1.\" $OpenBSD: netstat.1,v 1.32 2003/07/14 12:38:30 jmc Exp $ 2.\" $NetBSD: netstat.1,v 1.11 1995/10/03 21:42:43 thorpej Exp $ 3.\" 4.\" Copyright (c) 1983, 1990, 1992, 1993 5.\" The Regents of the University of California. All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. Neither the name of the University nor the names of its contributors 16.\" may be used to endorse or promote products derived from this software 17.\" without specific prior written permission. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" from: @(#)netstat.1 8.8 (Berkeley) 4/18/94 32.\" 33.Dd April 18, 1994 34.Dt NETSTAT 1 35.Os 36.Sh NAME 37.Nm netstat 38.Nd show network status 39.Sh SYNOPSIS 40.Nm netstat 41.Op Fl Aan 42.Op Fl f Ar address_family 43.Op Fl M Ar core 44.Op Fl N Ar system 45.Nm netstat 46.Op Fl bdgilmnqrstu 47.Op Fl f Ar address_family 48.Op Fl M Ar core 49.Op Fl N Ar system 50.Nm netstat 51.Op Fl bdn 52.Op Fl I Ar interface 53.Op Fl M Ar core 54.Op Fl N Ar system 55.Op Fl w Ar wait 56.Nm netstat 57.Op Fl M Ar core 58.Op Fl N Ar system 59.Op Fl p Ar protocol 60.Nm netstat 61.Op Fl s 62.Op Fl f Ar address_family 63.Op Fl i 64.Op Fl I Ar Interface 65.Sh DESCRIPTION 66The 67.Nm 68command symbolically displays the contents of various network-related 69data structures. 70There are a number of output formats, 71depending on the options for the information presented. 72.Pp 73The first form of the command displays a list of active sockets for 74each protocol. 75The second form presents the contents of one of the other network 76data structures according to the option selected. 77Using the third form, with a 78.Ar wait 79interval specified, 80.Nm 81will continuously display the information regarding packet 82traffic on the configured network interfaces. 83The fourth form displays statistics about the named protocol. 84The fifth form displays per interface statistics for 85the specified address family. 86.Pp 87The options are as follows: 88.Bl -tag -width Ds 89.It Fl A 90With the default display, 91show the address of any protocol control blocks associated with sockets; used 92for debugging. 93.It Fl a 94With the default display, 95show the state of all sockets; normally sockets used by 96server processes are not shown. 97.It Fl b 98With the interface display (option 99.Fl i ) , 100show bytes in and out, instead of packet statistics. 101.It Fl d 102With either interface display (option 103.Fl i 104or an interval, as described below), 105show the number of dropped packets. 106.It Fl f Ar address_family 107Limit statistics or address control block reports to those 108of the specified 109.Ar address_family . 110.Pp 111The following address families are recognized: 112.Pp 113.Bl -column "Address Family" "AF_APPLETA" "Description" -offset indent -compact 114.It Sy "Address Family" Ta Sy "Constant" Ta Sy "Description" 115.It "inet" Ta Dv "AF_INET" Ta "IP Version 4" 116.It "inet6" Ta Dv "AF_INET6" Ta "IP Version 6" 117.It "ipx" Ta Dv "AF_IPX" Ta "Novell IPX" 118.It "atalk" Ta Dv "AF_APPLETALK" Ta "AppleTalk" 119.It "ns" Ta Dv "AF_NS" Ta "Xerox NS Protocols" 120.It "iso" Ta Dv "AF_ISO" Ta "ISO Protocol Family" 121.It "encap" Ta Dv "PF_KEY" Ta "IPsec" 122.It "local" Ta Dv "AF_LOCAL" Ta "Local to Host (i.e., pipes)" 123.It "unix" Ta Dv "AF_UNIX" Ta "Local to Host (i.e., pipes)" 124.El 125.Pp 126.It Fl g 127Show information related to multicast (group address) routing. 128By default, show the IP Multicast virtual-interface and routing tables. 129If the 130.Fl s 131option is also present, show multicast routing statistics. 132.It Fl I Ar interface 133Show information about the specified 134.Ar interface ; 135used with a 136.Ar wait 137interval as described below. 138.Pp 139If the 140.Fl f Ar address_family 141option (with the 142.Fl s 143option) is present, show per-interface 144statistics on the given interface for the specified 145.Ar address_family . 146.It Fl i 147Show the state of interfaces which have been auto-configured 148(interfaces statically configured into a system but not 149located at boot-time are not shown). 150.Pp 151If the 152.Fl a 153option is also present, multicast addresses currently in use are shown 154for each Ethernet interface and for each IP interface address. 155Multicast addresses are shown on separate lines following the interface 156address with which they are associated. 157.Pp 158If the 159.Fl f Ar address_family 160option (with the 161.Fl s 162option) is present, show per-interface statistics on all interfaces 163for the specified 164.Ar address_family . 165.It Fl l 166With the 167.Fl g 168option, display wider fields for the IPv6 multicast routing table 169.Qq Origin 170and 171.Qq Group 172columns. 173.It Fl M Ar core 174Extract values associated with the name list from the specified core 175instead of the running kernel. 176.It Fl m 177Show statistics recorded by the memory management routines 178(the network manages a private pool of memory buffers). 179.It Fl N Ar system 180Extract the name list from the specified system instead of the running kernel. 181.It Fl n 182Show network addresses as numbers (normally 183.Nm 184interprets addresses and attempts to display them 185symbolically). 186This option may be used with any of the display formats. 187.It Fl p Ar protocol 188Show statistics about 189.Ar protocol , 190which is either a well-known name for a protocol or an alias for it. 191Some protocol names and aliases are listed in the file 192.Pa /etc/protocols . 193A null response typically means that there are no interesting numbers to 194report. 195The program will complain if 196.Ar protocol 197is unknown or if there is no statistics routine for it. 198.It Fl q 199Only show interfaces that have seen packets (or bytes if 200.Fl b 201is specified) 202.It Fl r 203Show the routing tables. 204If the 205.Fl s 206option is also specified, show routing statistics instead. 207.It Fl s 208Show per-protocol statistics. 209If this option is repeated, counters with a value of zero are suppressed. 210.It Fl t 211With the 212.Fl i 213option, display the current value of the watchdog timer function. 214.It Fl u 215Limit statistics or address control block reports to the 216.Dv AF_UNIX 217address family. 218.It Fl v 219Be verbose. 220Avoids truncation of long addresses. 221.It Fl w Ar wait 222Show network interface statistics at intervals of 223.Ar wait 224seconds. 225.El 226.Pp 227The default display, for active sockets, shows the local 228and remote addresses, send and receive queue sizes (in bytes), protocol, 229and the internal state of the protocol. 230.Pp 231Address formats are of the form 232.Dq host.port 233or 234.Dq network.port 235if a socket's address specifies a network but no specific host address. 236When known, the host and network addresses are displayed symbolically 237according to the databases 238.Pa /etc/hosts 239and 240.Pa /etc/networks , 241respectively. 242If a symbolic name for an address is unknown, or if the 243.Fl n 244option is specified, the address is printed numerically, according 245to the address family. 246.Pp 247For more information regarding the Internet 248.Dq dot format , 249refer to 250.Xr inet 3 . 251Unspecified, or 252.Dq wildcard 253addresses and ports appear as a single 254.Dq \&* . 255If a local port number is registered as being in use for RPC by 256.Xr portmap 8 , 257its RPC service name or RPC service number will be printed in 258.Dq [] 259immediately after the port number. 260.Pp 261The interface display provides a table of cumulative 262statistics regarding packets transferred, errors, and collisions. 263The network addresses of the interface 264and the maximum transmission unit (MTU) are also displayed. 265.Pp 266The routing table display indicates the available routes and their status. 267Each route consists of a destination host or network and 268a gateway to use in forwarding packets. 269If the destination is a 270network in numeric format, the netmask (in /24 style format) is appended. 271The flags field shows a collection of information about 272the route stored as binary choices. 273The individual flags are discussed in more detail in the 274.Xr route 8 275and 276.Xr route 4 277manual pages. 278.Pp 279The mapping between letters and flags is: 280.Bl -column XXXX RTF_BLACKHOLE 2811 RTF_PROTO1 Protocol specific routing flag #1. 2822 RTF_PROTO2 Protocol specific routing flag #2. 2833 RTF_PROTO3 Protocol specific routing flag #3. 284B RTF_BLACKHOLE Just discard pkts (during updates). 285C RTF_CLONING Generate new routes on use. 286D RTF_DYNAMIC Created dynamically (by redirect). 287G RTF_GATEWAY Destination requires forwarding by intermediary. 288H RTF_HOST Host entry (net otherwise). 289L RTF_LLINFO Valid protocol to link address translation. 290M RTF_MODIFIED Modified dynamically (by redirect). 291R RTF_REJECT Host or net unreachable. 292S RTF_STATIC Manually added. 293U RTF_UP Route usable. 294X RTF_XRESOLVE External daemon translates proto to link address. 295.El 296.Pp 297Direct routes are created for each interface attached to the local host; 298the gateway field for such entries shows the address of the outgoing interface. 299The refcnt field gives the current number of active uses of the route. 300Connection oriented protocols normally hold on to a single route for the 301duration of a connection while connectionless protocols obtain a route while 302sending to the same destination. 303The use field provides a count of the number of packets sent using that route. 304The MTU entry shows the MTU associated with that route. 305This MTU value is used as the basis for the TCP maximum segment size (MSS). 306The 'L' flag appended to the mtu value indicates that the value is 307locked, and that path mtu discovery is turned off for that route. 308A 309.Sq - 310indicates that the MTU for this route has not been set, and a default 311TCP maximum segment size will be used. 312The interface entry indicates the network interface utilized for the route. 313.Pp 314When 315.Nm 316is invoked with the 317.Fl w 318option and a 319.Ar wait 320interval argument, it displays a running count of statistics related to 321network interfaces. 322An obsolescent version of this option used a numeric parameter 323with no option, and is currently supported for backward compatibility. 324This display consists of a column for the primary interface (the first 325interface found during autoconfiguration) and a column summarizing 326information for all interfaces. 327The primary interface may be replaced with another interface with the 328.Fl I 329option. 330The first line of each screen of information contains a summary since the 331system was last rebooted. 332Subsequent lines of output show values accumulated over the preceding interval. 333.Sh SEE ALSO 334.Xr nfsstat 1 , 335.Xr ps 1 , 336.Xr netintro 4 , 337.Xr hosts 5 , 338.Xr networks 5 , 339.Xr protocols 5 , 340.Xr services 5 , 341.Xr iostat 8 , 342.Xr trpt 8 , 343.Xr vmstat 8 344.Sh HISTORY 345The 346.Nm 347command appeared in 348.Bx 4.2 . 349IPv6 support was added by WIDE/KAME project. 350.Sh BUGS 351The notion of errors is ill-defined. 352