1.\" Copyright (c) 1983, 1990, 1992 The Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" %sccs.include.redist.roff% 5.\" 6.\" @(#)netstat.1 6.15 (Berkeley) 07/20/92 7.\" 8.Dd 9.Dt NETSTAT 1 10.Os BSD 4.2 11.Sh NAME 12.Nm netstat 13.Nd show network status 14.Sh SYNOPSIS 15.Nm netstat 16.Op Fl ABan 17.Op Fl f Ar address_family 18.Op Ar system 19.Op Ar core 20.Nm netstat 21.Op Fl Bhimnrs 22.Op Fl f Ar address_family 23.Op Fl M Ar core 24.Op Fl N Ar system 25.Nm netstat 26.Op Fl n 27.Op Fl I Op Ar interface 28.Op Fl M Ar core 29.Op Fl N Ar system 30.Op Fl w Ar wait 31.Nm netstat 32.Op Fl p Ar protocol 33.Op Fl M Ar core 34.Op Fl N Ar system 35.Sh DESCRIPTION 36The 37.Nm netstat 38command symbolically displays the contents of various network-related 39data structures. 40There are a number of output formats, 41depending on the options for the information presented. 42The first form of the command displays a list of active sockets for 43each protocol. 44The second form presents the contents of one of the other network 45data structures according to the option selected. 46Using the third form, with a 47.Ar wait 48interval specified, 49.Nm netstat 50will continuously display the information regarding packet 51traffic on the configured network interfaces. 52The fourth form displays statistics about the named protocol. 53.Pp 54The options have the following meaning: 55.Bl -tag -width flag 56.It Fl A 57With the default display, 58show the address of any protocol control blocks associated with sockets; used 59for debugging. 60.It Fl B 61With the default display, 62show the multicast routing tables. 63When 64.Fl s 65is also present, show multicast routing statistics instead. 66.It Fl a 67With the default display, 68show the state of all sockets; normally sockets used by 69server processes are not shown. 70.It Fl d 71With either interface display (option 72.Fl i 73or an interval, as described below), 74show the number of dropped packets. 75.It Fl h 76Show the state of the 77.Tn IMP 78host table. 79.It Fl i 80Show the state of interfaces which have been auto-configured 81(interfaces statically configured into a system, but not 82located at boot time are not shown). 83.It Fl I Ar interface 84Show information only about this interface; 85used with an 86.Ar wait 87interval as described below. 88.It Fl M 89Extract values associated with the name list from the specified core 90instead of the default 91.Pa /dev/kmem . 92.It Fl m 93Show statistics recorded by the memory management routines 94(the network manages a private pool of memory buffers). 95.It Fl N 96Extract the name list from the specified system instead of the default 97.Pa /vmunix . 98.It Fl n 99Show network addresses as numbers (normally 100.Nm netstat 101interprets addresses and attempts to display them 102symbolically). 103This option may be used with any of the display formats. 104.It Fl p Ar protocol 105Show statistics about 106.Ar protocol , 107which is either a well-known name for a protocol or an alias for it. Some 108protocol names and aliases are listed in the file 109.Pa /etc/protocols . 110A null response typically means that there are no interesting numbers to 111report. 112The program will complain if 113.Ar protocol 114is unknown or if there is no statistics routine for it. 115.It Fl s 116Show per-protocol statistics. 117.It Fl r 118Show the routing tables. 119When 120.Fl s 121is also present, show routing statistics instead. 122.It Fl f Ar address_family 123Limit statistics or address control block reports to those 124of the specified 125.Ar address family . 126The following address families 127are recognized: 128.Ar inet , 129for 130.Dv AF_INET , 131.Ar ns , 132for 133.Dv AF_NS , 134and 135.Ar unix , 136for 137.Dv AF_UNIX . 138.El 139.Pp 140The default display, for active sockets, shows the local 141and remote addresses, send and receive queue sizes (in bytes), protocol, 142and the internal state of the protocol. 143Address formats are of the form ``host.port'' or ``network.port'' 144if a socket's address specifies a network but no specific host address. 145When known the host and network addresses are displayed symbolically 146according to the data bases 147.Pa /etc/hosts 148and 149.Pa /etc/networks , 150respectively. If a symbolic name for an address is unknown, or if 151the 152.Fl n 153option is specified, the address is printed numerically, according 154to the address family. 155For more information regarding 156the Internet ``dot format,'' 157refer to 158.Xr inet 3 ) . 159Unspecified, 160or ``wildcard'', addresses and ports appear as ``*''. 161.Pp 162The interface display provides a table of cumulative 163statistics regarding packets transferred, errors, and collisions. 164The network addresses of the interface 165and the maximum transmission unit (``mtu'') are also displayed. 166.Pp 167The routing table display indicates the available routes and 168their status. Each route consists of a destination host or network 169and a gateway to use in forwarding packets. The flags field shows 170the state of the route (``U'' if ``up''), whether the route 171is to a gateway (``G''), whether the route was created dynamically 172by a redirect (``D''), and whether the route has been modified 173by a redirect (``M''). Direct routes are created for each 174interface attached to the local host; 175the gateway field for such entries shows the address of the outgoing interface. 176The refcnt field gives the 177current number of active uses of the route. Connection oriented 178protocols normally hold on to a single route for the duration of 179a connection while connectionless protocols obtain a route while sending 180to the same destination. 181The use field provides a count of the number of packets 182sent using that route. The interface entry indicates the network 183interface utilized for the route. 184.Pp 185When 186.Nm netstat 187is invoked with a 188.Ar wait 189interval argument, it displays a running count of statistics related to 190network interfaces. 191This display consists of a column for the primary interface (the first 192interface found during autoconfiguration) and a column summarizing 193information for all interfaces. 194The primary interface may be replaced with another interface with the 195.Fl I 196option. 197The first line of each screen of information contains a summary since the 198system was last rebooted. Subsequent lines of output show values 199accumulated over the preceding interval. 200.Sh SEE ALSO 201.Xr iostat 1 , 202.Xr nfsstat 1 , 203.Xr ps 1 , 204.Xr vmstat 1 , 205.Xr hosts 5 , 206.Xr networks 5 , 207.Xr protocols 5 , 208.Xr services 5 , 209.Xr trpt 8 , 210.Xr trsp 8 211.Sh HISTORY 212The 213.Nm netstat 214command appeared in 215.Bx 4.2 . 216.\" .Sh FILES 217.\" .Bl -tag -width /dev/kmem -compact 218.\" .It Pa /vmunix 219.\" default kernel namelist 220.\" .It Pa /dev/kmem 221.\" default memory file 222.\" .El 223.Sh BUGS 224The notion of errors is ill-defined. 225.Pp 226Collisions mean something else for the 227.Tn IMP . 228