr hosts 5 , 202.Xr networks 5 , 203.Xr protocols 5 , 204.Xr services 5 , 205.Xr trpt 8 , 206.Xr trsp 8 207.Sh HISTORY 208The 209.Nm netstat 210command appeared in 211.Bx 4.2 . 212.\" .Sh FILES 213.\" .Bl -tag -width /dev/kmem -compact 214.\" .It Pa /vmunix 215.\" default kernel namelist 216.\" .It Pa /dev/kmem 217.\" default memory file 218.\" .El 219.Sh BUGS 220The notion of errors is ill-defined. 221.Pp 222Collisions mean something else for the 223.Tn IMP . 224