1.\" $NetBSD: netstat.1,v 1.66 2013/03/01 18:26:11 joerg Exp $ 2.\" 3.\" Copyright (c) 1983, 1990, 1992, 1993 4.\" The Regents of the University of California. All rights reserved. 5.\" 6.\" Redistribution and use in source and binary forms, with or without 7.\" modification, are permitted provided that the following conditions 8.\" are met: 9.\" 1. Redistributions of source code must retain the above copyright 10.\" notice, this list of conditions and the following disclaimer. 11.\" 2. Redistributions in binary form must reproduce the above copyright 12.\" notice, this list of conditions and the following disclaimer in the 13.\" documentation and/or other materials provided with the distribution. 14.\" 3. Neither the name of the University nor the names of its contributors 15.\" may be used to endorse or promote products derived from this software 16.\" without specific prior written permission. 17.\" 18.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 19.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 20.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 21.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 22.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 24.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 25.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 26.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 27.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 28.\" SUCH DAMAGE. 29.\" 30.\" @(#)netstat.1 8.8 (Berkeley) 4/18/94 31.\" 32.Dd February 5, 2013 33.Dt NETSTAT 1 34.Os 35.Sh NAME 36.Nm netstat 37.Nd show network status 38.Sh SYNOPSIS 39.Nm 40.Op Fl Aan 41.Op Fl f Ar address_family 42.Op Fl M Ar core 43.Op Fl N Ar system 44.Nm 45.Op Fl bdghiLlmnqrSsTtv 46.Op Fl f Ar address_family 47.Op Fl M Ar core 48.Op Fl N Ar system 49.Nm 50.Op Fl dn 51.Op Fl I Ar interface 52.Op Fl M Ar core 53.Op Fl N Ar system 54.Op Fl w Ar wait 55.Nm 56.Op Fl M Ar core 57.Op Fl N Ar system 58.Op Fl p Ar protocol 59.Nm 60.Op Fl M Ar core 61.Op Fl N Ar system 62.Op Fl p Ar protocol 63.Fl P Ar pcbaddr 64.Nm 65.Op Fl i 66.Op Fl I Ar Interface 67.Op Fl p Ar protocol 68.Nm 69.Op Fl is 70.Op Fl f Ar address_family 71.Op Fl I Ar Interface 72.Nm 73.Op Fl s 74.Op Fl I Ar Interface 75.Fl B 76.Sh DESCRIPTION 77The 78.Nm 79command symbolically displays the contents of various network-related 80data structures. 81There are a number of output formats, 82depending on the options for the information presented. 83The first form of the command displays a list of active sockets for 84each protocol. 85The second form presents the contents of one of the other network 86data structures according to the option selected. 87Using the third form, with a 88.Ar wait 89interval specified, 90.Nm 91will continuously display the information regarding packet 92traffic on the configured network interfaces. 93The fourth form displays statistics about the named protocol. 94The fifth and sixth forms display per interface statistics for 95the specified protocol or address family. 96.Pp 97The options have the following meaning: 98.Bl -tag -width flag 99.It Fl A 100With the default display, 101show the address of any protocol control blocks associated with sockets; used 102for debugging. 103.It Fl a 104With the default display, 105show the state of all sockets; normally sockets used by 106server processes are not shown. 107.It Fl B 108With the default display, 109show the current 110.Xr bpf 4 111peers. 112To show only the peers listening to a specific interface, 113use the 114.Fl I 115option. 116If the 117.Fl s 118option is present, show the current 119.Xr bpf 4 120statistics. 121.It Fl b 122With the interface display (option 123.Fl i ) , 124show bytes in and out, instead of packets in and out. 125.It Fl d 126With either interface display (option 127.Fl i 128or an interval, as described below), 129show the number of dropped packets. 130.It Fl f Ar address_family 131Limit statistics or address control block reports to those 132of the specified 133.Ar address_family . 134The following address families 135are recognized: 136.Ar inet , 137for 138.Dv AF_INET ; 139.Ar inet6 , 140for 141.Dv AF_INET6 ; 142.Ar arp , 143for 144.Dv AF_ARP ; 145.Ar ns , 146for 147.Dv AF_NS ; 148.Ar atalk , 149for 150.Dv AF_APPLETALK ; 151.Ar mpls , 152for 153.Dv AF_MPLS ; 154and 155.Ar local 156or 157.Ar unix , 158for 159.Dv AF_LOCAL . 160.It Fl g 161Show information related to multicast (group address) routing. 162By default, show the IP Multicast virtual-interface and routing tables. 163If the 164.Fl s 165option is also present, show multicast routing statistics. 166.It Fl h 167When used with 168.Fl b 169in combination with either 170.Fl i 171or 172.Fl I , 173output "human-readable" byte counts. 174.It Fl I Ar interface 175Show information about the specified interface; 176used with a 177.Ar wait 178interval as described below. 179If the 180.Fl f Ar address_family 181option (with the 182.Fl s 183option) or the 184.Fl p Ar protocol 185option is present, show per-interface statistics on the 186.Ar interface 187for the specified 188.Ar address_family 189or 190.Ar protocol , 191respectively. 192.It Fl i 193Show the state of interfaces which have been auto-configured 194(interfaces statically configured into a system, but not 195located at boot time are not shown). 196If the 197.Fl a 198options is also present, multicast addresses currently in use are shown 199for each Ethernet interface and for each IP interface address. 200Multicast addresses are shown on separate lines following the interface 201address with which they are associated. 202If the 203.Fl f Ar address_family 204option (with the 205.Fl s 206option) or the 207.Fl p Ar protocol 208option is present, show per-interface statistics on all interfaces 209for the specified 210.Ar address_family 211or 212.Ar protocol , 213respectively. 214.It Fl L 215Don't show link-level routes (e.g., IPv4 ARP or IPv6 neighbour cache). 216.It Fl l 217With the 218.Fl g 219option, display wider fields for the IPv6 multicast routing table 220.Qq Origin 221and 222.Qq Group 223columns. 224.It Fl M 225Extract values associated with the name list from the specified core 226instead of the default 227.Pa /dev/kmem . 228.It Fl m 229Show statistics recorded by the mbuf memory management routines 230(the network manages a private pool of memory buffers). 231.It Fl N 232Extract the name list from the specified system instead of the default 233.Pa /netbsd . 234.It Fl n 235Show network addresses and ports as numbers (normally 236.Nm 237interprets addresses and ports and attempts to display them 238symbolically). 239This option may be used with any of the display formats. 240.It Fl P Ar pcbaddr 241Dump the contents of the protocol control block (PCB) located at kernel 242virtual address 243.Ar pcbaddr . 244This address may be obtained using the 245.Fl A 246flag. 247The default protocol is TCP, but may be overridden using the 248.Fl p 249flag. 250.It Fl p Ar protocol 251Show statistics about 252.Ar protocol , 253which is either a well-known name for a protocol or an alias for it. 254Some protocol names and aliases are listed in the file 255.Pa /etc/protocols . 256A null response typically means that there are no interesting numbers to 257report. 258The program will complain if 259.Ar protocol 260is unknown or if there is no statistics routine for it. 261.It Fl q 262Show software interrupt queue setting/statistics for all protocols. 263.It Fl r 264Show the routing tables. 265When 266.Fl s 267is also present, show routing statistics instead. 268.It Fl S 269Show network addresses as numbers (as with 270.Fl n , 271but show ports symbolically). 272.It Fl s 273Show per-protocol statistics. 274If this option is repeated, counters with a value of zero are suppressed. 275.It Fl T 276Show MPLS Tags for the routing tables. 277If multiple tags exists, they will 278be comma separated, first tag being the BoS one. 279.It Fl t 280With the 281.Fl i 282option, display the current value of the watchdog timer function. 283.It Fl v 284Show extra (verbose) detail for the routing tables 285.Pq Fl r , 286or avoid truncation of long addresses. 287.It Fl w Ar wait 288Show network interface statistics at intervals of 289.Ar wait 290seconds. 291.It Fl X 292Force use of 293.Xr sysctl 3 294when retrieving information. 295Some features of 296.Nm 297may not be (fully) supported when using 298.Xr sysctl 3 . 299This flag forces the use of the latter regardless, and emits a message if a 300not yet fully supported feature is used in conjunction with it. 301This flag might be removed at any time; do not rely on its presence. 302.El 303.Pp 304The default display, for active sockets, shows the local 305and remote addresses, send and receive queue sizes (in bytes), protocol, 306and the internal state of the protocol. 307Address formats are of the form ``host.port'' or ``network.port'' 308if a socket's address specifies a network but no specific host address. 309When known the host and network addresses are displayed symbolically 310according to the data bases 311.Pa /etc/hosts 312and 313.Pa /etc/networks , 314respectively. 315If a symbolic name for an address is unknown, or if 316the 317.Fl n 318option is specified, the address is printed numerically, according 319to the address family. 320For more information regarding 321the Internet ``dot format,'' 322refer to 323.Xr inet 3 ) . 324Unspecified, 325or ``wildcard'', addresses and ports appear as ``*''. 326You can use the 327.Xr fstat 1 328command to find out which process or processes hold references to a socket. 329.Pp 330The interface display provides a table of cumulative 331statistics regarding packets transferred, errors, and collisions. 332The network addresses of the interface 333and the maximum transmission unit (``mtu'') are also displayed. 334.Pp 335The routing table display indicates the available routes and 336their status. 337Each route consists of a destination host or network 338and a gateway to use in forwarding packets. 339The flags field shows 340a collection of information about the route stored as 341binary choices. 342The individual flags are discussed in more 343detail in the 344.Xr route 8 345and 346.Xr route 4 347manual pages. 348The mapping between letters and flags is: 349.Bl -column XXXX RTF_BLACKHOLE 350.It 1 RTF_PROTO1 Protocol specific routing flag #1 351.It 2 RTF_PROTO2 Protocol specific routing flag #2 352.It B RTF_BLACKHOLE Just discard pkts (during updates) 353.It C RTF_CLONING Generate new routes on use 354.It c RTF_CLONED Cloned routes (generated from RTF_CLONING) 355.It D RTF_DYNAMIC Created dynamically (by redirect) 356.It G RTF_GATEWAY Destination requires forwarding by intermediary 357.It H RTF_HOST Host entry (net otherwise) 358.It L RTF_LLINFO Valid protocol to link address translation. 359.It M RTF_MODIFIED Modified dynamically (by redirect) 360.It p RTF_ANNOUNCE Link level proxy 361.It R RTF_REJECT Host or net unreachable 362.It S RTF_STATIC Manually added 363.It U RTF_UP Route usable 364.It X RTF_XRESOLVE External daemon translates proto to link address 365.El 366.Pp 367Direct routes are created for each 368interface attached to the local host; 369the gateway field for such entries shows the address of the outgoing interface. 370The refcnt field gives the 371current number of active uses of the route. 372Connection oriented 373protocols normally hold on to a single route for the duration of 374a connection while connectionless protocols obtain a route while sending 375to the same destination. 376The use field provides a count of the number of packets 377sent using that route. 378The mtu entry shows the mtu associated with 379that route. 380This mtu value is used as the basis for the TCP maximum 381segment size. 382The 'L' flag appended to the mtu value indicates that 383the value is locked, and that path mtu discovery is turned off for 384that route. 385A 386.Sq - 387indicates that the mtu for this route has not been set, and a default 388TCP maximum segment size will be used. 389The interface entry indicates 390the network interface used for the route. 391.Pp 392When 393.Nm 394is invoked with the 395.Fl w 396option and a 397.Ar wait 398interval argument, it displays a running count of statistics related to 399network interfaces. 400An obsolescent version of this option used a numeric parameter 401with no option, and is currently supported for backward compatibility. 402This display consists of a column for the primary interface (the first 403interface found during autoconfiguration) and a column summarizing 404information for all interfaces. 405The primary interface may be replaced with another interface with the 406.Fl I 407option. 408The first line of each screen of information contains a summary since the 409system was last rebooted. 410Subsequent lines of output show values 411accumulated over the preceding interval. 412.Pp 413The first character of the flags column in the 414.Fl B 415option shows the status of the 416.Xr bpf 4 417descriptor which has three different values: 418Idle ('I'), Waiting ('W') and Timed Out ('T'). 419The second character indicates whether the promisc flag is set. 420The third character indicates the status of the immediate mode. 421The fourth character indicates whether the peer will have the ability 422to see the packets sent. 423And the fifth character shows the header complete flag status. 424.Sh SEE ALSO 425.Xr fstat 1 , 426.Xr nfsstat 1 , 427.Xr ps 1 , 428.Xr sockstat 1 , 429.Xr vmstat 1 , 430.Xr inet 3 , 431.Xr bpf 4 , 432.Xr hosts 5 , 433.Xr networks 5 , 434.Xr protocols 5 , 435.Xr services 5 , 436.Xr iostat 8 , 437.Xr trpt 8 438.Sh HISTORY 439The 440.Nm 441command appeared in 442.Bx 4.2 . 443IPv6 support was added by WIDE/KAME project. 444.\" .Sh FILES 445.\" .Bl -tag -width /dev/kmem -compact 446.\" .It Pa /netbsd 447.\" default kernel namelist 448.\" .It Pa /dev/kmem 449.\" default memory file 450.\" .El 451.Sh BUGS 452The notion of errors is ill-defined. 453