1.\" $OpenBSD: netstat.1,v 1.34 2003/11/28 10:05:43 jmc Exp $ 2.\" $NetBSD: netstat.1,v 1.11 1995/10/03 21:42:43 thorpej Exp $ 3.\" 4.\" Copyright (c) 1983, 1990, 1992, 1993 5.\" The Regents of the University of California. All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. Neither the name of the University nor the names of its contributors 16.\" may be used to endorse or promote products derived from this software 17.\" without specific prior written permission. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" from: @(#)netstat.1 8.8 (Berkeley) 4/18/94 32.\" 33.Dd April 18, 1994 34.Dt NETSTAT 1 35.Os 36.Sh NAME 37.Nm netstat 38.Nd show network status 39.Sh SYNOPSIS 40.Nm netstat 41.Op Fl Aan 42.Op Fl f Ar address_family 43.Op Fl M Ar core 44.Op Fl N Ar system 45.Nm netstat 46.Op Fl bdgilmnqrstu 47.Op Fl f Ar address_family 48.Op Fl M Ar core 49.Op Fl N Ar system 50.Nm netstat 51.Op Fl bdn 52.Op Fl I Ar interface 53.Op Fl M Ar core 54.Op Fl N Ar system 55.Op Fl w Ar wait 56.Nm netstat 57.Op Fl M Ar core 58.Op Fl N Ar system 59.Op Fl p Ar protocol 60.Nm netstat 61.Op Fl a 62.Op Fl f Ar address_family 63.Op Fl i | I Ar interface 64.Sh DESCRIPTION 65The 66.Nm 67command symbolically displays the contents of various network-related 68data structures. 69There are a number of output formats, 70depending on the options for the information presented. 71.Pp 72The first form of the command displays a list of active sockets for 73each protocol. 74The second form presents the contents of one of the other network 75data structures according to the option selected. 76Using the third form, with a 77.Ar wait 78interval specified, 79.Nm 80will continuously display the information regarding packet 81traffic on the configured network interfaces. 82The fourth form displays statistics about the named protocol. 83The fifth form displays per interface statistics for 84the specified address family. 85.Pp 86The options are as follows: 87.Bl -tag -width Ds 88.It Fl A 89With the default display, 90show the address of any protocol control blocks associated with sockets; used 91for debugging. 92.It Fl a 93With the default display, 94show the state of all sockets; normally sockets used by 95server processes are not shown. 96With the interface display (options 97.Fl I 98or 99.Fl i ) , 100show multicast addresses. 101.It Fl b 102With the interface display (options 103.Fl I 104or 105.Fl i ) , 106show bytes in and out, instead of packet statistics. 107.It Fl d 108With either the interface display (options 109.Fl I 110or 111.Fl i ) 112or an interval (option 113.Fl w ) , 114show the number of dropped packets. 115.It Fl f Ar address_family 116Limit statistics or address control block reports to those 117of the specified 118.Ar address_family . 119.Pp 120The following address families are recognized: 121.Pp 122.Bl -column "Address Family" "AF_APPLETA" "Description" -offset indent -compact 123.It Sy "Address Family" Ta Sy "Constant" Ta Sy "Description" 124.It "inet" Ta Dv "AF_INET" Ta "IP Version 4" 125.It "inet6" Ta Dv "AF_INET6" Ta "IP Version 6" 126.It "ipx" Ta Dv "AF_IPX" Ta "Novell IPX" 127.It "atalk" Ta Dv "AF_APPLETALK" Ta "AppleTalk" 128.It "ns" Ta Dv "AF_NS" Ta "Xerox NS Protocols" 129.It "iso" Ta Dv "AF_ISO" Ta "ISO Protocol Family" 130.It "encap" Ta Dv "PF_KEY" Ta "IPsec" 131.It "local" Ta Dv "AF_LOCAL" Ta "Local to Host (i.e., pipes)" 132.It "unix" Ta Dv "AF_UNIX" Ta "Local to Host (i.e., pipes)" 133.El 134.Pp 135.It Fl g 136Show information related to multicast (group address) routing. 137By default, show the IP multicast virtual-interface and routing tables. 138If the 139.Fl s 140option is also present, show multicast routing statistics. 141.It Fl I Ar interface 142Show information about the specified 143.Ar interface ; 144used with a 145.Ar wait 146interval as described below. 147.Pp 148If the 149.Fl a 150option is also present, multicast addresses currently in use are shown 151for the given interface and for each IP interface address. 152Multicast addresses are shown on separate lines following the interface 153address with which they are associated. 154.Pp 155If the 156.Fl f Ar address_family 157option (with the 158.Fl s 159option) is present, show per-interface 160statistics on the given interface for the specified 161.Ar address_family . 162.It Fl i 163Show the state of interfaces which have been auto-configured 164(interfaces statically configured into a system but not 165located at boot-time are not shown). 166.Pp 167If the 168.Fl a 169option is also present, multicast addresses currently in use are shown 170for each Ethernet interface and for each IP interface address. 171Multicast addresses are shown on separate lines following the interface 172address with which they are associated. 173.Pp 174If the 175.Fl f Ar address_family 176option (with the 177.Fl s 178option) is present, show per-interface statistics on all interfaces 179for the specified 180.Ar address_family . 181.It Fl l 182With the 183.Fl g 184option, display wider fields for the IPv6 multicast routing table 185.Qq Origin 186and 187.Qq Group 188columns. 189.It Fl M Ar core 190Extract values associated with the name list from the specified core 191instead of the running kernel. 192.It Fl m 193Show statistics recorded by the memory management routines 194(the network manages a private pool of memory buffers). 195.It Fl N Ar system 196Extract the name list from the specified system instead of the running kernel. 197.It Fl n 198Show network addresses as numbers (normally 199.Nm 200interprets addresses and attempts to display them 201symbolically). 202This option may be used with any of the display formats. 203.It Fl p Ar protocol 204Show statistics about 205.Ar protocol , 206which is either a well-known name for a protocol or an alias for it. 207Some protocol names and aliases are listed in the file 208.Pa /etc/protocols . 209A null response typically means that there are no interesting numbers to 210report. 211The program will complain if 212.Ar protocol 213is unknown or if there is no statistics routine for it. 214.It Fl q 215Only show interfaces that have seen packets (or bytes if 216.Fl b 217is specified). 218.It Fl r 219Show the routing tables. 220If the 221.Fl s 222option is also specified, show routing statistics instead. 223.It Fl s 224Show per-protocol statistics. 225If this option is repeated, counters with a value of zero are suppressed. 226.It Fl t 227With the 228.Fl i 229option, display the current value of the watchdog timer function. 230.It Fl u 231Limit statistics or address control block reports to the 232.Dv AF_UNIX 233address family. 234.It Fl v 235Be verbose. 236Avoids truncation of long addresses. 237.It Fl w Ar wait 238Show network interface statistics at intervals of 239.Ar wait 240seconds. 241.El 242.Pp 243The default display, for active sockets, shows the local 244and remote addresses, send and receive queue sizes (in bytes), protocol, 245and the internal state of the protocol. 246.Pp 247Address formats are of the form 248.Dq host.port 249or 250.Dq network.port 251if a socket's address specifies a network but no specific host address. 252When known, the host and network addresses are displayed symbolically 253according to the databases 254.Pa /etc/hosts 255and 256.Pa /etc/networks , 257respectively. 258If a symbolic name for an address is unknown, or if the 259.Fl n 260option is specified, the address is printed numerically, according 261to the address family. 262.Pp 263For more information regarding the Internet 264.Dq dot format , 265refer to 266.Xr inet 3 . 267Unspecified or 268.Dq wildcard 269addresses and ports appear as a single 270.Sq * . 271If a local port number is registered as being in use for RPC by 272.Xr portmap 8 , 273its RPC service name or RPC service number will be printed in 274.Dq [] 275immediately after the port number. 276.Pp 277The interface display provides a table of cumulative 278statistics regarding packets transferred, errors, and collisions. 279The network addresses of the interface 280and the maximum transmission unit (MTU) are also displayed. 281.Pp 282The routing table display indicates the available routes and their status. 283Each route consists of a destination host or network and 284a gateway to use in forwarding packets. 285If the destination is a 286network in numeric format, the netmask (in /24 style format) is appended. 287The flags field shows a collection of information about 288the route stored as binary choices. 289The individual flags are discussed in more detail in the 290.Xr route 8 291and 292.Xr route 4 293manual pages. 294.Pp 295The mapping between letters and flags is: 296.Bl -column XXXX RTF_BLACKHOLE 2971 RTF_PROTO1 Protocol specific routing flag #1. 2982 RTF_PROTO2 Protocol specific routing flag #2. 2993 RTF_PROTO3 Protocol specific routing flag #3. 300B RTF_BLACKHOLE Just discard pkts (during updates). 301C RTF_CLONING Generate new routes on use. 302c RTF_CLONED Cloned routes (generated from RTF_CLONING). 303D RTF_DYNAMIC Created dynamically (by redirect). 304G RTF_GATEWAY Destination requires forwarding by intermediary. 305H RTF_HOST Host entry (net otherwise). 306L RTF_LLINFO Valid protocol to link address translation. 307M RTF_MODIFIED Modified dynamically (by redirect). 308R RTF_REJECT Host or net unreachable. 309S RTF_STATIC Manually added. 310U RTF_UP Route usable. 311X RTF_XRESOLVE External daemon translates proto to link address. 312.El 313.Pp 314Direct routes are created for each interface attached to the local host; 315the gateway field for such entries shows the address of the outgoing interface. 316The refcnt field gives the current number of active uses of the route. 317Connection oriented protocols normally hold on to a single route for the 318duration of a connection while connectionless protocols obtain a route while 319sending to the same destination. 320The use field provides a count of the number of packets sent using that route. 321The MTU entry shows the MTU associated with that route. 322This MTU value is used as the basis for the TCP maximum segment size (MSS). 323The 324.Sq L 325flag appended to the MTU value indicates that the value is 326locked, and that path MTU discovery is turned off for that route. 327A 328.Sq - 329indicates that the MTU for this route has not been set, and a default 330TCP maximum segment size will be used. 331The interface entry indicates the network interface utilized for the route. 332.Pp 333When 334.Nm 335is invoked with the 336.Fl w 337option and a 338.Ar wait 339interval argument, it displays a running count of statistics related to 340network interfaces. 341An obsolescent version of this option used a numeric parameter 342with no option, and is currently supported for backward compatibility. 343This display consists of a column for the primary interface (the first 344interface found during autoconfiguration) and a column summarizing 345information for all interfaces. 346The primary interface may be replaced with another interface with the 347.Fl I 348option. 349The first line of each screen of information contains a summary since the 350system was last rebooted. 351Subsequent lines of output show values accumulated over the preceding interval. 352.Sh SEE ALSO 353.Xr nfsstat 1 , 354.Xr ps 1 , 355.Xr inet 3 , 356.Xr netintro 4 , 357.Xr route 4 , 358.Xr hosts 5 , 359.Xr networks 5 , 360.Xr protocols 5 , 361.Xr services 5 , 362.Xr iostat 8 , 363.Xr portmap 8 , 364.Xr route 8 , 365.Xr trpt 8 , 366.Xr vmstat 8 367.Sh HISTORY 368The 369.Nm 370command appeared in 371.Bx 4.2 . 372IPv6 support was added by WIDE/KAME project. 373.Sh BUGS 374The notion of errors is ill-defined. 375