1.\" Copyright (c) 1983, 1990, 1992, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)netstat.1 8.8 (Berkeley) 4/18/94 33.\" $FreeBSD$ 34.\" 35.Dd June 15, 2001 36.Dt NETSTAT 1 37.Os 38.Sh NAME 39.Nm netstat 40.Nd show network status 41.Sh SYNOPSIS 42.Nm 43.Op Fl AaLlnW 44.Op Fl f Ar address_family | Fl p Ar protocol 45.Op Fl M Ar core 46.Op Fl N Ar system 47.Nm 48.Op Fl gilnsS 49.Op Fl f Ar address_family 50.Op Fl M Ar core 51.Op Fl N Ar system 52.Nm 53.Fl i | I Ar interface 54.Op Fl w Ar wait 55.Op Fl abdgt 56.Op Fl M Ar core 57.Op Fl N Ar system 58.Nm 59.Fl s Op Fl s 60.Op Fl z 61.Op Fl f Ar address_family | Fl p Ar protocol 62.Op Fl M Ar core 63.Op Fl N Ar system 64.Nm 65.Fl i | I Ar interface Fl s 66.Op Fl f Ar address_family | Fl p Ar protocol 67.Op Fl M Ar core 68.Op Fl N Ar system 69.Nm 70.Fl m 71.Op Fl M Ar core 72.Op Fl N Ar system 73.Nm 74.Fl r 75.Op Fl Aaln 76.Op Fl f Ar address_family 77.Op Fl M Ar core 78.Op Fl N Ar system 79.Nm 80.Fl rs 81.Op Fl s 82.Op Fl M Ar core 83.Op Fl N Ar system 84.Sh DESCRIPTION 85The 86.Nm 87command symbolically displays the contents of various network-related 88data structures. 89There are a number of output formats, 90depending on the options for the information presented. 91The first form of the command displays a list of active sockets for 92each protocol. 93The second form presents the contents of one of the other network 94data structures according to the option selected. 95Using the third form, with a 96.Ar wait 97interval specified, 98.Nm 99will continuously display the information regarding packet 100traffic on the configured network interfaces. 101The fourth form displays statistics for 102the specified protocol or address family. 103The fifth form displays per-interface statistics for 104the specified protocol or address family. 105The sixth form displays 106.Xr mbuf 9 107statistics. 108The seventh form displays routing table for the specified address family. 109The eighth form displays routing statistics. 110.Pp 111The options have the following meaning: 112.Bl -tag -width flag 113.It Fl A 114With the default display, 115show the address of any protocol control blocks associated with sockets; used 116for debugging. 117.It Fl a 118With the default display, 119show the state of all sockets; normally sockets used by 120server processes are not shown. 121With the routing table display (option 122.Fl r , 123as described below), show protocol-cloned routes (routes 124generated by a 125.Dv RTF_PRCLONING 126parent route); normally these routes are 127not shown. 128.It Fl b 129With the interface display (option 130.Fl i , 131as described below), 132show the number of bytes in and out. 133.It Fl d 134With either interface display (option 135.Fl i 136or an interval, as described below), 137show the number of dropped packets. 138.It Fl f Ar address_family 139Limit statistics or address control block reports to those 140of the specified 141.Ar address family . 142The following address families 143are recognized: 144.Ar inet , 145for 146.Dv AF_INET , 147.Ar inet6 , 148for 149.Dv AF_INET6 , 150.Ar ipx , 151for 152.Dv AF_IPX , 153.Ar atalk , 154for 155.Dv AF_APPLETALK (ddp) , 156.Ar netgraph 157or 158.Ar ng 159for 160.Dv AF_NETGRAPH , 161.\".Ar ns , 162.\"for 163.\".Dv AF_NS , 164.\".Ar iso , 165.\"for 166.\".Dv AF_ISO , 167and 168.Ar unix , 169for 170.Dv AF_UNIX . 171.It Fl g 172Show information related to multicast (group address) routing. 173By default, show the IP Multicast virtual-interface and routing tables. 174If the 175.Fl s 176option is also present, show multicast routing statistics. 177.It Fl I Ar interface 178Show information about the specified interface; 179used with a 180.Ar wait 181interval as described below. 182If the 183.Fl s 184option is present, show per-interface protocol statistics on the 185.Ar interface 186for the specified 187.Ar address_family 188or 189.Ar protocol , 190or for all protocol families. 191.It Fl i 192Show the state of interfaces which have been auto-configured 193(interfaces statically configured into a system, but not 194located at boot time are not shown). 195If the 196.Fl a 197options is also present, multicast addresses currently in use are shown 198for each Ethernet interface and for each IP interface address. 199Multicast addresses are shown on separate lines following the interface 200address with which they are associated. 201If the 202.Fl s 203option is present, show per-interface statistics on all interfaces 204for the specified 205.Ar address_family 206or 207.Ar protocol , 208or for all protocol families. 209.It Fl L 210Show the size of the various listen queues. 211The first count shows the 212number of unaccepted connections. 213The second count shows the amount of unaccepted incomplete connections. 214The third count is the maximum number of queued connections. 215.It Fl l 216Print full IPv6 address. 217.It Fl M 218Extract values associated with the name list from the specified core 219instead of the default 220.Pa /dev/kmem . 221.It Fl m 222Show statistics recorded by the memory management routines 223(the network manages a private pool of memory buffers). 224.It Fl N 225Extract the name list from the specified system instead of the default 226.Pa /kernel . 227.It Fl n 228Show network addresses and ports as numbers (normally 229.Nm 230interprets addresses and ports and attempts to display them 231symbolically). 232This option may be used with any of the display formats. 233.It Fl p Ar protocol 234Show statistics about 235.Ar protocol , 236which is either a well-known name for a protocol or an alias for it. Some 237protocol names and aliases are listed in the file 238.Pa /etc/protocols . 239The special protocol name 240.Dq bdg 241is used to show bridging statistics. 242A null response typically means that there are no interesting numbers to 243report. 244The program will complain if 245.Ar protocol 246is unknown or if there is no statistics routine for it. 247.It Fl r 248Show the routing tables. 249Use with 250.Fl a 251to show protocol-cloned routes. 252When 253.Fl s 254is also present, show routing statistics instead. 255When 256.Fl l 257is also present, 258.Nm 259assumes more columns are there and the maximum transmission unit 260.Pq Dq mtu 261are also displayed. 262.It Fl S 263Show network addresses as numbers (as with 264.Fl n ) 265but show ports symbolically). 266.It Fl s 267Show per-protocol statistics. 268If this option is repeated, counters with a value of zero are suppressed. 269.It Fl W 270In certain displays, avoid truncating addresses even if this causes 271some fields to overflow. 272.It Fl w Ar wait 273Show network interface statistics at intervals of 274.Ar wait 275seconds. 276.It Fl z 277Reset statistics. 278.El 279.Pp 280The default display, for active sockets, shows the local 281and remote addresses, send and receive queue sizes (in bytes), protocol, 282and the internal state of the protocol. 283Address formats are of the form 284.Dq host.port 285or 286.Dq network.port 287if a socket's address specifies a network but no specific host address. 288When known the host and network addresses are displayed symbolically 289according to the data bases 290.Pa /etc/hosts 291and 292.Pa /etc/networks , 293respectively. If a symbolic name for an address is unknown, or if 294the 295.Fl n 296option is specified, the address is printed numerically, according 297to the address family. 298For more information regarding 299the Internet 300.Dq dot format , 301refer to 302.Xr inet 3 ) . 303Unspecified, 304or 305.Dq wildcard , 306addresses and ports appear as 307.Dq * . 308.Pp 309The interface display provides a table of cumulative 310statistics regarding packets transferred, errors, and collisions. 311The network addresses of the interface 312and the maximum transmission unit 313.Pq Dq mtu 314are also displayed. 315.Pp 316The routing table display indicates the available routes and 317their status. Each route consists of a destination host or network 318and a gateway to use in forwarding packets. The flags field shows 319a collection of information about the route stored as 320binary choices. The individual flags are discussed in more 321detail in the 322.Xr route 8 323and 324.Xr route 4 325manual pages. 326The mapping between letters and flags is: 327.Bl -column XXXX RTF_BLACKHOLE 3281 RTF_PROTO1 Protocol specific routing flag #1 3292 RTF_PROTO2 Protocol specific routing flag #2 3303 RTF_PROTO3 Protocol specific routing flag #3 331B RTF_BLACKHOLE Just discard pkts (during updates) 332b RTF_BROADCAST The route represents a broadcast address 333C RTF_CLONING Generate new routes on use 334c RTF_PRCLONING Protocol-specified generate new routes on use 335D RTF_DYNAMIC Created dynamically (by redirect) 336G RTF_GATEWAY Destination requires forwarding by intermediary 337H RTF_HOST Host entry (net otherwise) 338L RTF_LLINFO Valid protocol to link address translation 339M RTF_MODIFIED Modified dynamically (by redirect) 340R RTF_REJECT Host or net unreachable 341S RTF_STATIC Manually added 342U RTF_UP Route usable 343W RTF_WASCLONED Route was generated as a result of cloning 344X RTF_XRESOLVE External daemon translates proto to link address 345.El 346.Pp 347Direct routes are created for each 348interface attached to the local host; 349the gateway field for such entries shows the address of the outgoing interface. 350The refcnt field gives the 351current number of active uses of the route. Connection oriented 352protocols normally hold on to a single route for the duration of 353a connection while connectionless protocols obtain a route while sending 354to the same destination. 355The use field provides a count of the number of packets 356sent using that route. The interface entry indicates the network 357interface utilized for the route. 358.Pp 359When 360.Nm 361is invoked with the 362.Fl w 363option and a 364.Ar wait 365interval argument, it displays a running count of statistics related to 366network interfaces. 367An obsolescent version of this option used a numeric parameter 368with no option, and is currently supported for backward compatibility. 369By default, this display summarizes information for all interfaces. 370Information for a specific interface may be displayed with the 371.Fl I 372option. 373.Sh SEE ALSO 374.Xr fstat 1 , 375.Xr nfsstat 1 , 376.Xr ps 1 , 377.Xr sockstat 1 , 378.Xr inet 4 , 379.Xr unix 4 , 380.Xr hosts 5 , 381.Xr networks 5 , 382.Xr protocols 5 , 383.Xr services 5 , 384.Xr iostat 8 , 385.Xr trpt 8 , 386.Xr vmstat 8 387.Sh HISTORY 388The 389.Nm 390command appeared in 391.Bx 4.2 . 392.Pp 393IPv6 support was added by WIDE/KAME project. 394.Sh FILES 395.Bl -tag -width /dev/kmem -compact 396.It Pa /kernel 397default kernel namelist 398.It Pa /dev/kmem 399default memory file 400.El 401.Sh BUGS 402The notion of errors is ill-defined. 403