1.\" $OpenBSD: netstat.1,v 1.54 2009/01/26 17:28:09 claudio Exp $ 2.\" $NetBSD: netstat.1,v 1.11 1995/10/03 21:42:43 thorpej Exp $ 3.\" 4.\" Copyright (c) 1983, 1990, 1992, 1993 5.\" The Regents of the University of California. All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. Neither the name of the University nor the names of its contributors 16.\" may be used to endorse or promote products derived from this software 17.\" without specific prior written permission. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" from: @(#)netstat.1 8.8 (Berkeley) 4/18/94 32.\" 33.Dd $Mdocdate: January 26 2009 $ 34.Dt NETSTAT 1 35.Os 36.Sh NAME 37.Nm netstat 38.Nd show network status 39.Sh SYNOPSIS 40.Nm netstat 41.Op Fl Aan 42.Op Fl f Ar address_family 43.Op Fl M Ar core 44.Op Fl N Ar system 45.Nm netstat 46.Bk -words 47.Op Fl bdFgilmnqrstu 48.Op Fl f Ar address_family 49.Op Fl M Ar core 50.Op Fl N Ar system 51.Op Fl T Ar tableid 52.Ek 53.Nm netstat 54.Op Fl bdn 55.Op Fl I Ar interface 56.Op Fl M Ar core 57.Op Fl N Ar system 58.Op Fl w Ar wait 59.Nm netstat 60.Op Fl M Ar core 61.Op Fl N Ar system 62.Fl P Ar pcbaddr 63.Nm netstat 64.Op Fl s 65.Op Fl M Ar core 66.Op Fl N Ar system 67.Op Fl p Ar protocol 68.Nm netstat 69.Op Fl a 70.Op Fl f Ar address_family 71.Op Fl i | I Ar interface 72.Nm netstat 73.Op Fl W Ar interface 74.Sh DESCRIPTION 75The 76.Nm 77command symbolically displays the contents of various network-related 78data structures. 79There are a number of output formats, 80depending on the options for the information presented. 81.Pp 82The first form of the command displays a list of active sockets for 83each protocol. 84The second form presents the contents of one of the other network 85data structures according to the option selected. 86Using the third form, with a 87.Ar wait 88interval specified, 89.Nm 90will continuously display the information regarding packet 91traffic on the configured network interfaces. 92The fourth form displays statistics about the protocol control block (PCB). 93The fifth form displays statistics about the named protocol. 94The sixth form displays per interface statistics for 95the specified address family. 96The final form displays per interface statistics for 97the specified wireless (802.11) device. 98.Pp 99The options are as follows: 100.Bl -tag -width Ds 101.It Fl A 102With the default display, 103show the address of any protocol control blocks associated with sockets; used 104for debugging, e.g. with the 105.Fl P 106flag. 107.It Fl a 108With the default display, 109show the state of all sockets; normally sockets used by 110server processes are not shown. 111With the interface display (options 112.Fl I 113or 114.Fl i ) , 115show multicast addresses. 116.It Fl b 117With the interface display (options 118.Fl I 119or 120.Fl i ) , 121show bytes in and out, instead of packet statistics. 122.It Fl d 123With either the interface display (options 124.Fl I 125or 126.Fl i ) 127or an interval (option 128.Fl w ) , 129show the number of dropped packets. 130.It Fl F 131When showing routes, only show routes whose gateway are in the 132same address family as the destination. 133.It Fl f Ar address_family 134Limit statistics or address control block reports to those 135of the specified 136.Ar address_family . 137.Pp 138The following address families are recognized: 139.Pp 140.Bl -column "Address Family" "AF_APPLETA" "Description" -offset indent -compact 141.It Sy "Address Family" Ta Sy "Constant" Ta Sy "Description" 142.It "inet" Ta Dv "AF_INET" Ta "IP Version 4" 143.It "inet6" Ta Dv "AF_INET6" Ta "IP Version 6" 144.It "atalk" Ta Dv "AF_APPLETALK" Ta "AppleTalk" 145.It "encap" Ta Dv "PF_KEY" Ta "IPsec" 146.It "local" Ta Dv "AF_LOCAL" Ta "Local to Host (i.e., pipes)" 147.It "unix" Ta Dv "AF_UNIX" Ta "Local to Host (i.e., pipes)" 148.El 149.Pp 150.It Fl g 151Show information related to multicast (group address) routing. 152By default, show the IP multicast virtual-interface and routing tables. 153If the 154.Fl s 155option is also present, show multicast routing statistics. 156.It Fl I Ar interface 157Show information about the specified 158.Ar interface ; 159used with a 160.Ar wait 161interval as described below. 162.Pp 163If the 164.Fl a 165option is also present, multicast addresses currently in use are shown 166for the given interface and for each IP interface address. 167Multicast addresses are shown on separate lines following the interface 168address with which they are associated. 169.Pp 170If the 171.Fl f Ar address_family 172option (with the 173.Fl s 174option) is present, show per-interface 175statistics on the given interface for the specified 176.Ar address_family . 177.It Fl i 178Show the state of interfaces which have been auto-configured 179(interfaces statically configured into a system but not 180located at boot-time are not shown). 181.Pp 182If the 183.Fl a 184option is also present, multicast addresses currently in use are shown 185for each Ethernet interface and for each IP interface address. 186Multicast addresses are shown on separate lines following the interface 187address with which they are associated. 188.Pp 189If the 190.Fl f Ar address_family 191option (with the 192.Fl s 193option) is present, show per-interface statistics on all interfaces 194for the specified 195.Ar address_family . 196.It Fl l 197With the 198.Fl g 199option, display wider fields for the IPv6 multicast routing table 200.Qq Origin 201and 202.Qq Group 203columns. 204.It Fl M Ar core 205Extract values associated with the name list from the specified core 206instead of the running kernel. 207.It Fl m 208Show statistics recorded by the memory management routines 209(the network manages a private pool of memory buffers). 210.It Fl N Ar system 211Extract the name list from the specified system instead of the running kernel. 212.It Fl n 213Show network addresses as numbers (normally 214.Nm 215interprets addresses and attempts to display them 216symbolically). 217This option may be used with any of the display formats. 218.It Fl P Ar pcbaddr 219Display the contents of the protocol control block (PCB) located at 220the kernel virtual address 221.Ar pcbaddr . 222PCB addresses can be obtained using the 223.Fl A 224flag. 225This option can currently only be used to display TCP control blocks. 226.It Fl p Ar protocol 227Restrict the output to 228.Ar protocol , 229which is either a well-known name for a protocol or an alias for it. 230Some protocol names and aliases are listed in the file 231.Pa /etc/protocols . 232The program will complain if 233.Ar protocol 234is unknown. 235If the 236.Fl s 237option is specified, the per-protocol statistics are displayed. 238Otherwise the states of the matching sockets are shown. 239.It Fl q 240Only show interfaces that have seen packets (or bytes if 241.Fl b 242is specified). 243.It Fl r 244Show the routing tables. 245If the 246.Fl s 247option is also specified, show routing statistics instead. 248.It Fl s 249Show per-protocol statistics. 250If this option is repeated, counters with a value of zero are suppressed. 251.It Fl T Ar tableid 252Select an alternate routing table to modify or query. 253Table 0 is the default table. 254.It Fl t 255With the 256.Fl i 257option, display the current value of the watchdog timer function. 258.It Fl u 259Limit statistics or address control block reports to the 260.Dv AF_UNIX 261address family. 262.It Fl v 263Be verbose. 264Avoids truncation of long addresses. 265.It Fl W Ar interface 266(IEEE 802.11 devices only) 267Show per-interface IEEE 802.11 wireless statistics. 268.It Fl w Ar wait 269Show network interface statistics at intervals of 270.Ar wait 271seconds. 272.El 273.Pp 274The default display, for active sockets, shows the local 275and remote addresses, send and receive queue sizes (in bytes), protocol, 276and the internal state of the protocol. 277.Pp 278Address formats are of the form 279.Dq host.port 280or 281.Dq network.port 282if a socket's address specifies a network but no specific host address. 283When known, the host and network addresses are displayed symbolically 284according to the databases 285.Pa /etc/hosts 286and 287.Pa /etc/networks , 288respectively. 289If a symbolic name for an address is unknown, or if the 290.Fl n 291option is specified, the address is printed numerically, according 292to the address family. 293.Pp 294For more information regarding the Internet 295.Dq dot format , 296refer to 297.Xr inet 3 . 298Unspecified or 299.Dq wildcard 300addresses and ports appear as a single 301.Sq * . 302If a local port number is registered as being in use for RPC by 303.Xr portmap 8 , 304its RPC service name or RPC service number will be printed in 305.Dq [] 306immediately after the port number. 307.Pp 308The interface display provides a table of cumulative 309statistics regarding packets transferred, errors, and collisions. 310The network addresses of the interface 311and the maximum transmission unit (MTU) are also displayed. 312.Pp 313The routing table display indicates the available routes and their status. 314Each route consists of a destination host or network and 315a gateway to use in forwarding packets. 316If the destination is a 317network in numeric format, the netmask (in /24 style format) is appended. 318The flags field shows a collection of information about 319the route stored as binary choices. 320The individual flags are discussed in more detail in the 321.Xr route 8 322and 323.Xr route 4 324manual pages. 325.Pp 326The mapping between letters and flags is: 327.Bl -column XXXX RTF_BLACKHOLE 3281 RTF_PROTO1 Protocol specific routing flag #1. 3292 RTF_PROTO2 Protocol specific routing flag #2. 3303 RTF_PROTO3 Protocol specific routing flag #3. 331B RTF_BLACKHOLE Just discard pkts (during updates). 332C RTF_CLONING Generate new routes on use. 333c RTF_CLONED Cloned routes (generated from RTF_CLONING). 334D RTF_DYNAMIC Created dynamically (by redirect). 335G RTF_GATEWAY Destination requires forwarding by intermediary. 336H RTF_HOST Host entry (net otherwise). 337L RTF_LLINFO Valid protocol to link address translation. 338M RTF_MODIFIED Modified dynamically (by redirect). 339P RTF_MPATH Multipath route. 340R RTF_REJECT Host or net unreachable. 341S RTF_STATIC Manually added. 342U RTF_UP Route usable. 343X RTF_XRESOLVE External daemon translates proto to link address. 344.El 345.Pp 346Direct routes are created for each interface attached to the local host; 347the gateway field for such entries shows the address of the outgoing interface. 348The refcnt field gives the current number of active uses of the route. 349Connection oriented protocols normally hold on to a single route for the 350duration of a connection while connectionless protocols obtain a route while 351sending to the same destination. 352The use field provides a count of the number of packets sent using that route. 353The MTU entry shows the MTU associated with that route. 354This MTU value is used as the basis for the TCP maximum segment size (MSS). 355The 356.Sq L 357flag appended to the MTU value indicates that the value is 358locked, and that path MTU discovery is turned off for that route. 359A 360.Sq - 361indicates that the MTU for this route has not been set, and a default 362TCP maximum segment size will be used. 363The interface entry indicates the network interface utilized for the route. 364.Pp 365When 366.Nm 367is invoked with the 368.Fl w 369option and a 370.Ar wait 371interval argument, it displays a running count of statistics related to 372network interfaces. 373An obsolescent version of this option used a numeric parameter 374with no option, and is currently supported for backward compatibility. 375This display consists of a column for the primary interface (the first 376interface found during autoconfiguration) and a column summarizing 377information for all interfaces. 378The primary interface may be replaced with another interface with the 379.Fl I 380option. 381The first line of each screen of information contains a summary since the 382system was last rebooted. 383Subsequent lines of output show values accumulated over the preceding interval. 384.Sh SEE ALSO 385.Xr fstat 1 , 386.Xr nfsstat 1 , 387.Xr ps 1 , 388.Xr systat 1 , 389.Xr tcpbench 1 , 390.Xr top 1 , 391.Xr inet 3 , 392.Xr netintro 4 , 393.Xr route 4 , 394.Xr hosts 5 , 395.Xr networks 5 , 396.Xr protocols 5 , 397.Xr services 5 , 398.Xr iostat 8 , 399.Xr portmap 8 , 400.Xr pstat 8 , 401.Xr route 8 , 402.Xr tcpdrop 8 , 403.Xr trpt 8 , 404.Xr vmstat 8 405.Sh HISTORY 406The 407.Nm 408command appeared in 409.Bx 4.2 . 410IPv6 support was added by WIDE/KAME project. 411.Sh BUGS 412The notion of errors is ill-defined. 413