1.\" $OpenBSD: netstat.1,v 1.40 2004/07/13 23:33:29 jmc Exp $ 2.\" $NetBSD: netstat.1,v 1.11 1995/10/03 21:42:43 thorpej Exp $ 3.\" 4.\" Copyright (c) 1983, 1990, 1992, 1993 5.\" The Regents of the University of California. All rights reserved. 6.\" 7.\" Redistribution and use in source and binary forms, with or without 8.\" modification, are permitted provided that the following conditions 9.\" are met: 10.\" 1. Redistributions of source code must retain the above copyright 11.\" notice, this list of conditions and the following disclaimer. 12.\" 2. Redistributions in binary form must reproduce the above copyright 13.\" notice, this list of conditions and the following disclaimer in the 14.\" documentation and/or other materials provided with the distribution. 15.\" 3. Neither the name of the University nor the names of its contributors 16.\" may be used to endorse or promote products derived from this software 17.\" without specific prior written permission. 18.\" 19.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 20.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 21.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 22.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 24.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 25.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 26.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 27.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 28.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 29.\" SUCH DAMAGE. 30.\" 31.\" from: @(#)netstat.1 8.8 (Berkeley) 4/18/94 32.\" 33.Dd April 18, 1994 34.Dt NETSTAT 1 35.Os 36.Sh NAME 37.Nm netstat 38.Nd show network status 39.Sh SYNOPSIS 40.Nm netstat 41.Op Fl Aan 42.Op Fl f Ar address_family 43.Op Fl M Ar core 44.Op Fl N Ar system 45.Nm netstat 46.Op Fl bdgilmnqrSstu 47.Op Fl f Ar address_family 48.Op Fl M Ar core 49.Op Fl N Ar system 50.Nm netstat 51.Op Fl bdn 52.Op Fl I Ar interface 53.Op Fl M Ar core 54.Op Fl N Ar system 55.Op Fl w Ar wait 56.Nm netstat 57.Op Fl s 58.Op Fl M Ar core 59.Op Fl N Ar system 60.Op Fl p Ar protocol 61.Nm netstat 62.Op Fl a 63.Op Fl f Ar address_family 64.Op Fl i | I Ar interface 65.Sh DESCRIPTION 66The 67.Nm 68command symbolically displays the contents of various network-related 69data structures. 70There are a number of output formats, 71depending on the options for the information presented. 72.Pp 73The first form of the command displays a list of active sockets for 74each protocol. 75The second form presents the contents of one of the other network 76data structures according to the option selected. 77Using the third form, with a 78.Ar wait 79interval specified, 80.Nm 81will continuously display the information regarding packet 82traffic on the configured network interfaces. 83The fourth form displays statistics about the named protocol. 84The fifth form displays per interface statistics for 85the specified address family. 86.Pp 87The options are as follows: 88.Bl -tag -width Ds 89.It Fl A 90With the default display, 91show the address of any protocol control blocks associated with sockets; used 92for debugging. 93.It Fl a 94With the default display, 95show the state of all sockets; normally sockets used by 96server processes are not shown. 97With the interface display (options 98.Fl I 99or 100.Fl i ) , 101show multicast addresses. 102.It Fl b 103With the interface display (options 104.Fl I 105or 106.Fl i ) , 107show bytes in and out, instead of packet statistics. 108.It Fl d 109With either the interface display (options 110.Fl I 111or 112.Fl i ) 113or an interval (option 114.Fl w ) , 115show the number of dropped packets. 116.It Fl f Ar address_family 117Limit statistics or address control block reports to those 118of the specified 119.Ar address_family . 120.Pp 121The following address families are recognized: 122.Pp 123.Bl -column "Address Family" "AF_APPLETA" "Description" -offset indent -compact 124.It Sy "Address Family" Ta Sy "Constant" Ta Sy "Description" 125.It "inet" Ta Dv "AF_INET" Ta "IP Version 4" 126.It "inet6" Ta Dv "AF_INET6" Ta "IP Version 6" 127.It "ipx" Ta Dv "AF_IPX" Ta "Novell IPX" 128.It "atalk" Ta Dv "AF_APPLETALK" Ta "AppleTalk" 129.It "ns" Ta Dv "AF_NS" Ta "Xerox NS Protocols" 130.It "encap" Ta Dv "PF_KEY" Ta "IPsec" 131.It "local" Ta Dv "AF_LOCAL" Ta "Local to Host (i.e., pipes)" 132.It "unix" Ta Dv "AF_UNIX" Ta "Local to Host (i.e., pipes)" 133.El 134.Pp 135.It Fl g 136Show information related to multicast (group address) routing. 137By default, show the IP multicast virtual-interface and routing tables. 138If the 139.Fl s 140option is also present, show multicast routing statistics. 141.It Fl I Ar interface 142Show information about the specified 143.Ar interface ; 144used with a 145.Ar wait 146interval as described below. 147.Pp 148If the 149.Fl a 150option is also present, multicast addresses currently in use are shown 151for the given interface and for each IP interface address. 152Multicast addresses are shown on separate lines following the interface 153address with which they are associated. 154.Pp 155If the 156.Fl f Ar address_family 157option (with the 158.Fl s 159option) is present, show per-interface 160statistics on the given interface for the specified 161.Ar address_family . 162.It Fl i 163Show the state of interfaces which have been auto-configured 164(interfaces statically configured into a system but not 165located at boot-time are not shown). 166.Pp 167If the 168.Fl a 169option is also present, multicast addresses currently in use are shown 170for each Ethernet interface and for each IP interface address. 171Multicast addresses are shown on separate lines following the interface 172address with which they are associated. 173.Pp 174If the 175.Fl f Ar address_family 176option (with the 177.Fl s 178option) is present, show per-interface statistics on all interfaces 179for the specified 180.Ar address_family . 181.It Fl l 182With the 183.Fl g 184option, display wider fields for the IPv6 multicast routing table 185.Qq Origin 186and 187.Qq Group 188columns. 189.It Fl M Ar core 190Extract values associated with the name list from the specified core 191instead of the running kernel. 192.It Fl m 193Show statistics recorded by the memory management routines 194(the network manages a private pool of memory buffers). 195.It Fl N Ar system 196Extract the name list from the specified system instead of the running kernel. 197.It Fl n 198Show network addresses as numbers (normally 199.Nm 200interprets addresses and attempts to display them 201symbolically). 202This option may be used with any of the display formats. 203.It Fl p Ar protocol 204Restrict the output to 205.Ar protocol , 206which is either a well-known name for a protocol or an alias for it. 207Some protocol names and aliases are listed in the file 208.Pa /etc/protocols . 209The program will complain if 210.Ar protocol 211is unknown. 212If the 213.Fl s 214option is specified, the per-protocol statistics are displayed. 215Otherwise the states of the matching sockets are shown. 216.It Fl q 217Only show interfaces that have seen packets (or bytes if 218.Fl b 219is specified). 220.It Fl r 221Show the routing tables. 222If the 223.Fl s 224option is also specified, show routing statistics instead. 225.It Fl S 226Make the 227.Fl r 228command display the source selector part of the routes. 229.It Fl s 230Show per-protocol statistics. 231If this option is repeated, counters with a value of zero are suppressed. 232.It Fl t 233With the 234.Fl i 235option, display the current value of the watchdog timer function. 236.It Fl u 237Limit statistics or address control block reports to the 238.Dv AF_UNIX 239address family. 240.It Fl v 241Be verbose. 242Avoids truncation of long addresses. 243.It Fl w Ar wait 244Show network interface statistics at intervals of 245.Ar wait 246seconds. 247.El 248.Pp 249The default display, for active sockets, shows the local 250and remote addresses, send and receive queue sizes (in bytes), protocol, 251and the internal state of the protocol. 252.Pp 253Address formats are of the form 254.Dq host.port 255or 256.Dq network.port 257if a socket's address specifies a network but no specific host address. 258When known, the host and network addresses are displayed symbolically 259according to the databases 260.Pa /etc/hosts 261and 262.Pa /etc/networks , 263respectively. 264If a symbolic name for an address is unknown, or if the 265.Fl n 266option is specified, the address is printed numerically, according 267to the address family. 268.Pp 269For more information regarding the Internet 270.Dq dot format , 271refer to 272.Xr inet 3 . 273Unspecified or 274.Dq wildcard 275addresses and ports appear as a single 276.Sq * . 277If a local port number is registered as being in use for RPC by 278.Xr portmap 8 , 279its RPC service name or RPC service number will be printed in 280.Dq [] 281immediately after the port number. 282.Pp 283The interface display provides a table of cumulative 284statistics regarding packets transferred, errors, and collisions. 285The network addresses of the interface 286and the maximum transmission unit (MTU) are also displayed. 287.Pp 288The routing table display indicates the available routes and their status. 289Each route consists of a destination host or network and 290a gateway to use in forwarding packets. 291If the destination is a 292network in numeric format, the netmask (in /24 style format) is appended. 293The flags field shows a collection of information about 294the route stored as binary choices. 295The individual flags are discussed in more detail in the 296.Xr route 8 297and 298.Xr route 4 299manual pages. 300.Pp 301The mapping between letters and flags is: 302.Bl -column XXXX RTF_BLACKHOLE 3031 RTF_PROTO1 Protocol specific routing flag #1. 3042 RTF_PROTO2 Protocol specific routing flag #2. 3053 RTF_PROTO3 Protocol specific routing flag #3. 306B RTF_BLACKHOLE Just discard pkts (during updates). 307C RTF_CLONING Generate new routes on use. 308c RTF_CLONED Cloned routes (generated from RTF_CLONING). 309D RTF_DYNAMIC Created dynamically (by redirect). 310G RTF_GATEWAY Destination requires forwarding by intermediary. 311H RTF_HOST Host entry (net otherwise). 312L RTF_LLINFO Valid protocol to link address translation. 313M RTF_MODIFIED Modified dynamically (by redirect). 314R RTF_REJECT Host or net unreachable. 315S RTF_STATIC Manually added. 316U RTF_UP Route usable. 317X RTF_XRESOLVE External daemon translates proto to link address. 318.El 319.Pp 320Direct routes are created for each interface attached to the local host; 321the gateway field for such entries shows the address of the outgoing interface. 322The refcnt field gives the current number of active uses of the route. 323Connection oriented protocols normally hold on to a single route for the 324duration of a connection while connectionless protocols obtain a route while 325sending to the same destination. 326The use field provides a count of the number of packets sent using that route. 327The MTU entry shows the MTU associated with that route. 328This MTU value is used as the basis for the TCP maximum segment size (MSS). 329The 330.Sq L 331flag appended to the MTU value indicates that the value is 332locked, and that path MTU discovery is turned off for that route. 333A 334.Sq - 335indicates that the MTU for this route has not been set, and a default 336TCP maximum segment size will be used. 337The interface entry indicates the network interface utilized for the route. 338.Pp 339When 340.Nm 341is invoked with the 342.Fl w 343option and a 344.Ar wait 345interval argument, it displays a running count of statistics related to 346network interfaces. 347An obsolescent version of this option used a numeric parameter 348with no option, and is currently supported for backward compatibility. 349This display consists of a column for the primary interface (the first 350interface found during autoconfiguration) and a column summarizing 351information for all interfaces. 352The primary interface may be replaced with another interface with the 353.Fl I 354option. 355The first line of each screen of information contains a summary since the 356system was last rebooted. 357Subsequent lines of output show values accumulated over the preceding interval. 358.Sh SEE ALSO 359.Xr nfsstat 1 , 360.Xr ps 1 , 361.Xr inet 3 , 362.Xr netintro 4 , 363.Xr route 4 , 364.Xr hosts 5 , 365.Xr networks 5 , 366.Xr protocols 5 , 367.Xr services 5 , 368.Xr iostat 8 , 369.Xr portmap 8 , 370.Xr route 8 , 371.Xr tcpdrop 8 , 372.Xr trpt 8 , 373.Xr vmstat 8 374.Sh HISTORY 375The 376.Nm 377command appeared in 378.Bx 4.2 . 379IPv6 support was added by WIDE/KAME project. 380.Sh BUGS 381The notion of errors is ill-defined. 382