1.\" $OpenBSD: netstat.1,v 1.56 2009/06/27 11:35:57 michele Exp $ 2.\" $NetBSD: netstat.1,v 1.11 1995/10/03 21:42:43 thorpej Exp $ 3.\" 4.\" Copyright (c) 1983, 1990, 1992, 1993 5.\" The Regents of the University of California. All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. Neither the name of the University nor the names of its contributors 16.\" may be used to endorse or promote products derived from this software 17.\" without specific prior written permission. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" from: @(#)netstat.1 8.8 (Berkeley) 4/18/94 32.\" 33.Dd $Mdocdate: June 27 2009 $ 34.Dt NETSTAT 1 35.Os 36.Sh NAME 37.Nm netstat 38.Nd show network status 39.Sh SYNOPSIS 40.Nm netstat 41.Op Fl Aan 42.Op Fl f Ar address_family 43.Op Fl M Ar core 44.Op Fl N Ar system 45.Nm netstat 46.Bk -words 47.Op Fl bdFgilmnqrstu 48.Op Fl f Ar address_family 49.Op Fl M Ar core 50.Op Fl N Ar system 51.Op Fl T Ar tableid 52.Ek 53.Nm netstat 54.Op Fl bdn 55.Op Fl I Ar interface 56.Op Fl M Ar core 57.Op Fl N Ar system 58.Op Fl w Ar wait 59.Nm netstat 60.Op Fl M Ar core 61.Op Fl N Ar system 62.Fl P Ar pcbaddr 63.Nm netstat 64.Op Fl s 65.Op Fl M Ar core 66.Op Fl N Ar system 67.Op Fl p Ar protocol 68.Nm netstat 69.Op Fl a 70.Op Fl f Ar address_family 71.Op Fl i | I Ar interface 72.Nm netstat 73.Op Fl W Ar interface 74.Sh DESCRIPTION 75The 76.Nm 77command symbolically displays the contents of various network-related 78data structures. 79There are a number of output formats, 80depending on the options for the information presented. 81.Pp 82The first form of the command displays a list of active sockets for 83each protocol. 84The second form presents the contents of one of the other network 85data structures according to the option selected. 86Using the third form, with a 87.Ar wait 88interval specified, 89.Nm 90will continuously display the information regarding packet 91traffic on the configured network interfaces. 92The fourth form displays statistics about the protocol control block (PCB). 93The fifth form displays statistics about the named protocol. 94The sixth form displays per interface statistics for 95the specified address family. 96The final form displays per interface statistics for 97the specified wireless (802.11) device. 98.Pp 99The options are as follows: 100.Bl -tag -width Ds 101.It Fl A 102With the default display, 103show the address of any protocol control blocks associated with sockets; used 104for debugging, e.g. with the 105.Fl P 106flag. 107.It Fl a 108With the default display, 109show the state of all sockets; normally sockets used by 110server processes are not shown. 111With the interface display (options 112.Fl I 113or 114.Fl i ) , 115show multicast addresses. 116.It Fl b 117With the interface display (options 118.Fl I 119or 120.Fl i ) , 121show bytes in and out, instead of packet statistics. 122.It Fl d 123With either the interface display (options 124.Fl I 125or 126.Fl i ) 127or an interval (option 128.Fl w ) , 129show the number of dropped packets. 130.It Fl F 131When showing routes, only show routes whose gateway are in the 132same address family as the destination. 133.It Fl f Ar address_family 134Limit statistics or address control block reports to those 135of the specified 136.Ar address_family . 137.Pp 138The following address families are recognized: 139.Pp 140.Bl -column "Address Family" "AF_APPLETA" "Description" -offset indent -compact 141.It Sy "Address Family" Ta Sy "Constant" Ta Sy "Description" 142.It "atalk" Ta Dv "AF_APPLETALK" Ta "AppleTalk" 143.It "encap" Ta Dv "PF_KEY" Ta "IPsec" 144.It "inet" Ta Dv "AF_INET" Ta "IP Version 4" 145.It "inet6" Ta Dv "AF_INET6" Ta "IP Version 6" 146.It "local" Ta Dv "AF_LOCAL" Ta "Local to Host (i.e., pipes)" 147.It "mpls" Ta Dv "AF_MPLS" Ta "MPLS" 148.It "pflow" Ta Dv "PF_FLOW" Ta "pflow data export" 149.It "unix" Ta Dv "AF_UNIX" Ta "Local to Host (i.e., pipes)" 150.El 151.Pp 152.It Fl g 153Show information related to multicast (group address) routing. 154By default, show the IP multicast virtual-interface and routing tables. 155If the 156.Fl s 157option is also present, show multicast routing statistics. 158.It Fl I Ar interface 159Show information about the specified 160.Ar interface ; 161used with a 162.Ar wait 163interval as described below. 164.Pp 165If the 166.Fl a 167option is also present, multicast addresses currently in use are shown 168for the given interface and for each IP interface address. 169Multicast addresses are shown on separate lines following the interface 170address with which they are associated. 171.Pp 172If the 173.Fl f Ar address_family 174option (with the 175.Fl s 176option) is present, show per-interface 177statistics on the given interface for the specified 178.Ar address_family . 179.It Fl i 180Show the state of interfaces which have been auto-configured 181(interfaces statically configured into a system but not 182located at boot-time are not shown). 183.Pp 184If the 185.Fl a 186option is also present, multicast addresses currently in use are shown 187for each Ethernet interface and for each IP interface address. 188Multicast addresses are shown on separate lines following the interface 189address with which they are associated. 190.Pp 191If the 192.Fl f Ar address_family 193option (with the 194.Fl s 195option) is present, show per-interface statistics on all interfaces 196for the specified 197.Ar address_family . 198.It Fl l 199With the 200.Fl g 201option, display wider fields for the IPv6 multicast routing table 202.Qq Origin 203and 204.Qq Group 205columns. 206.It Fl M Ar core 207Extract values associated with the name list from the specified core 208instead of the running kernel. 209.It Fl m 210Show statistics recorded by the memory management routines 211(the network manages a private pool of memory buffers). 212.It Fl N Ar system 213Extract the name list from the specified system instead of the running kernel. 214.It Fl n 215Show network addresses as numbers (normally 216.Nm 217interprets addresses and attempts to display them 218symbolically). 219This option may be used with any of the display formats. 220.It Fl P Ar pcbaddr 221Display the contents of the protocol control block (PCB) located at 222the kernel virtual address 223.Ar pcbaddr . 224PCB addresses can be obtained using the 225.Fl A 226flag. 227This option can currently only be used to display TCP control blocks. 228.It Fl p Ar protocol 229Restrict the output to 230.Ar protocol , 231which is either a well-known name for a protocol or an alias for it. 232Some protocol names and aliases are listed in the file 233.Pa /etc/protocols . 234The program will complain if 235.Ar protocol 236is unknown. 237If the 238.Fl s 239option is specified, the per-protocol statistics are displayed. 240Otherwise the states of the matching sockets are shown. 241.It Fl q 242Only show interfaces that have seen packets (or bytes if 243.Fl b 244is specified). 245.It Fl r 246Show the routing tables. 247If the 248.Fl s 249option is also specified, show routing statistics instead. 250.It Fl s 251Show per-protocol statistics. 252If this option is repeated, counters with a value of zero are suppressed. 253.It Fl T Ar tableid 254Select an alternate routing table to modify or query. 255Table 0 is the default table. 256.It Fl t 257With the 258.Fl i 259option, display the current value of the watchdog timer function. 260.It Fl u 261Limit statistics or address control block reports to the 262.Dv AF_UNIX 263address family. 264.It Fl v 265Be verbose. 266Avoids truncation of long addresses. 267.It Fl W Ar interface 268(IEEE 802.11 devices only) 269Show per-interface IEEE 802.11 wireless statistics. 270.It Fl w Ar wait 271Show network interface statistics at intervals of 272.Ar wait 273seconds. 274.El 275.Pp 276The default display, for active sockets, shows the local 277and remote addresses, send and receive queue sizes (in bytes), protocol, 278and the internal state of the protocol. 279.Pp 280Address formats are of the form 281.Dq host.port 282or 283.Dq network.port 284if a socket's address specifies a network but no specific host address. 285When known, the host and network addresses are displayed symbolically 286according to the databases 287.Pa /etc/hosts 288and 289.Pa /etc/networks , 290respectively. 291If a symbolic name for an address is unknown, or if the 292.Fl n 293option is specified, the address is printed numerically, according 294to the address family. 295.Pp 296For more information regarding the Internet 297.Dq dot format , 298refer to 299.Xr inet 3 . 300Unspecified or 301.Dq wildcard 302addresses and ports appear as a single 303.Sq * . 304If a local port number is registered as being in use for RPC by 305.Xr portmap 8 , 306its RPC service name or RPC service number will be printed in 307.Dq [] 308immediately after the port number. 309.Pp 310The interface display provides a table of cumulative 311statistics regarding packets transferred, errors, and collisions. 312The network addresses of the interface 313and the maximum transmission unit (MTU) are also displayed. 314.Pp 315The routing table display indicates the available routes and their status. 316Each route consists of a destination host or network and 317a gateway to use in forwarding packets. 318If the destination is a 319network in numeric format, the netmask (in /24 style format) is appended. 320The flags field shows a collection of information about 321the route stored as binary choices. 322The individual flags are discussed in more detail in the 323.Xr route 8 324and 325.Xr route 4 326manual pages. 327.Pp 328The mapping between letters and flags is: 329.Bl -column XXXX RTF_BLACKHOLE 3301 RTF_PROTO1 Protocol specific routing flag #1. 3312 RTF_PROTO2 Protocol specific routing flag #2. 3323 RTF_PROTO3 Protocol specific routing flag #3. 333B RTF_BLACKHOLE Just discard pkts (during updates). 334C RTF_CLONING Generate new routes on use. 335c RTF_CLONED Cloned routes (generated from RTF_CLONING). 336D RTF_DYNAMIC Created dynamically (by redirect). 337G RTF_GATEWAY Destination requires forwarding by intermediary. 338H RTF_HOST Host entry (net otherwise). 339L RTF_LLINFO Valid protocol to link address translation. 340M RTF_MODIFIED Modified dynamically (by redirect). 341P RTF_MPATH Multipath route. 342R RTF_REJECT Host or net unreachable. 343S RTF_STATIC Manually added. 344T RTF_MPLS MPLS route. 345U RTF_UP Route usable. 346X RTF_XRESOLVE External daemon translates proto to link address. 347.El 348.Pp 349Direct routes are created for each interface attached to the local host; 350the gateway field for such entries shows the address of the outgoing interface. 351The refcnt field gives the current number of active uses of the route. 352Connection oriented protocols normally hold on to a single route for the 353duration of a connection while connectionless protocols obtain a route while 354sending to the same destination. 355The use field provides a count of the number of packets sent using that route. 356The MTU entry shows the MTU associated with that route. 357This MTU value is used as the basis for the TCP maximum segment size (MSS). 358The 359.Sq L 360flag appended to the MTU value indicates that the value is 361locked, and that path MTU discovery is turned off for that route. 362A 363.Sq - 364indicates that the MTU for this route has not been set, and a default 365TCP maximum segment size will be used. 366The interface entry indicates the network interface utilized for the route. 367.Pp 368When 369.Nm 370is invoked with the 371.Fl w 372option and a 373.Ar wait 374interval argument, it displays a running count of statistics related to 375network interfaces. 376An obsolescent version of this option used a numeric parameter 377with no option, and is currently supported for backward compatibility. 378This display consists of a column for the primary interface (the first 379interface found during autoconfiguration) and a column summarizing 380information for all interfaces. 381The primary interface may be replaced with another interface with the 382.Fl I 383option. 384The first line of each screen of information contains a summary since the 385system was last rebooted. 386Subsequent lines of output show values accumulated over the preceding interval. 387.Sh SEE ALSO 388.Xr fstat 1 , 389.Xr nfsstat 1 , 390.Xr ps 1 , 391.Xr systat 1 , 392.Xr tcpbench 1 , 393.Xr top 1 , 394.Xr inet 3 , 395.Xr netintro 4 , 396.Xr route 4 , 397.Xr hosts 5 , 398.Xr networks 5 , 399.Xr protocols 5 , 400.Xr services 5 , 401.Xr iostat 8 , 402.Xr portmap 8 , 403.Xr pstat 8 , 404.Xr route 8 , 405.Xr tcpdrop 8 , 406.Xr trpt 8 , 407.Xr vmstat 8 408.Sh HISTORY 409The 410.Nm 411command appeared in 412.Bx 4.2 . 413IPv6 support was added by WIDE/KAME project. 414.Sh BUGS 415The notion of errors is ill-defined. 416