1.\" Copyright (c) 1983, 1990 The Regents of the University of California. 2.\" All rights reserved. 3.\" 4.\" %sccs.include.redist.man% 5.\" 6.\" @(#)netstat.1 6.12 (Berkeley) 03/14/91 7.\" 8.Vx 9.Vx 10.Dd 11.Dt NETSTAT 1 12.Os BSD 4.2 13.Sh NAME 14.Nm netstat 15.Nd show network status 16.Sh SYNOPSIS 17.Nm netstat 18.Op Fl Aan 19.Op Fl f Ar address_family 20.Op Ar system 21.Op Ar core 22.Nm netstat 23.Op Fl himnrs 24.Op Fl f Ar address_family 25.Op Ar system 26.Op Ar core 27.Nm netstat 28.Op Fl n 29.Op Fl I Op Ar interface 30.Ar interval 31.Op Ar system 32.Op Ar core 33.Nm netstat 34.Op Fl p Ar protocol 35.Op Ar system 36.Op Ar core 37.Sh DESCRIPTION 38The 39.Nm netstat 40command symbolically displays the contents of various network-related 41data structures. 42There are a number of output formats, 43depending on the options for the information presented. 44The first form of the command displays a list of active sockets for 45each protocol. 46The second form presents the contents of one of the other network 47data structures according to the option selected. 48Using the third form, with an 49.Ar interval 50specified, 51.Nm netstat 52will continuously display the information regarding packet 53traffic on the configured network interfaces. 54The fourth form displays statistics about the named protocol. 55.Pp 56The options have the following meaning: 57.Tw Fl 58.Tp Fl A 59With the default display, 60show the address of any protocol control blocks associated with sockets; used 61for debugging. 62.Tp Fl a 63With the default display, 64show the state of all sockets; normally sockets used by 65server processes are not shown. 66.Tp Fl d 67With either interface display (option 68.Fl i 69or an interval, as described below), 70show the number of dropped packets. 71.Tp Fl h 72Show the state of the IMP host table. 73.Tp Fl i 74Show the state of interfaces which have been auto-configured 75(interfaces statically configured into a system, but not 76located at boot time are not shown). 77.Tp Cx Fl I 78.Ws 79.Ar interface 80.Cx 81Show information only about this interface; 82used with an 83.Ar interval 84as described below. 85.Tp Fl m 86Show statistics recorded by the memory management routines 87(the network manages a private pool of memory buffers). 88.Tp Fl n 89Show network addresses as numbers (normally 90.Nm netstat 91interprets addresses and attempts to display them 92symbolically). 93This option may be used with any of the display formats. 94.Tp Cx Fl p 95.Ws 96.Ar protocol 97.Cx 98Show statistics about 99.Ar protocol , 100which is either a well-known name for a protocol or an alias for it. Some 101protocol names and aliases are listed in the file 102.Pa /etc/protocols . 103A null response typically means that there are no interesting numbers to 104report. 105The program will complain if 106.Ar protocol 107is unknown or if there is no statistics routine for it. 108.Tp Fl s 109Show per-protocol statistics. 110.Tp Fl r 111Show the routing tables. 112When 113.Fl s 114is also present, show routing statistics instead. 115.Tp Cx Fl f 116.Ws 117.Ar address_family 118.Cx 119Limit statistics or address control block reports to those 120of the specified 121.Ar address family . 122The following address families 123are recognized: 124.Ar inet , 125for 126.Li AF_INET , 127.Ar ns , 128for 129.Li AF_NS , 130and 131.Ar unix , 132for 133.Li AF_UNIX . 134.Tp 135.Pp 136The arguments, 137.Ar system 138and 139.Ar core 140allow substitutes for the defaults 141.Dq Pa vmunix 142and 143.Dq Pa /dev/kmem . 144.Pp 145The default display, for active sockets, shows the local 146and remote addresses, send and receive queue sizes (in bytes), protocol, 147and the internal state of the protocol. 148Address formats are of the form ``host.port'' or ``network.port'' 149if a socket's address specifies a network but no specific host address. 150When known the host and network addresses are displayed symbolically 151according to the data bases 152.Pa /etc/hosts 153and 154.Pa /etc/networks , 155respectively. If a symbolic name for an address is unknown, or if 156the 157.Fl n 158option is specified, the address is printed numerically, according 159to the address family. 160For more information regarding 161the Internet ``dot format,'' 162refer to 163.Xr inet 3 ) . 164Unspecified, 165or ``wildcard'', addresses and ports appear as ``*''. 166.Pp 167The interface display provides a table of cumulative 168statistics regarding packets transferred, errors, and collisions. 169The network addresses of the interface 170and the maximum transmission unit (``mtu'') are also displayed. 171.Pp 172The routing table display indicates the available routes and 173their status. Each route consists of a destination host or network 174and a gateway to use in forwarding packets. The flags field shows 175the state of the route (``U'' if ``up''), whether the route 176is to a gateway (``G''), whether the route was created dynamically 177by a redirect (``D''), and whether the route has been modified 178by a redirect (``M''). Direct routes are created for each 179interface attached to the local host; 180the gateway field for such entries shows the address of the outgoing interface. 181The refcnt field gives the 182current number of active uses of the route. Connection oriented 183protocols normally hold on to a single route for the duration of 184a connection while connectionless protocols obtain a route while sending 185to the same destination. 186The use field provides a count of the number of packets 187sent using that route. The interface entry indicates the network 188interface utilized for the route. 189.Pp 190When 191.Nm netstat 192is invoked with an 193.Ar interval 194argument, it displays a running count of statistics related to 195network interfaces. This display consists of a 196column for the primary interface 197(the first interface found during autoconfiguration) 198and a column summarizing 199information for all interfaces. 200The primary interface may be replaced with another interface with the 201.Fl I 202option. 203The first line of each screen of information contains a summary since the 204system was last rebooted. Subsequent lines of output show values 205accumulated over the preceding interval. 206.Sh SEE ALSO 207.Xr iostat 1 , 208.Xr vmstat 1 , 209.Xr hosts 5 , 210.Xr networks 5 , 211.Xr protocols 5 , 212.Xr services 5 , 213.Xr trpt 8 214.Sh HISTORY 215.Nm Netstat 216appeared in 4.2 BSD. 217.Sh BUGS 218The notion of errors is ill-defined. Collisions mean 219something else for the IMP. 220