1.\" $OpenBSD: netstat.1,v 1.27 2001/11/09 00:56:24 miod Exp $ 2.\" $NetBSD: netstat.1,v 1.11 1995/10/03 21:42:43 thorpej Exp $ 3.\" 4.\" Copyright (c) 1983, 1990, 1992, 1993 5.\" The Regents of the University of California. All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. All advertising materials mentioning features or use of this software 16.\" must display the following acknowledgement: 17.\" This product includes software developed by the University of 18.\" California, Berkeley and its contributors. 19.\" 4. Neither the name of the University nor the names of its contributors 20.\" may be used to endorse or promote products derived from this software 21.\" without specific prior written permission. 22.\" 23.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 24.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 25.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 26.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 27.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 28.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 29.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 30.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 31.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 32.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 33.\" SUCH DAMAGE. 34.\" 35.\" from: @(#)netstat.1 8.8 (Berkeley) 4/18/94 36.\" 37.Dd April 18, 1994 38.Dt NETSTAT 1 39.Os 40.Sh NAME 41.Nm netstat 42.Nd show network status 43.Sh SYNOPSIS 44.Nm netstat 45.Op Fl Aan 46.Op Fl f Ar address_family 47.Op Fl M Ar core 48.Op Fl N Ar system 49.Nm netstat 50.Op Fl bdgimnqrs 51.Op Fl f Ar address_family 52.Op Fl M Ar core 53.Op Fl N Ar system 54.Nm netstat 55.Op Fl bdn 56.Op Fl I Ar interface 57.Op Fl M Ar core 58.Op Fl N Ar system 59.Op Fl w Ar wait 60.Nm netstat 61.Op Fl p Ar protocol 62.Op Fl M Ar core 63.Op Fl N Ar system 64.Nm netstat 65.Op Fl p Ar protocol 66.Op Fl i 67.Op Fl I Ar Interface 68.Nm netstat 69.Op Fl s 70.Op Fl f Ar address_family 71.Op Fl i 72.Op Fl I Ar Interface 73.Sh DESCRIPTION 74The 75.Nm 76command symbolically displays the contents of various network-related 77data structures. 78There are a number of output formats, 79depending on the options for the information presented. 80.Pp 81The first form of the command displays a list of active sockets for 82each protocol. 83The second form presents the contents of one of the other network 84data structures according to the option selected. 85Using the third form, with a 86.Ar wait 87interval specified, 88.Nm 89will continuously display the information regarding packet 90traffic on the configured network interfaces. 91The fourth form displays statistics about the named protocol. 92The fifth and sixth forms display per interface statistics for 93the specified protocol or address family. 94.Pp 95The options are as follows: 96.Bl -tag -width Ds 97.It Fl A 98With the default display, 99show the address of any protocol control blocks associated with sockets; used 100for debugging. 101.It Fl a 102With the default display, 103show the state of all sockets; normally sockets used by 104server processes are not shown. 105.It Fl b 106With the interface display (option 107.Fl i ) , 108show bytes in and out, instead of packet statistics. 109.It Fl d 110With either interface display (option 111.Fl i 112or an interval, as described below), 113show the number of dropped packets. 114.It Fl f Ar address_family 115Limit statistics or address control block reports to those 116of the specified 117.Ar address_family . 118.Pp 119The following address families are recognized: 120.Pp 121.Bl -column "Address Family" "AF_APPLETA" "Description" -offset indent -compact 122.It Sy "Address Family" Ta Sy "Constant" Ta Sy "Description" 123.It "inet" Dv Ta "AF_INET" Ta "IP Version 4" 124.It "inet6" Dv Ta "AF_INET6" Ta "IP Version 6" 125.It "ipx" Dv Ta "AF_IPX" Ta "Novell IPX" 126.It "atalk" Dv Ta "AF_APPLETALK" Ta "AppleTalk" 127.It "ns" Dv Ta "AF_NS" Ta "Xerox NS Protocols" 128.It "iso" Dv Ta "AF_ISO" Ta "ISO Protocol Family" 129.It "encap" Dv Ta "PF_KEY" Ta "IPsec" 130.It "local" Dv Ta "AF_LOCAL" Ta "Local to Host (i.e., pipes)" 131.It "unix" Dv Ta "AF_UNIX" Ta "Local to Host (i.e., pipes)" 132.El 133.Pp 134.It Fl g 135Show information related to multicast (group address) routing. 136By default, show the IP Multicast virtual-interface and routing tables. 137If the 138.Fl s 139option is also present, show multicast routing statistics. 140.It Fl I Ar interface 141Show information about the specified 142.Ar interface ; 143used with a 144.Ar wait 145interval as described below. 146.Pp 147If the 148.Fl f Ar address_family 149option (with the 150.Fl s 151option) or the 152.Fl p Ar protocol 153option is present, show per-interface statistics on the given interface 154for the specified 155.Ar address_family 156or 157.Ar protocol , 158respectively. 159.It Fl i 160Show the state of interfaces which have been auto-configured 161(interfaces statically configured into a system but not 162located at boot-time are not shown). 163.Pp 164If the 165.Fl a 166option is also present, multicast addresses currently in use are shown 167for each Ethernet interface and for each IP interface address. 168Multicast addresses are shown on separate lines following the interface 169address with which they are associated. 170.Pp 171If the 172.Fl f Ar address_family 173option (with the 174.Fl s 175option) or the 176.Fl p Ar protocol 177option is present, show per-interface statistics on all interfaces 178for the specified 179.Ar address_family 180or 181.Ar protocol , 182respectively. 183.It Fl M Ar core 184Extract values associated with the name list from the specified core 185instead of the running kernel. 186.It Fl m 187Show statistics recorded by the memory management routines 188(the network manages a private pool of memory buffers). 189.It Fl N Ar system 190Extract the name list from the specified system instead of the running kernel. 191.It Fl n 192Show network addresses as numbers (normally 193.Nm 194interprets addresses and attempts to display them 195symbolically). 196This option may be used with any of the display formats. 197.It Fl p Ar protocol 198Show statistics about 199.Ar protocol , 200which is either a well-known name for a protocol or an alias for it. 201Some protocol names and aliases are listed in the file 202.Pa /etc/protocols . 203A null response typically means that there are no interesting numbers to 204report. 205The program will complain if 206.Ar protocol 207is unknown or if there is no statistics routine for it. 208.It Fl q 209Only show interfaces that have seen packets (or bytes if 210.Fl b 211is specified) 212.It Fl r 213Show the routing tables. 214If the 215.Fl s 216option is also specified, show routing statistics instead. 217.It Fl s 218Show per-protocol statistics. 219If this option is repeated, counters with a value of zero are suppressed. 220.It Fl v 221Be verbose. 222Avoids truncation of long addresses. 223.It Fl w Ar wait 224Show network interface statistics at intervals of 225.Ar wait 226seconds. 227.El 228.Pp 229The default display, for active sockets, shows the local 230and remote addresses, send and receive queue sizes (in bytes), protocol, 231and the internal state of the protocol. 232.Pp 233Address formats are of the form 234.Dq host.port 235or 236.Dq network.port 237if a socket's address specifies a network but no specific host address. 238When known, the host and network addresses are displayed symbolically 239according to the databases 240.Pa /etc/hosts 241and 242.Pa /etc/networks , 243respectively. 244If a symbolic name for an address is unknown, or if the 245.Fl n 246option is specified, the address is printed numerically, according 247to the address family. 248.Pp 249For more information regarding the Internet 250.Dq dot format , 251refer to 252.Xr inet 3 . 253Unspecified, or 254.Dq wildcard 255addresses and ports appear as a single 256.Dq \&* . 257If a local port number is registered as being in use for RPC by 258.Xr portmap 8 , 259its RPC service name or RPC service number will be printed in 260.Dq [] 261immediately after the port number. 262.Pp 263The interface display provides a table of cumulative 264statistics regarding packets transferred, errors, and collisions. 265The network addresses of the interface 266and the maximum transmission unit (MTU) are also displayed. 267.Pp 268The routing table display indicates the available routes and their status. 269Each route consists of a destination host or network and 270a gateway to use in forwarding packets. 271If the destination is a 272network in numeric format, the netmask (in /24 style format) is appended. 273The flags field shows a collection of information about 274the route stored as binary choices. 275The individual flags are discussed in more detail in the 276.Xr route 8 277and 278.Xr route 4 279manual pages. 280.Pp 281The mapping between letters and flags is: 282.Bl -column XXXX RTF_BLACKHOLE 2831 RTF_PROTO1 Protocol specific routing flag #1. 2842 RTF_PROTO2 Protocol specific routing flag #2. 2853 RTF_PROTO3 Protocol specific routing flag #3. 286B RTF_BLACKHOLE Just discard pkts (during updates). 287C RTF_CLONING Generate new routes on use. 288D RTF_DYNAMIC Created dynamically (by redirect). 289G RTF_GATEWAY Destination requires forwarding by intermediary. 290H RTF_HOST Host entry (net otherwise). 291L RTF_LLINFO Valid protocol to link address translation. 292M RTF_MODIFIED Modified dynamically (by redirect). 293R RTF_REJECT Host or net unreachable. 294S RTF_STATIC Manually added. 295U RTF_UP Route usable. 296X RTF_XRESOLVE External daemon translates proto to link address. 297.El 298.Pp 299Direct routes are created for each interface attached to the local host; 300the gateway field for such entries shows the address of the outgoing interface. 301The refcnt field gives the current number of active uses of the route. 302Connection oriented protocols normally hold on to a single route for the 303duration of a connection while connectionless protocols obtain a route while 304sending to the same destination. 305The use field provides a count of the number of packets sent using that route. 306The MTU entry shows the MTU associated with that route. 307This MTU value is used as the basis for the TCP maximum segment size (MSS). 308The 'L' flag appended to the mtu value indicates that the value is 309locked, and that path mtu discovery is turned off for that route. 310A 311.Sq - 312indicates that the MTU for this route has not been set, and a default 313TCP maximum segment size will be used. 314The interface entry indicates the network interface utilized for the route. 315.Pp 316When 317.Nm 318is invoked with the 319.Fl w 320option and a 321.Ar wait 322interval argument, it displays a running count of statistics related to 323network interfaces. 324An obsolescent version of this option used a numeric parameter 325with no option, and is currently supported for backward compatibility. 326This display consists of a column for the primary interface (the first 327interface found during autoconfiguration) and a column summarizing 328information for all interfaces. 329The primary interface may be replaced with another interface with the 330.Fl I 331option. 332The first line of each screen of information contains a summary since the 333system was last rebooted. 334Subsequent lines of output show values accumulated over the preceding interval. 335.Sh SEE ALSO 336.Xr nfsstat 1 , 337.Xr ps 1 , 338.Xr netintro 4 , 339.Xr hosts 5 , 340.Xr networks 5 , 341.Xr protocols 5 , 342.Xr services 5 , 343.Xr iostat 8 , 344.Xr trpt 8 , 345.Xr trsp 8 , 346.Xr vmstat 8 347.Sh HISTORY 348The 349.Nm 350command appeared in 351.Bx 4.2 . 352IPv6 support was added by WIDE/KAME project. 353.Sh BUGS 354The notion of errors is ill-defined. 355