1.\" Copyright (c) 1983, 1990, 1992, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" %sccs.include.redist.roff% 5.\" 6.\" @(#)netstat.1 8.8 (Berkeley) 04/18/94 7.\" 8.Dd 9.Dt NETSTAT 1 10.Os BSD 4.2 11.Sh NAME 12.Nm netstat 13.Nd show network status 14.Sh SYNOPSIS 15.Nm netstat 16.Op Fl Aan 17.Op Fl f Ar address_family 18.Op Fl M Ar core 19.Op Fl N Ar system 20.Nm netstat 21.Op Fl dghimnrs 22.Op Fl f Ar address_family 23.Op Fl M Ar core 24.Op Fl N Ar system 25.Nm netstat 26.Op Fl dn 27.Op Fl I Ar interface 28.Op Fl M Ar core 29.Op Fl N Ar system 30.Op Fl w Ar wait 31.Nm netstat 32.Op Fl p Ar protocol 33.Op Fl M Ar core 34.Op Fl N Ar system 35.Sh DESCRIPTION 36The 37.Nm netstat 38command symbolically displays the contents of various network-related 39data structures. 40There are a number of output formats, 41depending on the options for the information presented. 42The first form of the command displays a list of active sockets for 43each protocol. 44The second form presents the contents of one of the other network 45data structures according to the option selected. 46Using the third form, with a 47.Ar wait 48interval specified, 49.Nm netstat 50will continuously display the information regarding packet 51traffic on the configured network interfaces. 52The fourth form displays statistics about the named protocol. 53.Pp 54The options have the following meaning: 55.Bl -tag -width flag 56.It Fl A 57With the default display, 58show the address of any protocol control blocks associated with sockets; used 59for debugging. 60.It Fl a 61With the default display, 62show the state of all sockets; normally sockets used by 63server processes are not shown. 64.It Fl d 65With either interface display (option 66.Fl i 67or an interval, as described below), 68show the number of dropped packets. 69.It Fl f Ar address_family 70Limit statistics or address control block reports to those 71of the specified 72.Ar address family . 73The following address families 74are recognized: 75.Ar inet , 76for 77.Dv AF_INET , 78.Ar ns , 79for 80.Dv AF_NS , 81.Ar iso , 82for 83.Dv AF_ISO , 84and 85.Ar unix , 86for 87.Dv AF_UNIX . 88.It Fl g 89Show information related to multicast (group address) routing. 90By default, show the IP Multicast virtual-interface and routing tables. 91If the 92.Fl s 93option is also present, show multicast routing statistics. 94.It Fl h 95Show the state of the 96.Tn IMP 97host table (obsolete). 98.It Fl I Ar interface 99Show information about the specified interface; 100used with a 101.Ar wait 102interval as described below. 103.It Fl i 104Show the state of interfaces which have been auto-configured 105(interfaces statically configured into a system, but not 106located at boot time are not shown). 107If the 108.Fl a 109options is also present, multicast addresses currently in use are shown 110for each Ethernet interface and for each IP interface address. 111Multicast addresses are shown on separate lines following the interface 112address with which they are associated. 113.It Fl M 114Extract values associated with the name list from the specified core 115instead of the default 116.Pa /dev/kmem . 117.It Fl m 118Show statistics recorded by the memory management routines 119(the network manages a private pool of memory buffers). 120.It Fl N 121Extract the name list from the specified system instead of the default 122.Pa /vmunix . 123.It Fl n 124Show network addresses as numbers (normally 125.Nm netstat 126interprets addresses and attempts to display them 127symbolically). 128This option may be used with any of the display formats. 129.It Fl p Ar protocol 130Show statistics about 131.Ar protocol , 132which is either a well-known name for a protocol or an alias for it. Some 133protocol names and aliases are listed in the file 134.Pa /etc/protocols . 135A null response typically means that there are no interesting numbers to 136report. 137The program will complain if 138.Ar protocol 139is unknown or if there is no statistics routine for it. 140.It Fl s 141Show per-protocol statistics. 142If this option is repeated, counters with a value of zero are suppressed. 143.It Fl r 144Show the routing tables. 145When 146.Fl s 147is also present, show routing statistics instead. 148.It Fl w Ar wait 149Show network interface statistics at intervals of 150.Ar wait 151seconds. 152.El 153.Pp 154The default display, for active sockets, shows the local 155and remote addresses, send and receive queue sizes (in bytes), protocol, 156and the internal state of the protocol. 157Address formats are of the form ``host.port'' or ``network.port'' 158if a socket's address specifies a network but no specific host address. 159When known the host and network addresses are displayed symbolically 160according to the data bases 161.Pa /etc/hosts 162and 163.Pa /etc/networks , 164respectively. If a symbolic name for an address is unknown, or if 165the 166.Fl n 167option is specified, the address is printed numerically, according 168to the address family. 169For more information regarding 170the Internet ``dot format,'' 171refer to 172.Xr inet 3 ) . 173Unspecified, 174or ``wildcard'', addresses and ports appear as ``*''. 175.Pp 176The interface display provides a table of cumulative 177statistics regarding packets transferred, errors, and collisions. 178The network addresses of the interface 179and the maximum transmission unit (``mtu'') are also displayed. 180.Pp 181The routing table display indicates the available routes and 182their status. Each route consists of a destination host or network 183and a gateway to use in forwarding packets. The flags field shows 184a collection of information about the route stored as 185binary choices. The individual flags are discussed in more 186detail in the 187.Xr route 8 188and 189.Xr route 4 190manual pages. 191The mapping between letters and flags is: 192.Bl -column XXXX RTF_BLACKHOLE 1931 RTF_PROTO2 Protocol specific routing flag #1 1942 RTF_PROTO1 Protocol specific routing flag #2 195B RTF_BLACKHOLE Just discard pkts (during updates) 196C RTF_CLONING Generate new routes on use 197D RTF_DYNAMIC Created dynamically (by redirect) 198G RTF_GATEWAY Destination requires forwarding by intermediary 199H RTF_HOST Host entry (net otherwise) 200L RTF_LLINFO Valid protocol to link address translation. 201M RTF_MODIFIED Modified dynamically (by redirect) 202R RTF_REJECT Host or net unreachable 203S RTF_STATIC Manually added 204U RTF_UP Route usable 205X RTF_XRESOLVE External daemon translates proto to link address 206.El 207.Pp 208Direct routes are created for each 209interface attached to the local host; 210the gateway field for such entries shows the address of the outgoing interface. 211The refcnt field gives the 212current number of active uses of the route. Connection oriented 213protocols normally hold on to a single route for the duration of 214a connection while connectionless protocols obtain a route while sending 215to the same destination. 216The use field provides a count of the number of packets 217sent using that route. The interface entry indicates the network 218interface utilized for the route. 219.Pp 220When 221.Nm netstat 222is invoked with the 223.Fl w 224option and a 225.Ar wait 226interval argument, it displays a running count of statistics related to 227network interfaces. 228An obsolescent version of this option used a numeric parameter 229with no option, and is currently supported for backward compatibility. 230This display consists of a column for the primary interface (the first 231interface found during autoconfiguration) and a column summarizing 232information for all interfaces. 233The primary interface may be replaced with another interface with the 234.Fl I 235option. 236The first line of each screen of information contains a summary since the 237system was last rebooted. Subsequent lines of output show values 238accumulated over the preceding interval. 239.Sh SEE ALSO 240.Xr iostat 1 , 241.Xr nfsstat 1 , 242.Xr ps 1 , 243.Xr vmstat 1 , 244.Xr hosts 5 , 245.Xr networks 5 , 246.Xr protocols 5 , 247.Xr services 5 , 248.Xr trpt 8 , 249.Xr trsp 8 250.Sh HISTORY 251The 252.Nm netstat 253command appeared in 254.Bx 4.2 . 255.\" .Sh FILES 256.\" .Bl -tag -width /dev/kmem -compact 257.\" .It Pa /vmunix 258.\" default kernel namelist 259.\" .It Pa /dev/kmem 260.\" default memory file 261.\" .El 262.Sh BUGS 263The notion of errors is ill-defined. 264