1.\" $NetBSD: netstat.1,v 1.40 2003/08/07 11:15:21 agc Exp $ 2.\" 3.\" Copyright (c) 1983, 1990, 1992, 1993 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the University nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.\" @(#)netstat.1 8.8 (Berkeley) 4/18/94 31.\" 32.Dd December 13, 1999 33.Dt NETSTAT 1 34.Os 35.Sh NAME 36.Nm netstat 37.Nd show network status 38.Sh SYNOPSIS 39.Nm 40.Op Fl Aan 41.Op Fl f Ar address_family 42.Op Fl M Ar core 43.Op Fl N Ar system 44.Nm 45.Op Fl bdgiLmnqrsSv 46.Op Fl f Ar address_family 47.Op Fl M Ar core 48.Op Fl N Ar system 49.Nm 50.Op Fl dn 51.Op Fl I Ar interface 52.Op Fl M Ar core 53.Op Fl N Ar system 54.Op Fl w Ar wait 55.Nm 56.Op Fl p Ar protocol 57.Op Fl M Ar core 58.Op Fl N Ar system 59.Nm 60.Op Fl p Ar protocol 61.Op Fl M Ar core 62.Op Fl N Ar system 63.Fl P Ar pcbaddr 64.Nm 65.Op Fl p Ar protocol 66.Op Fl i 67.Op Fl I Ar Interface 68.Nm 69.Op Fl s 70.Op Fl f Ar address_family 71.Op Fl i 72.Op Fl I Ar Interface 73.Sh DESCRIPTION 74The 75.Nm 76command symbolically displays the contents of various network-related 77data structures. 78There are a number of output formats, 79depending on the options for the information presented. 80The first form of the command displays a list of active sockets for 81each protocol. 82The second form presents the contents of one of the other network 83data structures according to the option selected. 84Using the third form, with a 85.Ar wait 86interval specified, 87.Nm 88will continuously display the information regarding packet 89traffic on the configured network interfaces. 90The fourth form displays statistics about the named protocol. 91The fifth and sixth forms display per interface statistics for 92the specified protocol or address family. 93.Pp 94The options have the following meaning: 95.Bl -tag -width flag 96.It Fl A 97With the default display, 98show the address of any protocol control blocks associated with sockets; used 99for debugging. 100.It Fl a 101With the default display, 102show the state of all sockets; normally sockets used by 103server processes are not shown. 104.It Fl b 105With the interface display (option 106.Fl i ) , 107show bytes in and out, instead of packets in and out. 108.It Fl d 109With either interface display (option 110.Fl i 111or an interval, as described below), 112show the number of dropped packets. 113.It Fl f Ar address_family 114Limit statistics or address control block reports to those 115of the specified 116.Ar address family . 117The following address families 118are recognized: 119.Ar inet , 120for 121.Dv AF_INET ; 122.Ar inet6 , 123for 124.Dv AF_INET6 ; 125.Ar arp , 126for 127.Dv AF_ARP ; 128.Ar ns , 129for 130.Dv AF_NS ; 131.Ar iso , 132for 133.Dv AF_ISO ; 134.Ar atalk , 135for 136.Dv AF_APPLETALK ; 137and 138.Ar local 139or 140.Ar unix , 141for 142.Dv AF_LOCAL . 143.It Fl g 144Show information related to multicast (group address) routing. 145By default, show the IP Multicast virtual-interface and routing tables. 146If the 147.Fl s 148option is also present, show multicast routing statistics. 149.It Fl I Ar interface 150Show information about the specified interface; 151used with a 152.Ar wait 153interval as described below. 154If the 155.Fl f Ar address_family 156option (with the 157.Fl s 158option) or the 159.Fl p Ar protocol 160option is present, show per-interface statistics on the 161.Ar interface 162for the specified 163.Ar address_family 164or 165.Ar protocol , 166respectively. 167.It Fl i 168Show the state of interfaces which have been auto-configured 169(interfaces statically configured into a system, but not 170located at boot time are not shown). 171If the 172.Fl a 173options is also present, multicast addresses currently in use are shown 174for each Ethernet interface and for each IP interface address. 175Multicast addresses are shown on separate lines following the interface 176address with which they are associated. 177If the 178.Fl f Ar address_family 179option (with the 180.Fl s 181option) or the 182.Fl p Ar protocol 183option is present, show per-interface statistics on all interfaces 184for the specified 185.Ar address_family 186or 187.Ar protocol , 188respectively. 189.It Fl L 190Don't show link-level routes (e.g., IPv4 ARP or IPv6 neighbour cache). 191.It Fl M 192Extract values associated with the name list from the specified core 193instead of the default 194.Pa /dev/kmem . 195.It Fl m 196Show statistics recorded by the memory management routines 197(the network manages a private pool of memory buffers). 198.It Fl N 199Extract the name list from the specified system instead of the default 200.Pa /netbsd . 201.It Fl n 202Show network addresses and ports as numbers (normally 203.Nm 204interprets addresses and ports and attempts to display them 205symbolically). 206This option may be used with any of the display formats. 207.It Fl S 208Show network addresses as numbers (as with 209.Fl n ) 210but show ports symbolically). 211.It Fl P Ar pcbaddr 212Dump the contents of the protocol control block (PCB) located at kernel 213virtual address 214.Ar pcbaddr . 215This address may be obtained using the 216.Fl A 217flag. 218The default protocol is TCP, but may be overridden using the 219.Fl p 220flag. 221.It Fl p Ar protocol 222Show statistics about 223.Ar protocol , 224which is either a well-known name for a protocol or an alias for it. 225Some protocol names and aliases are listed in the file 226.Pa /etc/protocols . 227A null response typically means that there are no interesting numbers to 228report. 229The program will complain if 230.Ar protocol 231is unknown or if there is no statistics routine for it. 232.It Fl q 233Show software interrupt queue setting/statistics for all protocols. 234.It Fl s 235Show per-protocol statistics. 236If this option is repeated, counters with a value of zero are suppressed. 237.It Fl r 238Show the routing tables. 239When 240.Fl s 241is also present, show routing statistics instead. 242.It Fl v 243Show extra (verbose) detail for the routing tables 244.Pq Fl r , 245or avoid truncation of long addresses. 246.It Fl w Ar wait 247Show network interface statistics at intervals of 248.Ar wait 249seconds. 250.El 251.Pp 252The default display, for active sockets, shows the local 253and remote addresses, send and receive queue sizes (in bytes), protocol, 254and the internal state of the protocol. 255Address formats are of the form ``host.port'' or ``network.port'' 256if a socket's address specifies a network but no specific host address. 257When known the host and network addresses are displayed symbolically 258according to the data bases 259.Pa /etc/hosts 260and 261.Pa /etc/networks , 262respectively. 263If a symbolic name for an address is unknown, or if 264the 265.Fl n 266option is specified, the address is printed numerically, according 267to the address family. 268For more information regarding 269the Internet ``dot format,'' 270refer to 271.Xr inet 3 ) . 272Unspecified, 273or ``wildcard'', addresses and ports appear as ``*''. 274You can use the 275.Xr fstat 1 276to find out which process or processes hold references to a socket. 277.Pp 278The interface display provides a table of cumulative 279statistics regarding packets transferred, errors, and collisions. 280The network addresses of the interface 281and the maximum transmission unit (``mtu'') are also displayed. 282.Pp 283The routing table display indicates the available routes and 284their status. 285Each route consists of a destination host or network 286and a gateway to use in forwarding packets. 287The flags field shows 288a collection of information about the route stored as 289binary choices. 290The individual flags are discussed in more 291detail in the 292.Xr route 8 293and 294.Xr route 4 295manual pages. 296The mapping between letters and flags is: 297.Bl -column XXXX RTF_BLACKHOLE 2981 RTF_PROTO1 Protocol specific routing flag #1 2992 RTF_PROTO2 Protocol specific routing flag #2 300B RTF_BLACKHOLE Just discard pkts (during updates) 301C RTF_CLONING Generate new routes on use 302c RTF_CLONED Cloned routes (generated from RTF_CLONING) 303D RTF_DYNAMIC Created dynamically (by redirect) 304G RTF_GATEWAY Destination requires forwarding by intermediary 305H RTF_HOST Host entry (net otherwise) 306L RTF_LLINFO Valid protocol to link address translation. 307M RTF_MODIFIED Modified dynamically (by redirect) 308R RTF_REJECT Host or net unreachable 309S RTF_STATIC Manually added 310U RTF_UP Route usable 311X RTF_XRESOLVE External daemon translates proto to link address 312.El 313.Pp 314Direct routes are created for each 315interface attached to the local host; 316the gateway field for such entries shows the address of the outgoing interface. 317The refcnt field gives the 318current number of active uses of the route. 319Connection oriented 320protocols normally hold on to a single route for the duration of 321a connection while connectionless protocols obtain a route while sending 322to the same destination. 323The use field provides a count of the number of packets 324sent using that route. 325The mtu entry shows the mtu associated with 326that route. 327This mtu value is used as the basis for the TCP maximum 328segment size. 329The 'L' flag appended to the mtu value indicates that 330the value is locked, and that path mtu discovery is turned off for 331that route. 332A 333.Sq - 334indicates that the mtu for this route has not been set, and a default 335TCP maximum segment size will be used. 336The interface entry indicates 337the network interface used for the route. 338.Pp 339When 340.Nm 341is invoked with the 342.Fl w 343option and a 344.Ar wait 345interval argument, it displays a running count of statistics related to 346network interfaces. 347An obsolescent version of this option used a numeric parameter 348with no option, and is currently supported for backward compatibility. 349This display consists of a column for the primary interface (the first 350interface found during autoconfiguration) and a column summarizing 351information for all interfaces. 352The primary interface may be replaced with another interface with the 353.Fl I 354option. 355The first line of each screen of information contains a summary since the 356system was last rebooted. 357Subsequent lines of output show values 358accumulated over the preceding interval. 359.Sh SEE ALSO 360.Xr fstat 1 , 361.Xr nfsstat 1 , 362.Xr ps 1 , 363.Xr vmstat 1 , 364.Xr inet 3 , 365.Xr hosts 5 , 366.Xr networks 5 , 367.Xr protocols 5 , 368.Xr services 5 , 369.Xr iostat 8 , 370.Xr trpt 8 , 371.Xr trsp 8 372.Sh HISTORY 373The 374.Nm 375command appeared in 376.Bx 4.2 . 377IPv6 support was added by WIDE/KAME project. 378.\" .Sh FILES 379.\" .Bl -tag -width /dev/kmem -compact 380.\" .It Pa /netbsd 381.\" default kernel namelist 382.\" .It Pa /dev/kmem 383.\" default memory file 384.\" .El 385.Sh BUGS 386The notion of errors is ill-defined. 387