1.\" $NetBSD: netstat.1,v 1.67 2013/10/18 22:18:14 bad Exp $ 2.\" 3.\" Copyright (c) 1983, 1990, 1992, 1993 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the University nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.\" @(#)netstat.1 8.8 (Berkeley) 4/18/94 31.\" 32.Dd October 19, 2013 33.Dt NETSTAT 1 34.Os 35.Sh NAME 36.Nm netstat 37.Nd show network status 38.Sh SYNOPSIS 39.ds address_family Fl f Ar address_family Ns Op , Ns Ar family ... 40.Nm 41.Op Fl Aan 42.Op \*[address_family] 43.Op Fl M Ar core 44.Op Fl N Ar system 45.Nm 46.Op Fl bdghiLlmnqrSsTtv 47.Op \*[address_family] 48.Op Fl M Ar core 49.Op Fl N Ar system 50.Nm 51.Op Fl dn 52.Op Fl I Ar interface 53.Op Fl M Ar core 54.Op Fl N Ar system 55.Op Fl w Ar wait 56.Nm 57.Op Fl M Ar core 58.Op Fl N Ar system 59.Op Fl p Ar protocol 60.Nm 61.Op Fl M Ar core 62.Op Fl N Ar system 63.Op Fl p Ar protocol 64.Fl P Ar pcbaddr 65.Nm 66.Op Fl i 67.Op Fl I Ar Interface 68.Op Fl p Ar protocol 69.Nm 70.Op Fl is 71.Op \*[address_family] 72.Op Fl I Ar Interface 73.Nm 74.Op Fl s 75.Op Fl I Ar Interface 76.Fl B 77.Sh DESCRIPTION 78The 79.Nm 80command symbolically displays the contents of various network-related 81data structures. 82There are a number of output formats, 83depending on the options for the information presented. 84The first form of the command displays a list of active sockets for 85each protocol. 86The second form presents the contents of one of the other network 87data structures according to the option selected. 88Using the third form, with a 89.Ar wait 90interval specified, 91.Nm 92will continuously display the information regarding packet 93traffic on the configured network interfaces. 94The fourth form displays statistics about the named protocol. 95The fifth and sixth forms display per interface statistics for 96the specified protocol or address family. 97.Pp 98The options have the following meaning: 99.Bl -tag -width flag 100.It Fl A 101With the default display, 102show the address of any protocol control blocks associated with sockets; used 103for debugging. 104.It Fl a 105With the default display, 106show the state of all sockets; normally sockets used by 107server processes are not shown. 108.It Fl B 109With the default display, 110show the current 111.Xr bpf 4 112peers. 113To show only the peers listening to a specific interface, 114use the 115.Fl I 116option. 117If the 118.Fl s 119option is present, show the current 120.Xr bpf 4 121statistics. 122.It Fl b 123With the interface display (option 124.Fl i ) , 125show bytes in and out, instead of packets in and out. 126.It Fl d 127With either interface display (option 128.Fl i 129or an interval, as described below), 130show the number of dropped packets. 131.It \*[address_family] 132Limit statistics or address control block reports to those 133of the specified 134.Ar address_families . 135The following address families 136are recognized: 137.Ar inet , 138for 139.Dv AF_INET ; 140.Ar inet6 , 141for 142.Dv AF_INET6 ; 143.Ar arp , 144for 145.Dv AF_ARP ; 146.Ar ns , 147for 148.Dv AF_NS ; 149.Ar atalk , 150for 151.Dv AF_APPLETALK ; 152.Ar mpls , 153for 154.Dv AF_MPLS ; 155and 156.Ar local 157or 158.Ar unix , 159for 160.Dv AF_LOCAL . 161.It Fl g 162Show information related to multicast (group address) routing. 163By default, show the IP Multicast virtual-interface and routing tables. 164If the 165.Fl s 166option is also present, show multicast routing statistics. 167.It Fl h 168When used with 169.Fl b 170in combination with either 171.Fl i 172or 173.Fl I , 174output "human-readable" byte counts. 175.It Fl I Ar interface 176Show information about the specified interface; 177used with a 178.Ar wait 179interval as described below. 180If the 181.Fl f Ar address_family 182option (with the 183.Fl s 184option) or the 185.Fl p Ar protocol 186option is present, show per-interface statistics on the 187.Ar interface 188for the specified 189.Ar address_family 190or 191.Ar protocol , 192respectively. 193.It Fl i 194Show the state of interfaces which have been auto-configured 195(interfaces statically configured into a system, but not 196located at boot time are not shown). 197If the 198.Fl a 199options is also present, multicast addresses currently in use are shown 200for each Ethernet interface and for each IP interface address. 201Multicast addresses are shown on separate lines following the interface 202address with which they are associated. 203If the 204.Fl f Ar address_family 205option (with the 206.Fl s 207option) or the 208.Fl p Ar protocol 209option is present, show per-interface statistics on all interfaces 210for the specified 211.Ar address_family 212or 213.Ar protocol , 214respectively. 215.It Fl L 216Don't show link-level routes (e.g., IPv4 ARP or IPv6 neighbour cache). 217.It Fl l 218With the 219.Fl g 220option, display wider fields for the IPv6 multicast routing table 221.Qq Origin 222and 223.Qq Group 224columns. 225.It Fl M 226Extract values associated with the name list from the specified core 227instead of the default 228.Pa /dev/kmem . 229.It Fl m 230Show statistics recorded by the mbuf memory management routines 231(the network manages a private pool of memory buffers). 232.It Fl N 233Extract the name list from the specified system instead of the default 234.Pa /netbsd . 235.It Fl n 236Show network addresses and ports as numbers (normally 237.Nm 238interprets addresses and ports and attempts to display them 239symbolically). 240This option may be used with any of the display formats. 241.It Fl P Ar pcbaddr 242Dump the contents of the protocol control block (PCB) located at kernel 243virtual address 244.Ar pcbaddr . 245This address may be obtained using the 246.Fl A 247flag. 248The default protocol is TCP, but may be overridden using the 249.Fl p 250flag. 251.It Fl p Ar protocol 252Show statistics about 253.Ar protocol , 254which is either a well-known name for a protocol or an alias for it. 255Some protocol names and aliases are listed in the file 256.Pa /etc/protocols . 257A null response typically means that there are no interesting numbers to 258report. 259The program will complain if 260.Ar protocol 261is unknown or if there is no statistics routine for it. 262.It Fl q 263Show software interrupt queue setting/statistics for all protocols. 264.It Fl r 265Show the routing tables. 266When 267.Fl s 268is also present, show routing statistics instead. 269.It Fl S 270Show network addresses as numbers (as with 271.Fl n , 272but show ports symbolically). 273.It Fl s 274Show per-protocol statistics. 275If this option is repeated, counters with a value of zero are suppressed. 276.It Fl T 277Show MPLS Tags for the routing tables. 278If multiple tags exists, they will 279be comma separated, first tag being the BoS one. 280.It Fl t 281With the 282.Fl i 283option, display the current value of the watchdog timer function. 284.It Fl v 285Show extra (verbose) detail for the routing tables 286.Pq Fl r , 287or avoid truncation of long addresses. 288.It Fl w Ar wait 289Show network interface statistics at intervals of 290.Ar wait 291seconds. 292.It Fl X 293Force use of 294.Xr sysctl 3 295when retrieving information. 296Some features of 297.Nm 298may not be (fully) supported when using 299.Xr sysctl 3 . 300This flag forces the use of the latter regardless, and emits a message if a 301not yet fully supported feature is used in conjunction with it. 302This flag might be removed at any time; do not rely on its presence. 303.El 304.Pp 305The default display, for active sockets, shows the local 306and remote addresses, send and receive queue sizes (in bytes), protocol, 307and the internal state of the protocol. 308Address formats are of the form ``host.port'' or ``network.port'' 309if a socket's address specifies a network but no specific host address. 310When known the host and network addresses are displayed symbolically 311according to the data bases 312.Pa /etc/hosts 313and 314.Pa /etc/networks , 315respectively. 316If a symbolic name for an address is unknown, or if 317the 318.Fl n 319option is specified, the address is printed numerically, according 320to the address family. 321For more information regarding 322the Internet ``dot format,'' 323refer to 324.Xr inet 3 ) . 325Unspecified, 326or ``wildcard'', addresses and ports appear as ``*''. 327You can use the 328.Xr fstat 1 329command to find out which process or processes hold references to a socket. 330.Pp 331The interface display provides a table of cumulative 332statistics regarding packets transferred, errors, and collisions. 333The network addresses of the interface 334and the maximum transmission unit (``mtu'') are also displayed. 335.Pp 336The routing table display indicates the available routes and 337their status. 338Each route consists of a destination host or network 339and a gateway to use in forwarding packets. 340The flags field shows 341a collection of information about the route stored as 342binary choices. 343The individual flags are discussed in more 344detail in the 345.Xr route 8 346and 347.Xr route 4 348manual pages. 349The mapping between letters and flags is: 350.Bl -column XXXX RTF_BLACKHOLE 351.It 1 RTF_PROTO1 Protocol specific routing flag #1 352.It 2 RTF_PROTO2 Protocol specific routing flag #2 353.It B RTF_BLACKHOLE Just discard pkts (during updates) 354.It C RTF_CLONING Generate new routes on use 355.It c RTF_CLONED Cloned routes (generated from RTF_CLONING) 356.It D RTF_DYNAMIC Created dynamically (by redirect) 357.It G RTF_GATEWAY Destination requires forwarding by intermediary 358.It H RTF_HOST Host entry (net otherwise) 359.It L RTF_LLINFO Valid protocol to link address translation. 360.It M RTF_MODIFIED Modified dynamically (by redirect) 361.It p RTF_ANNOUNCE Link level proxy 362.It R RTF_REJECT Host or net unreachable 363.It S RTF_STATIC Manually added 364.It U RTF_UP Route usable 365.It X RTF_XRESOLVE External daemon translates proto to link address 366.El 367.Pp 368Direct routes are created for each 369interface attached to the local host; 370the gateway field for such entries shows the address of the outgoing interface. 371The refcnt field gives the 372current number of active uses of the route. 373Connection oriented 374protocols normally hold on to a single route for the duration of 375a connection while connectionless protocols obtain a route while sending 376to the same destination. 377The use field provides a count of the number of packets 378sent using that route. 379The mtu entry shows the mtu associated with 380that route. 381This mtu value is used as the basis for the TCP maximum 382segment size. 383The 'L' flag appended to the mtu value indicates that 384the value is locked, and that path mtu discovery is turned off for 385that route. 386A 387.Sq - 388indicates that the mtu for this route has not been set, and a default 389TCP maximum segment size will be used. 390The interface entry indicates 391the network interface used for the route. 392.Pp 393When 394.Nm 395is invoked with the 396.Fl w 397option and a 398.Ar wait 399interval argument, it displays a running count of statistics related to 400network interfaces. 401An obsolescent version of this option used a numeric parameter 402with no option, and is currently supported for backward compatibility. 403This display consists of a column for the primary interface (the first 404interface found during autoconfiguration) and a column summarizing 405information for all interfaces. 406The primary interface may be replaced with another interface with the 407.Fl I 408option. 409The first line of each screen of information contains a summary since the 410system was last rebooted. 411Subsequent lines of output show values 412accumulated over the preceding interval. 413.Pp 414The first character of the flags column in the 415.Fl B 416option shows the status of the 417.Xr bpf 4 418descriptor which has three different values: 419Idle ('I'), Waiting ('W') and Timed Out ('T'). 420The second character indicates whether the promisc flag is set. 421The third character indicates the status of the immediate mode. 422The fourth character indicates whether the peer will have the ability 423to see the packets sent. 424And the fifth character shows the header complete flag status. 425.Sh SEE ALSO 426.Xr fstat 1 , 427.Xr nfsstat 1 , 428.Xr ps 1 , 429.Xr sockstat 1 , 430.Xr vmstat 1 , 431.Xr inet 3 , 432.Xr bpf 4 , 433.Xr hosts 5 , 434.Xr networks 5 , 435.Xr protocols 5 , 436.Xr services 5 , 437.Xr iostat 8 , 438.Xr trpt 8 439.Sh HISTORY 440The 441.Nm 442command appeared in 443.Bx 4.2 . 444IPv6 support was added by WIDE/KAME project. 445.\" .Sh FILES 446.\" .Bl -tag -width /dev/kmem -compact 447.\" .It Pa /netbsd 448.\" default kernel namelist 449.\" .It Pa /dev/kmem 450.\" default memory file 451.\" .El 452.Sh BUGS 453The notion of errors is ill-defined. 454