1.\" Copyright (c) 1983, 1990 The Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" %sccs.include.redist.man% 5.\" 6.\" @(#)netstat.1 6.11 (Berkeley) 07/24/90 7.\" 8.Dd 9.Dt NETSTAT 1 10.Os BSD 4.2 11.Sh NAME 12.Nm netstat 13.Nd show network status 14.Sh SYNOPSIS 15.Nm netstat 16.Op Fl Aan 17.Op Fl f Ar address_family 18.Op Ar system 19.Op Ar core 20.Nm netstat 21.Op Fl himnrs 22.Op Fl f Ar address_family 23.Op Ar system 24.Op Ar core 25.Nm netstat 26.Op Fl n 27.Op Fl I Op Ar interface 28.Ar interval 29.Op Ar system 30.Op Ar core 31.Nm netstat 32.Op Fl p Ar protocol 33.Op Ar system 34.Op Ar core 35.Sh DESCRIPTION 36The 37.Nm netstat 38command symbolically displays the contents of various network-related 39data structures. 40There are a number of output formats, 41depending on the options for the information presented. 42The first form of the command displays a list of active sockets for 43each protocol. 44The second form presents the contents of one of the other network 45data structures according to the option selected. 46Using the third form, with an 47.Ar interval 48specified, 49.Nm netstat 50will continuously display the information regarding packet 51traffic on the configured network interfaces. 52The fourth form displays statistics about the named protocol. 53.Pp 54The options have the following meaning: 55.Tw Fl 56.Tp Fl A 57With the default display, 58show the address of any protocol control blocks associated with sockets; used 59for debugging. 60.Tp Fl a 61With the default display, 62show the state of all sockets; normally sockets used by 63server processes are not shown. 64.Tp Fl d 65With either interface display (option 66.Fl i 67or an interval, as described below), 68show the number of dropped packets. 69.Tp Fl h 70Show the state of the IMP host table. 71.Tp Fl i 72Show the state of interfaces which have been auto-configured 73(interfaces statically configured into a system, but not 74located at boot time are not shown). 75.Tp Cx Fl I 76.Ws 77.Ar interface 78.Cx 79Show information only about this interface; 80used with an 81.Ar interval 82as described below. 83.Tp Fl m 84Show statistics recorded by the memory management routines 85(the network manages a private pool of memory buffers). 86.Tp Fl n 87Show network addresses as numbers (normally 88.Nm netstat 89interprets addresses and attempts to display them 90symbolically). 91This option may be used with any of the display formats. 92.Tp Cx Fl p 93.Ws 94.Ar protocol 95.Cx 96Show statistics about 97.Ar protocol , 98which is either a well-known name for a protocol or an alias for it. Some 99protocol names and aliases are listed in the file 100.Pa /etc/protocols . 101A null response typically means that there are no interesting numbers to 102report. 103The program will complain if 104.Ar protocol 105is unknown or if there is no statistics routine for it. 106.Tp Fl s 107Show per-protocol statistics. 108.Tp Fl r 109Show the routing tables. 110When 111.Fl s 112is also present, show routing statistics instead. 113.Tp Cx Fl f 114.Ws 115.Ar address_family 116.Cx 117Limit statistics or address control block reports to those 118of the specified 119.Ar address family . 120The following address families 121are recognized: 122.Ar inet , 123for 124.Li AF_INET , 125.Ar ns , 126for 127.Li AF_NS , 128and 129.Ar unix , 130for 131.Li AF_UNIX . 132.Tp 133.Pp 134The arguments, 135.Ar system 136and 137.Ar core 138allow substitutes for the defaults 139.Dq Pa vmunix 140and 141.Dq Pa /dev/kmem . 142.Pp 143The default display, for active sockets, shows the local 144and remote addresses, send and receive queue sizes (in bytes), protocol, 145and the internal state of the protocol. 146Address formats are of the form ``host.port'' or ``network.port'' 147if a socket's address specifies a network but no specific host address. 148When known the host and network addresses are displayed symbolically 149according to the data bases 150.Pa /etc/hosts 151and 152.Pa /etc/networks , 153respectively. If a symbolic name for an address is unknown, or if 154the 155.Fl n 156option is specified, the address is printed numerically, according 157to the address family. 158For more information regarding 159the Internet ``dot format,'' 160refer to 161.Xr inet 3 ) . 162Unspecified, 163or ``wildcard'', addresses and ports appear as ``*''. 164.Pp 165The interface display provides a table of cumulative 166statistics regarding packets transferred, errors, and collisions. 167The network addresses of the interface 168and the maximum transmission unit (``mtu'') are also displayed. 169.Pp 170The routing table display indicates the available routes and 171their status. Each route consists of a destination host or network 172and a gateway to use in forwarding packets. The flags field shows 173the state of the route (``U'' if ``up''), whether the route 174is to a gateway (``G''), whether the route was created dynamically 175by a redirect (``D''), and whether the route has been modified 176by a redirect (``M''). Direct routes are created for each 177interface attached to the local host; 178the gateway field for such entries shows the address of the outgoing interface. 179The refcnt field gives the 180current number of active uses of the route. Connection oriented 181protocols normally hold on to a single route for the duration of 182a connection while connectionless protocols obtain a route while sending 183to the same destination. 184The use field provides a count of the number of packets 185sent using that route. The interface entry indicates the network 186interface utilized for the route. 187.Pp 188When 189.Nm netstat 190is invoked with an 191.Ar interval 192argument, it displays a running count of statistics related to 193network interfaces. This display consists of a 194column for the primary interface 195(the first interface found during autoconfiguration) 196and a column summarizing 197information for all interfaces. 198The primary interface may be replaced with another interface with the 199.Fl I 200option. 201The first line of each screen of information contains a summary since the 202system was last rebooted. Subsequent lines of output show values 203accumulated over the preceding interval. 204.Sh SEE ALSO 205.Xr iostat 1 , 206.Xr vmstat 1 , 207.Xr hosts 5 , 208.Xr networks 5 , 209.Xr protocols 5 , 210.Xr services 5 , 211.Xr trpt 8 212.Sh HISTORY 213.Nm Netstat 214appeared in 4.2 BSD. 215.Sh BUGS 216The notion of errors is ill-defined. Collisions mean 217something else for the IMP. 218