1.\" Copyright (c) 1983, 1990, 1992, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.\" @(#)netstat.1 8.8 (Berkeley) 4/18/94 29.\" $FreeBSD$ 30.\" 31.Dd August 14, 2023 32.Dt NETSTAT 1 33.Os 34.Sh NAME 35.Nm netstat 36.Nd show network status and statistics 37.Sh SYNOPSIS 38.Bk -words 39.Bl -tag -width "netstat" 40.It Nm 41.Op Fl j Ar jail 42.Op Fl -libxo 43.Op Fl 46AaCLnPRSTWx 44.Op Fl f Ar protocol_family | Fl p Ar protocol 45.It Nm Fl i | I Ar interface 46.Op Fl j Ar jail 47.Op Fl -libxo 48.Op Fl 46abdhnW 49.Op Fl f Ar address_family 50.Op Fl M Ar core 51.Op Fl N Ar system 52.It Nm Fl w Ar wait 53.Op Fl j Ar jail 54.Op Fl -libxo 55.Op Fl I Ar interface 56.Op Fl 46d 57.Op Fl M Ar core 58.Op Fl N Ar system 59.Op Fl q Ar howmany 60.It Nm Fl s 61.Op Fl j Ar jail 62.Op Fl -libxo 63.Op Fl 46sz 64.Op Fl f Ar protocol_family | Fl p Ar protocol 65.Op Fl M Ar core 66.Op Fl N Ar system 67.It Nm Fl i | I Ar interface Fl s 68.Op Fl j Ar jail 69.Op Fl -libxo 70.Op Fl 46s 71.Op Fl f Ar protocol_family | Fl p Ar protocol 72.Op Fl M Ar core 73.Op Fl N Ar system 74.It Nm Fl m 75.Op Fl j Ar jail 76.Op Fl -libxo 77.Op Fl M Ar core 78.Op Fl N Ar system 79.It Nm Fl B 80.Op Fl j Ar jail 81.Op Fl -libxo 82.Op Fl z 83.Op Fl I Ar interface 84.It Nm Fl r 85.Op Fl j Ar jail 86.Op Fl -libxo 87.Op Fl 46nW 88.Op Fl F Ar fibnum 89.Op Fl f Ar address_family 90.It Nm Fl rs 91.Op Fl j Ar jail 92.Op Fl -libxo 93.Op Fl s 94.Op Fl M Ar core 95.Op Fl N Ar system 96.It Nm Fl g 97.Op Fl j Ar jail 98.Op Fl -libxo 99.Op Fl 46W 100.Op Fl f Ar address_family 101.It Nm Fl gs 102.Op Fl j Ar jail 103.Op Fl -libxo 104.Op Fl 46s 105.Op Fl f Ar address_family 106.Op Fl M Ar core 107.Op Fl N Ar system 108.It Nm Fl Q 109.Op Fl j Ar jail 110.Op Fl -libxo 111.El 112.Ek 113.Sh DESCRIPTION 114The 115.Nm 116command shows the contents of various network-related 117data structures. 118The arguments passed determine which of the below output formats the 119command uses. 120.Bl -tag -width indent 121.It Xo 122.Bk -words 123.Nm 124.Op Fl 46AaCLnRSTWx 125.Op Fl f Ar protocol_family | Fl p Ar protocol 126.Op Fl j Ar jail 127.Ek 128.Xc 129Display a list of active sockets 130(protocol control blocks) 131for each network protocol. 132.Pp 133The default display for active sockets shows the local 134and remote addresses, send and receive queue sizes (in bytes), protocol, 135and the internal state of the protocol. 136Address formats are of the form 137.Dq host.port 138or 139.Dq network.port 140if a socket's address specifies a network but no specific host address. 141When known, the host and network addresses are displayed symbolically 142according to the databases 143.Xr hosts 5 144and 145.Xr networks 5 , 146respectively. 147If a symbolic name for an address is unknown, or if 148the 149.Fl n 150option is specified, the address is printed numerically, according 151to the address family. 152For more information regarding 153the Internet IPv4 154.Dq dot format , 155refer to 156.Xr inet 3 . 157Unspecified, 158or 159.Dq wildcard , 160addresses and ports appear as 161.Dq Li * . 162.Bl -tag -width indent 163.It Fl -libxo 164Generate output via 165.Xr libxo 3 166in a selection of different human and machine readable formats. 167See 168.Xr xo_parse_args 3 169for details on command line arguments. 170.It Fl 4 171Show IPv4 only. 172See 173.Sx GENERAL OPTIONS . 174.It Fl 6 175Show IPv6 only. 176See 177.Sx GENERAL OPTIONS . 178.It Fl A 179Show the address of a protocol control block (PCB) 180associated with a socket; used for debugging. 181.It Fl a 182Show the state of all sockets; 183normally sockets used by server processes are not shown. 184.It Fl c 185Show the used TCP stack for each session. 186.It Fl C 187Show the congestion control algorithm and diagnostic information of TCP sockets. 188.It Fl L 189Show the size of the various listen queues. 190The first count shows the number of unaccepted connections, 191the second count shows the amount of unaccepted incomplete connections, 192and the third count is the maximum number of queued connections. 193.It Fl n 194Do not resolve numeric addresses and port numbers to names. 195See 196.Sx GENERAL OPTIONS . 197.It Fl P 198Display the log ID for each socket. 199.It Fl R 200Display the flowid and flowtype for each socket. 201flowid is a 32 bit hardware specific identifier for each flow. 202flowtype defines which protocol fields are hashed to produce the id. 203A complete listing is available in 204.Pa sys/mbuf.h 205under 206.Dv M_HASHTYPE_* . 207.It Fl S 208Show network addresses as numbers (as with 209.Fl n ) 210but show ports symbolically. 211.It Fl T 212Display diagnostic information from the TCP control block. 213Fields include the number of packets requiring retransmission, 214received out-of-order, and those advertising a zero-sized window. 215.It Fl W 216Avoid truncating addresses even if this causes some fields to overflow. 217.It Fl x 218Display socket buffer and TCP timer statistics for each 219internet socket. 220.Pp 221The 222.Fl x 223flag causes 224.Nm 225to output all the information recorded about data 226stored in the socket buffers. 227The fields are: 228.Bl -column ".Li R-HIWA" 229.It Li R-HIWA Ta Receive buffer high water mark, in bytes. 230.It Li S-HIWA Ta Send buffer high water mark, in bytes. 231.It Li R-LOWA Ta Receive buffer low water mark, in bytes. 232.It Li S-LOWA Ta Send buffer low water mark, in bytes. 233.It Li R-BCNT Ta Receive buffer byte count. 234.It Li S-BCNT Ta Send buffer byte count. 235.It Li R-BMAX Ta Maximum bytes that can be used in the receive buffer. 236.It Li S-BMAX Ta Maximum bytes that can be used in the send buffer. 237.It Li rexmt Ta Time, in seconds, to fire Retransmit Timer, or 0 if not armed. 238.It Li persist Ta Time, in seconds, to fire Retransmit Persistence, or 0 if not armed. 239.It Li keep Ta Time, in seconds, to fire Keep Alive, or 0 if not armed. 240.It Li 2msl Ta Time, in seconds, to fire 2*msl TIME_WAIT Timer, or 0 if not armed. 241.It Li delack Ta Time, in seconds, to fire Delayed ACK Timer, or 0 if not armed. 242.It Li rcvtime Ta Time, in seconds, since last packet received. 243.El 244.It Fl f Ar protocol_family 245Filter by 246.Ar protocol_family . 247See 248.Sx GENERAL OPTIONS . 249.It Fl p Ar protocol 250Filter by 251.Ar protocol . 252See 253.Sx GENERAL OPTIONS . 254.It Fl j Ar jail 255Run inside a jail. 256See 257.Sx GENERAL OPTIONS . 258.El 259.It Xo 260.Bk -words 261.Nm 262.Fl i | I Ar interface 263.Op Fl 46abdhnW 264.Op Fl f Ar address_family 265.Op Fl M Ar core 266.Op Fl N Ar system 267.Op Fl j Ar jail 268.Ek 269.Xc 270Show the state of all network interfaces or a single 271.Ar interface 272which have been auto-configured 273(interfaces statically configured into a system, but not 274located at boot time are not shown). 275An asterisk 276.Pq Dq Li * 277after an interface name indicates that the interface is 278.Dq down . 279.Pp 280When 281.Nm 282is invoked with 283.Fl i 284.Pq all interfaces 285or 286.Fl I Ar interface , 287it provides a table of cumulative 288statistics regarding packets transferred, errors, and collisions. 289The network addresses of the interface 290and the maximum transmission unit 291.Pq Dq mtu 292are also displayed. 293If both 294.Fl i 295and 296.Fl I 297are specified, 298.Fl I 299overrides any instances of 300.Fl i . 301.Bl -tag -width indent 302.It Fl 4 303Show IPv4 only. 304See 305.Sx GENERAL OPTIONS . 306.It Fl 6 307Show IPv6 only. 308See 309.Sx GENERAL OPTIONS . 310.It Fl a 311Multicast addresses currently in use are shown 312for each Ethernet interface and for each IP interface address. 313Multicast addresses are shown on separate lines following the interface 314address with which they are associated. 315.It Fl b 316Show the number of bytes in and out. 317.It Fl d 318Show the number of dropped packets. 319.It Fl h 320Print all counters in human readable form. 321.It Fl n 322Do not resolve numeric addresses and port numbers to names. 323See 324.Sx GENERAL OPTIONS . 325.It Fl W 326Avoid truncating addresses even if this causes some fields to overflow. 327See 328.Sx GENERAL OPTIONS . 329However, in most cases field widths are determined automatically with the 330.Fl i 331option, and this option has little effect. 332.It Fl f Ar protocol_family 333Filter by 334.Ar protocol_family . 335See 336.Sx GENERAL OPTIONS . 337.It Fl j Ar jail 338Run inside a jail. 339See 340.Sx GENERAL OPTIONS . 341.El 342.It Xo 343.Bk -words 344.Nm 345.Fl w Ar wait 346.Op Fl I Ar interface 347.Op Fl 46d 348.Op Fl M Ar core 349.Op Fl N Ar system 350.Op Fl q Ar howmany 351.Op Fl j Ar jail 352.Ek 353.Xc 354At intervals of 355.Ar wait 356seconds, display the information regarding packet traffic on all 357configured network interfaces or a single 358.Ar interface . 359.Pp 360When 361.Nm 362is invoked with the 363.Fl w 364option and a 365.Ar wait 366interval argument, it displays a running count of statistics related to 367network interfaces. 368An obsolescent version of this option used a numeric parameter 369with no option, and is currently supported for backward compatibility. 370By default, this display summarizes information for all interfaces. 371Information for a specific interface may be displayed with the 372.Fl I Ar interface 373option. 374.Bl -tag -width indent 375.It Fl I Ar interface 376Only show information regarding 377.Ar interface 378.It Fl 4 379Show IPv4 only. 380See 381.Sx GENERAL OPTIONS . 382.It Fl 6 383Show IPv6 only. 384See 385.Sx GENERAL OPTIONS . 386.It Fl d 387Show the number of dropped packets. 388.It Fl M 389Use an alternative core. 390See 391.Sx GENERAL OPTIONS . 392.It Fl N 393Use an alternative kernel image. 394See 395.Sx GENERAL OPTIONS . 396.It Fl q 397Exit after 398.Ar howmany 399outputs. 400.It Fl j Ar jail 401Run inside a jail. 402See 403.Sx GENERAL OPTIONS . 404.El 405.It Xo 406.Bk -words 407.Nm 408.Fl s 409.Op Fl 46sz 410.Op Fl f Ar protocol_family | Fl p Ar protocol 411.Op Fl M Ar core 412.Op Fl N Ar system 413.Op Fl j Ar jail 414.Ek 415.Xc 416Display system-wide statistics for each network protocol. 417.Bl -tag -width indent 418.It Fl 4 419Show IPv4 only. 420See 421.Sx GENERAL OPTIONS . 422.It Fl 6 423Show IPv6 only. 424See 425.Sx GENERAL OPTIONS . 426.It Fl s 427If 428.Fl s 429is repeated, counters with a value of zero are suppressed. 430.It Fl z 431Reset statistic counters after displaying them. 432.It Fl f Ar protocol_family 433Filter by 434.Ar protocol_family . 435See 436.Sx GENERAL OPTIONS . 437.It Fl p Ar protocol 438Filter by 439.Ar protocol . 440See 441.Sx GENERAL OPTIONS . 442.It Fl M 443Use an alternative core. 444See 445.Sx GENERAL OPTIONS . 446.It Fl N 447Use an alternative kernel image 448See 449.Sx GENERAL OPTIONS . 450.It Fl j Ar jail 451Run inside a jail. 452See 453.Sx GENERAL OPTIONS . 454.El 455.It Xo 456.Bk -words 457.Nm 458.Fl i | I Ar interface Fl s 459.Op Fl 46s 460.Op Fl f Ar protocol_family | Fl p Ar protocol 461.Op Fl M Ar core 462.Op Fl N Ar system 463.Op Fl j Ar jail 464.Ek 465.Xc 466Display per-interface statistics for each network protocol. 467If both 468.Fl i 469and 470.Fl I 471are specified, 472.Fl I 473overrides any instances of 474.Fl i . 475.Bl -tag -width indent 476.It Fl 4 477Show IPv4 only 478See 479.Sx GENERAL OPTIONS . 480.It Fl 6 481Show IPv6 only 482See 483.Sx GENERAL OPTIONS . 484.It Fl s 485If 486.Fl s 487is repeated, counters with a value of zero are suppressed. 488.It Fl f Ar protocol_family 489Filter by 490.Ar protocol_family . 491See 492.Sx GENERAL OPTIONS . 493.It Fl p Ar protocol 494Filter by 495.Ar protocol . 496See 497.Sx GENERAL OPTIONS . 498.It Fl M 499Use an alternative core 500See 501.Sx GENERAL OPTIONS . 502.It Fl N 503Use an alternative kernel image 504See 505.Sx GENERAL OPTIONS . 506.It Fl j Ar jail 507Run inside a jail. 508See 509.Sx GENERAL OPTIONS . 510.El 511.It Xo 512.Bk -words 513.Nm 514.Fl m 515.Op Fl M Ar core 516.Op Fl N Ar system 517.Op Fl j Ar jail 518.Ek 519.Xc 520Show statistics recorded by the memory management routines 521.Pq Xr mbuf 9 . 522The network manages a private pool of memory buffers. 523.Bl -tag -width indent 524.It Fl M 525Use an alternative core 526See 527.Sx GENERAL OPTIONS . 528.It Fl N 529Use an alternative kernel image 530See 531.Sx GENERAL OPTIONS . 532.It Fl j Ar jail 533Run inside a jail. 534See 535.Sx GENERAL OPTIONS . 536.El 537.It Xo 538.Bk -words 539.Nm 540.Fl B 541.Op Fl z 542.Op Fl I Ar interface 543.Op Fl j Ar jail 544.Ek 545.Xc 546Show statistics about 547.Xr bpf 4 548peers. 549This includes information like 550how many packets have been matched, dropped and received by the 551bpf device, also information about current buffer sizes and device 552states. 553.Pp 554The 555.Xr bpf 4 556flags displayed when 557.Nm 558is invoked with the 559.Fl B 560option represent the underlying parameters of the bpf peer. 561Each flag is 562represented as a single lower case letter. 563The mapping between the letters and flags in order of appearance are: 564.Bl -column ".Li i" 565.It Li p Ta Set if listening promiscuously 566.It Li i Ta Dv BIOCIMMEDIATE No has been set on the device 567.It Li f Ta Dv BIOCGHDRCMPLT No status: source link addresses are being 568filled automatically 569.It Li s Ta Dv BIOCGSEESENT No status: see packets originating locally and 570remotely on the interface. 571.It Li a Ta Packet reception generates a signal 572.It Li l Ta Dv BIOCLOCK No status: descriptor has been locked 573.El 574.Pp 575For more information about these flags, please refer to 576.Xr bpf 4 . 577.Bl -tag -width indent 578.It Fl z 579Reset statistic counters after displaying them. 580.It Fl j Ar jail 581Run inside a jail. 582See 583.Sx GENERAL OPTIONS . 584.El 585.It Xo 586.Bk -words 587.Nm 588.Fl r 589.Op Fl 46AnW 590.Op Fl F Ar fibnum 591.Op Fl f Ar address_family 592.Op Fl M Ar core 593.Op Fl N Ar system 594.Op Fl j Ar jail 595.Ek 596.Xc 597Display the contents of routing tables. 598.Pp 599When 600.Nm 601is invoked with the routing table option 602.Fl r , 603it lists the available routes and their status. 604Each route consists of a destination host or network, and a gateway to use 605in forwarding packets. 606The flags field shows a collection of information about the route stored 607as binary choices. 608The individual flags are discussed in more detail in the 609.Xr route 8 610and 611.Xr route 4 612manual pages. 613The mapping between letters and flags is: 614.Bl -column ".Li W" ".Dv RTF_WASCLONED" 615.It Li 1 Ta Dv RTF_PROTO1 Ta "Protocol specific routing flag #1" 616.It Li 2 Ta Dv RTF_PROTO2 Ta "Protocol specific routing flag #2" 617.It Li 3 Ta Dv RTF_PROTO3 Ta "Protocol specific routing flag #3" 618.It Li B Ta Dv RTF_BLACKHOLE Ta "Just discard pkts (during updates)" 619.It Li b Ta Dv RTF_BROADCAST Ta "The route represents a broadcast address" 620.It Li D Ta Dv RTF_DYNAMIC Ta "Created dynamically (by redirect)" 621.It Li G Ta Dv RTF_GATEWAY Ta "Destination requires forwarding by intermediary" 622.It Li H Ta Dv RTF_HOST Ta "Host entry (net otherwise)" 623.It Li L Ta Dv RTF_LLINFO Ta "Valid protocol to link address translation" 624.It Li M Ta Dv RTF_MODIFIED Ta "Modified dynamically (by redirect)" 625.It Li R Ta Dv RTF_REJECT Ta "Host or net unreachable" 626.It Li S Ta Dv RTF_STATIC Ta "Manually added" 627.It Li U Ta Dv RTF_UP Ta "Route usable" 628.It Li X Ta Dv RTF_XRESOLVE Ta "External daemon translates proto to link address" 629.El 630.Pp 631Direct routes are created for each 632interface attached to the local host; 633the gateway field for such entries shows the address of the outgoing interface. 634The refcnt field gives the 635current number of active uses of the route. 636Connection oriented 637protocols normally hold on to a single route for the duration of 638a connection while connectionless protocols obtain a route while sending 639to the same destination. 640The use field provides a count of the number of packets 641sent using that route. 642The interface entry indicates the network interface utilized for the route. 643.Bl -tag -width indent 644.It Fl 4 645Show IPv4 only. 646See 647.Sx GENERAL OPTIONS . 648.It Fl 6 649Show IPv6 only. 650See 651.Sx GENERAL OPTIONS . 652.It Fl n 653Do not resolve numeric addresses and port numbers to names. 654See 655.Sx GENERAL OPTIONS . 656.It Fl W 657Show the path MTU for each route, and print interface names with a 658wider field size. 659.It Fl F 660Display the routing table with the number 661.Ar fibnum . 662If the specified 663.Ar fibnum 664is -1 or 665.Fl F 666is not specified, 667the default routing table is displayed. 668.It Fl f 669Display the routing table for a particular 670.Ar address_family . 671.It Fl M 672Use an alternative core 673See 674.Sx GENERAL OPTIONS . 675.It Fl N 676Use an alternative kernel image 677See 678.Sx GENERAL OPTIONS . 679.It Fl j Ar jail 680Run inside a jail. 681See 682.Sx GENERAL OPTIONS . 683.El 684.It Xo 685.Bk -words 686.Nm 687.Fl rs 688.Op Fl s 689.Op Fl M Ar core 690.Op Fl N Ar system 691.Op Fl j Ar jail 692.Ek 693.Xc 694Display routing statistics. 695.Bl -tag -width indent 696.It Fl s 697If 698.Fl s 699is repeated, counters with a value of zero are suppressed. 700.It Fl M 701Use an alternative core 702See 703.Sx GENERAL OPTIONS . 704.It Fl N 705Use an alternative kernel image 706See 707.Sx GENERAL OPTIONS . 708.It Fl j Ar jail 709Run inside a jail. 710See 711.Sx GENERAL OPTIONS . 712.El 713.It Xo 714.Bk -words 715.Nm 716.Fl g 717.Op Fl 46W 718.Op Fl f Ar address_family 719.Op Fl M Ar core 720.Op Fl N Ar system 721.Op Fl j Ar jail 722.Ek 723.Xc 724Display the contents of the multicast virtual interface tables, 725and multicast forwarding caches. 726Entries in these tables will appear only when the kernel is 727actively forwarding multicast sessions. 728This option is applicable only to the 729.Cm inet 730and 731.Cm inet6 732address families. 733.Bl -tag -width indent 734.It Fl 4 735Show IPv4 only 736See 737.Sx GENERAL OPTIONS . 738.It Fl 6 739Show IPv6 only 740See 741.Sx GENERAL OPTIONS . 742.It Fl W 743Avoid truncating addresses even if this causes some fields to overflow. 744.It Fl f Ar protocol_family 745Filter by 746.Ar protocol_family . 747See 748.Sx GENERAL OPTIONS . 749.It Fl M 750Use an alternative core 751See 752.Sx GENERAL OPTIONS . 753.It Fl N 754Use an alternative kernel image 755See 756.Sx GENERAL OPTIONS . 757.It Fl j Ar jail 758Run inside a jail. 759See 760.Sx GENERAL OPTIONS . 761.El 762.It Xo 763.Bk -words 764.Nm 765.Fl gs 766.Op Fl 46s 767.Op Fl f Ar address_family 768.Op Fl M Ar core 769.Op Fl N Ar system 770.Op Fl j Ar jail 771.Ek 772.Xc 773Show multicast routing statistics. 774.Bl -tag -width indent 775.It Fl 4 776Show IPv4 only 777See 778.Sx GENERAL OPTIONS . 779.It Fl 6 780Show IPv6 only 781See 782.Sx GENERAL OPTIONS . 783.It Fl s 784If 785.Fl s 786is repeated, counters with a value of zero are suppressed. 787.It Fl f Ar protocol_family 788Filter by 789.Ar protocol_family . 790See 791.Sx GENERAL OPTIONS . 792.It Fl M 793Use an alternative core 794See 795.Sx GENERAL OPTIONS . 796.It Fl N 797Use an alternative kernel image 798See 799.Sx GENERAL OPTIONS . 800.It Fl j Ar jail 801Run inside a jail. 802See 803.Sx GENERAL OPTIONS . 804.El 805.It Xo 806.Bk -words 807.Nm 808.Fl Q 809.Op Fl j Ar jail 810.Ek 811.Xc 812Show 813.Xr netisr 9 814statistics. 815The flags field shows available ISR handlers: 816.Bl -column ".Li W" ".Dv NETISR_SNP_FLAGS_DRAINEDCPU" 817.It Li C Ta Dv NETISR_SNP_FLAGS_M2CPUID Ta "Able to map mbuf to cpu id" 818.It Li D Ta Dv NETISR_SNP_FLAGS_DRAINEDCPU Ta "Has queue drain handler" 819.It Li F Ta Dv NETISR_SNP_FLAGS_M2FLOW Ta "Able to map mbuf to flow id" 820.It Fl j Ar jail 821Run inside a jail. 822See 823.Sx GENERAL OPTIONS . 824.El 825.El 826.Ss GENERAL OPTIONS 827Some options have the general meaning: 828.Bl -tag -width flag 829.It Fl 4 830Is shorthand for 831.Fl f 832.Ar inet 833.Pq Show only IPv4 834.It Fl 6 835Is shorthand for 836.Fl f 837.Ar inet6 838.Pq Show only IPv6 839.It Fl f Ar address_family , Fl p Ar protocol 840Limit display to those records 841of the specified 842.Ar address_family 843or a single 844.Ar protocol . 845The following address families and protocols are recognized: 846.Pp 847.Bl -tag -width ".Cm netgraph , ng Pq Dv AF_NETGRAPH" -compact 848.It Em Family 849.Em Protocols 850.It Cm inet Pq Dv AF_INET 851.Cm divert , icmp , igmp , ip , ipsec , pim, sctp , tcp , udp 852.It Cm inet6 Pq Dv AF_INET6 853.Cm icmp6 , ip6 , ipsec6 , rip6 , sctp , tcp , udp 854.It Cm pfkey Pq Dv PF_KEY 855.Cm pfkey 856.It Cm netgraph , ng Pq Dv AF_NETGRAPH 857.Cm ctrl , data 858.It Cm unix Pq Dv AF_UNIX 859.It Cm link Pq Dv AF_LINK 860.El 861.Pp 862The program will complain if 863.Ar protocol 864is unknown or if there is no statistics routine for it. 865.It Fl M 866Extract values associated with the name list from the specified core 867instead of the default 868.Pa /dev/kmem . 869.It Fl N 870Extract the name list from the specified system instead of the default, 871which is the kernel image the system has booted from. 872.It Fl n 873Show network addresses and ports as numbers. 874Normally 875.Nm 876attempts to resolve addresses and ports, 877and display them symbolically. 878.It Fl W 879Wider output; expand address fields, etc, to avoid truncation. 880Non-numeric values such as domain names may still be truncated; use the 881.Fl n 882option if necessary to avoid ambiguity. 883.It Fl j Ar jail 884Perform the actions inside the 885.Ar jail . 886This allows network state to be accessed even if the 887.Cm netstat 888binary is not available in the 889.Ar jail . 890.El 891.Sh EXAMPLES 892Show packet traffic information (packets, bytes, errors, packet drops, etc) for 893interface re0 updated every 2 seconds and exit after 5 outputs: 894.Bd -literal -offset indent 895$ netstat -w 2 -q 5 -I re0 896.Ed 897.Pp 898Show statistics for ICMP on any interface: 899.Bd -literal -offset indent 900$ netstat -s -p icmp 901.Ed 902.Pp 903Show routing tables: 904.Bd -literal -offset indent 905$ netstat -r 906.Ed 907.Pp 908Same as above, but without resolving numeric addresses and port numbers to 909names: 910.Bd -literal -offset indent 911$ netstat -rn 912.Ed 913.Sh SEE ALSO 914.Xr fstat 1 , 915.Xr nfsstat 1 , 916.Xr procstat 1 , 917.Xr ps 1 , 918.Xr sockstat 1 , 919.Xr libxo 3 , 920.Xr xo_parse_args 3 , 921.Xr bpf 4 , 922.Xr inet 4 , 923.Xr route 4 , 924.Xr unix 4 , 925.Xr hosts 5 , 926.Xr networks 5 , 927.Xr protocols 5 , 928.Xr services 5 , 929.Xr iostat 8 , 930.Xr route 8 , 931.Xr vmstat 8 , 932.Xr mbuf 9 933.Sh HISTORY 934The 935.Nm 936command appeared in 937.Bx 4.2 . 938.Pp 939IPv6 support was added by WIDE/KAME project. 940.Sh BUGS 941The notion of errors is ill-defined. 942