1.\" $OpenBSD: netstat.1,v 1.78 2016/07/13 08:40:46 mpi Exp $ 2.\" $NetBSD: netstat.1,v 1.11 1995/10/03 21:42:43 thorpej Exp $ 3.\" 4.\" Copyright (c) 1983, 1990, 1992, 1993 5.\" The Regents of the University of California. All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. Neither the name of the University nor the names of its contributors 16.\" may be used to endorse or promote products derived from this software 17.\" without specific prior written permission. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" from: @(#)netstat.1 8.8 (Berkeley) 4/18/94 32.\" 33.Dd $Mdocdate: July 13 2016 $ 34.Dt NETSTAT 1 35.Os 36.Sh NAME 37.Nm netstat 38.Nd show network status 39.Sh SYNOPSIS 40.Nm netstat 41.Op Fl AaBn 42.Op Fl f Ar address_family 43.Op Fl p Ar protocol 44.Op Fl M Ar core 45.Op Fl N Ar system 46.Nm netstat 47.Bk -words 48.Op Fl bdFgilmnqrstu 49.Op Fl f Ar address_family 50.Op Fl p Ar protocol 51.Op Fl M Ar core 52.Op Fl N Ar system 53.Op Fl T Ar tableid 54.Ek 55.Nm netstat 56.Op Fl bdhn 57.Op Fl c Ar count 58.Op Fl I Ar interface 59.Op Fl M Ar core 60.Op Fl N Ar system 61.Op Fl w Ar wait 62.Nm netstat 63.Op Fl v 64.Op Fl M Ar core 65.Op Fl N Ar system 66.Fl P Ar pcbaddr 67.Nm netstat 68.Op Fl s 69.Op Fl M Ar core 70.Op Fl N Ar system 71.Op Fl p Ar protocol 72.Nm netstat 73.Op Fl a 74.Op Fl f Ar address_family 75.Op Fl p Ar protocol 76.Op Fl i | I Ar interface 77.Nm netstat 78.Op Fl W Ar interface 79.Sh DESCRIPTION 80The 81.Nm 82command symbolically displays the contents of various network-related 83data structures. 84There are a number of output formats, 85depending on the options for the information presented. 86.Pp 87The first form of the command displays a list of active sockets for 88each protocol. 89The second form presents the contents of one of the other network 90data structures according to the option selected. 91Using the third form, with a 92.Ar wait 93interval specified, 94.Nm 95will continuously display the information regarding packet 96traffic on the configured network interfaces. 97The fourth form displays internals of the protocol control block (PCB) 98and the socket structure. 99The fifth form displays statistics about the named protocol. 100The sixth form displays per interface statistics for 101the specified address family. 102The final form displays per interface statistics for 103the specified wireless (802.11) device. 104.Pp 105The options are as follows: 106.Bl -tag -width Ds 107.It Fl A 108Show the address of any protocol control blocks associated with sockets; 109useful for debugging e.g. with the 110.Fl P 111flag. 112When used with the 113.Fl r 114flag it shows the internal addresses of the routing table. 115Only the super-user can see these addresses; 116unprivileged users will see them as 0x0. 117.It Fl a 118With the default display, 119show the state of all sockets; normally sockets used by 120server processes are not shown. 121.It Fl B 122With the default display, 123show buffer sizes for TCP sockets. 124This includes the send window size, receive window size and congestion 125window size. 126.It Fl b 127With the interface display (options 128.Fl I 129or 130.Fl i ) , 131show bytes in and out, instead of packet statistics. 132.It Fl c Ar count 133Display 134.Ar count 135updates, then exit. 136This option has no effect unless 137.Fl w 138is specified as well. 139.It Fl d 140With either the interface display (options 141.Fl I 142or 143.Fl i ) 144or an interval (option 145.Fl w ) , 146show the number of dropped packets. 147.It Fl F 148When showing routes, only show routes whose gateway are in the 149same address family as the destination. 150.It Fl f Ar address_family 151Limit statistics or address control block reports to those 152of the specified 153.Ar address_family . 154.Pp 155The following address families are recognized: 156.Bl -column "Address Family" "AF_APPLETA" "Description" -offset indent 157.It Sy "Address Family" Ta Sy "Constant" Ta Sy "Description" 158.It "inet" Ta Dv "AF_INET" Ta "IP Version 4" 159.It "inet6" Ta Dv "AF_INET6" Ta "IP Version 6" 160.It "local" Ta Dv "AF_LOCAL" Ta "Local to Host (i.e., pipes)" 161.It "mpls" Ta Dv "AF_MPLS" Ta "MPLS" 162.It "unix" Ta Dv "AF_UNIX" Ta "Local to Host (i.e., pipes)" 163.El 164.It Fl h 165Use unit suffixes to reduce the number of digits shown with the 166.Fl b 167and 168.Fl w 169options. 170.It Fl g 171Show information related to multicast (group address) routing. 172By default, show the IP multicast virtual-interface and routing tables. 173If the 174.Fl s 175option is also present, show multicast routing statistics. 176.It Fl I Ar interface 177Show information about the specified 178.Ar interface ; 179used with a 180.Ar wait 181interval as described below. 182.Pp 183If the 184.Fl f Ar address_family 185option (with the 186.Fl s 187option) is present, show per-interface 188statistics on the given interface for the specified 189.Ar address_family . 190.It Fl i 191Show the state of interfaces which have been auto-configured 192(interfaces statically configured into a system but not 193located at boot-time are not shown). 194.Pp 195If the 196.Fl f Ar address_family 197option (with the 198.Fl s 199option) is present, show per-interface statistics on all interfaces 200for the specified 201.Ar address_family . 202.It Fl l 203With the 204.Fl g 205option, display wider fields for the IPv6 multicast routing table 206.Qq Origin 207and 208.Qq Group 209columns. 210.It Fl M Ar core 211Extract values associated with the name list from the specified core 212instead of the running kernel. 213.It Fl m 214Show statistics recorded by the memory management routines 215(the network manages a private pool of memory buffers). 216.It Fl N Ar system 217Extract the name list from the specified system instead of the running kernel. 218.It Fl n 219Show network addresses as numbers (normally 220.Nm 221interprets addresses and attempts to display them 222symbolically). 223This option may be used with any of the display formats. 224.It Fl P Ar pcbaddr 225Display the contents of the protocol control block (PCB) 226located at the kernel virtual address 227.Ar pcbaddr . 228PCB addresses can be obtained using the 229.Fl A 230flag. 231When used with the 232.Fl v 233option, also print socket, domain and protocol specific structures. 234Only the super-user can use the 235.Fl P 236option. 237.It Fl p Ar protocol 238Restrict the output to 239.Ar protocol , 240which is either a well-known name for a protocol or an alias for it. 241Some protocol names and aliases are listed in the file 242.Pa /etc/protocols . 243The program will complain if 244.Ar protocol 245is unknown. 246If the 247.Fl s 248option is specified, the per-protocol statistics are displayed. 249Otherwise the states of the matching sockets are shown. 250.It Fl q 251Only show interfaces that have seen packets (or bytes if 252.Fl b 253is specified). 254.It Fl r 255Show the routing tables. 256If the 257.Fl s 258option is also specified, show routing statistics instead. 259When used with the 260.Fl v 261option, also print routing labels. 262.It Fl s 263Show per-protocol statistics. 264If this option is repeated, counters with a value of zero are suppressed. 265.It Fl T Ar tableid 266Select an alternate routing table to query. 267The default is to use the current routing table. 268.It Fl t 269With the 270.Fl i 271option, display the current value of the watchdog timer function. 272.It Fl u 273Limit statistics or address control block reports to the 274.Dv AF_UNIX 275address family. 276.It Fl v 277Show extra (verbose) detail for the routing tables 278.Pq Fl r , 279or avoid truncation of long addresses. 280When used with the 281.Fl P 282option, also print socket, domain and protocol specific structures. 283.It Fl W Ar interface 284(IEEE 802.11 devices only) 285Show per-interface IEEE 802.11 wireless statistics. 286.It Fl w Ar wait 287Show network interface statistics at intervals of 288.Ar wait 289seconds. 290.El 291.Pp 292The default display, for active sockets, shows the local 293and remote addresses, send and receive queue sizes (in bytes), protocol, 294and the internal state of the protocol. 295.Pp 296Address formats are of the form 297.Dq host.port 298or 299.Dq network.port 300if a socket's address specifies a network but no specific host address. 301When known, the host addresses are displayed symbolically 302according to the 303.Xr hosts 5 304database. 305If a symbolic name for an address is unknown, or if the 306.Fl n 307option is specified, the address is printed numerically, according 308to the address family. 309.Pp 310For more information regarding the Internet 311.Dq dot format , 312refer to 313.Xr inet_ntop 3 . 314Unspecified or 315.Dq wildcard 316addresses and ports appear as a single 317.Sq * . 318If a local port number is registered as being in use for RPC by 319.Xr portmap 8 , 320its RPC service name or RPC service number will be printed in 321.Dq [] 322immediately after the port number. 323.Pp 324The interface display provides a table of cumulative 325statistics regarding packets transferred, errors, and collisions. 326The network addresses of the interface 327and the maximum transmission unit (MTU) are also displayed. 328.Pp 329The routing table display indicates the available routes and their status. 330Each route consists of a destination host or network and 331a gateway to use in forwarding packets. 332If the destination is a 333network in numeric format, the netmask (in /24 style format) is appended. 334The flags field shows a collection of information about 335the route stored as binary choices. 336The individual flags are discussed in more detail in the 337.Xr route 8 338and 339.Xr route 4 340manual pages. 341.Pp 342The mapping between letters and flags is: 343.Bl -column "1" "RTF_BLACKHOLE" "Protocol specific routing flag #1." 344.It 1 Ta RTF_PROTO1 Ta "Protocol specific routing flag #1." 345.It 2 Ta RTF_PROTO2 Ta "Protocol specific routing flag #2." 346.It 3 Ta RTF_PROTO3 Ta "Protocol specific routing flag #3." 347.It B Ta RTF_BLACKHOLE Ta "Just discard pkts (during updates)." 348.It b Ta RTF_BROADCAST Ta "Correspond to a local broadcast address." 349.It C Ta RTF_CLONING Ta "Generate new routes on use." 350.It c Ta RTF_CLONED Ta "Cloned routes (generated from RTF_CLONING)." 351.It D Ta RTF_DYNAMIC Ta "Created dynamically (by redirect)." 352.It G Ta RTF_GATEWAY Ta "Destination requires forwarding by intermediary." 353.It H Ta RTF_HOST Ta "Host entry (net otherwise)." 354.It L Ta RTF_LLINFO Ta "Valid protocol to link address translation." 355.It l Ta RTF_LOCAL Ta "Correspond to a local address." 356.It M Ta RTF_MODIFIED Ta "Modified dynamically (by redirect)." 357.It m Ta RTF_MULTICAST Ta "Correspond to a multicast address." 358.It P Ta RTF_MPATH Ta "Multipath route." 359.It R Ta RTF_REJECT Ta "Host or net unreachable." 360.It S Ta RTF_STATIC Ta "Manually added." 361.It T Ta RTF_MPLS Ta "MPLS route." 362.It U Ta RTF_UP Ta "Route usable." 363.El 364.Pp 365Direct routes are created for each interface attached to the local host; 366the gateway field for such entries shows the address of the outgoing interface. 367The refcnt field gives the current number of active uses of the route. 368Connection oriented protocols normally hold on to a single route for the 369duration of a connection while connectionless protocols obtain a route while 370sending to the same destination. 371The use field provides a count of the number of packets sent using that route. 372The MTU entry shows the MTU associated with that route. 373This MTU value is used as the basis for the TCP maximum segment size (MSS). 374The 375.Sq L 376flag appended to the MTU value indicates that the value is 377locked, and that path MTU discovery is turned off for that route. 378A 379.Sq - 380indicates that the MTU for this route has not been set, and a default 381TCP maximum segment size will be used. 382The interface entry indicates the network interface utilized for the route. 383.Pp 384When 385.Nm 386is invoked with the 387.Fl w 388option and a 389.Ar wait 390interval argument, it displays a running count of statistics related to 391network interfaces. 392An obsolescent version of this option used a numeric parameter 393with no option, and is currently supported for backward compatibility. 394This display consists of a column for the primary interface (the first 395interface found during autoconfiguration) and a column summarizing 396information for all interfaces. 397The primary interface may be replaced with another interface with the 398.Fl I 399option. 400The first line of each screen of information contains a summary since the 401system was last rebooted. 402Subsequent lines of output show values accumulated over the preceding interval. 403.Sh SEE ALSO 404.Xr fstat 1 , 405.Xr nfsstat 1 , 406.Xr ps 1 , 407.Xr systat 1 , 408.Xr tcpbench 1 , 409.Xr top 1 , 410.Xr inet_ntop 3 , 411.Xr netintro 4 , 412.Xr route 4 , 413.Xr hosts 5 , 414.Xr protocols 5 , 415.Xr services 5 , 416.Xr iostat 8 , 417.Xr portmap 8 , 418.Xr pstat 8 , 419.Xr route 8 , 420.Xr tcpdrop 8 , 421.Xr trpt 8 , 422.Xr vmstat 8 423.Sh HISTORY 424The 425.Nm 426command appeared in 427.Bx 4.2 . 428IPv6 support was added by the WIDE/KAME project. 429.Sh BUGS 430The notion of errors is ill-defined. 431