1.\" Copyright (c) 1983, 1990, 1992, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)netstat.1 8.8 (Berkeley) 4/18/94 33.\" 34.Dd April 18, 1994 35.Dt NETSTAT 1 36.Os BSD 4.2 37.Sh NAME 38.Nm netstat 39.Nd show network status 40.Sh SYNOPSIS 41.Nm netstat 42.Op Fl Aan 43.Op Fl f Ar address_family 44.Op Fl M Ar core 45.Op Fl N Ar system 46.Nm netstat 47.Op Fl bdghimnrs 48.Op Fl f Ar address_family 49.Op Fl M Ar core 50.Op Fl N Ar system 51.Nm netstat 52.Op Fl bdn 53.Op Fl I Ar interface 54.Op Fl M Ar core 55.Op Fl N Ar system 56.Op Fl w Ar wait 57.Nm netstat 58.Op Fl p Ar protocol 59.Op Fl M Ar core 60.Op Fl N Ar system 61.Sh DESCRIPTION 62The 63.Nm netstat 64command symbolically displays the contents of various network-related 65data structures. 66There are a number of output formats, 67depending on the options for the information presented. 68The first form of the command displays a list of active sockets for 69each protocol. 70The second form presents the contents of one of the other network 71data structures according to the option selected. 72Using the third form, with a 73.Ar wait 74interval specified, 75.Nm netstat 76will continuously display the information regarding packet 77traffic on the configured network interfaces. 78The fourth form displays statistics about the named protocol. 79.Pp 80The options have the following meaning: 81.Bl -tag -width flag 82.It Fl A 83With the default display, 84show the address of any protocol control blocks associated with sockets; used 85for debugging. 86.It Fl a 87With the default display, 88show the state of all sockets; normally sockets used by 89server processes are not shown. 90.It Fl b 91With the interface display (option 92.Fl i 93, as described below), 94show the number of bytes in and out. 95.It Fl d 96With either interface display (option 97.Fl i 98or an interval, as described below), 99show the number of dropped packets. 100.It Fl f Ar address_family 101Limit statistics or address control block reports to those 102of the specified 103.Ar address family . 104The following address families 105are recognized: 106.Ar inet , 107for 108.Dv AF_INET , 109.Ar ipx , 110for 111.Dv AF_IPX , 112.Ar atalk , 113for 114.Dv AF_APPLETALK (ddp) , 115.\".Ar ns , 116.\"for 117.\".Dv AF_NS , 118.\".Ar iso , 119.\"for 120.\".Dv AF_ISO , 121and 122.Ar unix , 123for 124.Dv AF_UNIX . 125.It Fl g 126Show information related to multicast (group address) routing. 127By default, show the IP Multicast virtual-interface and routing tables. 128If the 129.Fl s 130option is also present, show multicast routing statistics. 131.It Fl h 132Show the state of the 133.Tn IMP 134host table (obsolete). 135.It Fl I Ar interface 136Show information about the specified interface; 137used with a 138.Ar wait 139interval as described below. 140.It Fl i 141Show the state of interfaces which have been auto-configured 142(interfaces statically configured into a system, but not 143located at boot time are not shown). 144If the 145.Fl a 146options is also present, multicast addresses currently in use are shown 147for each Ethernet interface and for each IP interface address. 148Multicast addresses are shown on separate lines following the interface 149address with which they are associated. 150.It Fl M 151Extract values associated with the name list from the specified core 152instead of the default 153.Pa /dev/kmem . 154.It Fl m 155Show statistics recorded by the memory management routines 156(the network manages a private pool of memory buffers). 157.It Fl N 158Extract the name list from the specified system instead of the default 159.Pa /kernel . 160.It Fl n 161Show network addresses as numbers (normally 162.Nm netstat 163interprets addresses and attempts to display them 164symbolically). 165This option may be used with any of the display formats. 166.It Fl p Ar protocol 167Show statistics about 168.Ar protocol , 169which is either a well-known name for a protocol or an alias for it. Some 170protocol names and aliases are listed in the file 171.Pa /etc/protocols . 172The special protocol name ``bdg'' 173is used to show bridging statistics. 174A null response typically means that there are no interesting numbers to 175report. 176The program will complain if 177.Ar protocol 178is unknown or if there is no statistics routine for it. 179.It Fl s 180Show per-protocol statistics. 181If this option is repeated, counters with a value of zero are suppressed. 182.It Fl r 183Show the routing tables. 184When 185.Fl s 186is also present, show routing statistics instead. 187.It Fl w Ar wait 188Show network interface statistics at intervals of 189.Ar wait 190seconds. 191.El 192.Pp 193The default display, for active sockets, shows the local 194and remote addresses, send and receive queue sizes (in bytes), protocol, 195and the internal state of the protocol. 196Address formats are of the form ``host.port'' or ``network.port'' 197if a socket's address specifies a network but no specific host address. 198When known the host and network addresses are displayed symbolically 199according to the data bases 200.Pa /etc/hosts 201and 202.Pa /etc/networks , 203respectively. If a symbolic name for an address is unknown, or if 204the 205.Fl n 206option is specified, the address is printed numerically, according 207to the address family. 208For more information regarding 209the Internet ``dot format,'' 210refer to 211.Xr inet 3 ) . 212Unspecified, 213or ``wildcard'', addresses and ports appear as ``*''. 214.Pp 215The interface display provides a table of cumulative 216statistics regarding packets transferred, errors, and collisions. 217The network addresses of the interface 218and the maximum transmission unit (``mtu'') are also displayed. 219.Pp 220The routing table display indicates the available routes and 221their status. Each route consists of a destination host or network 222and a gateway to use in forwarding packets. The flags field shows 223a collection of information about the route stored as 224binary choices. The individual flags are discussed in more 225detail in the 226.Xr route 8 227and 228.Xr route 4 229manual pages. 230The mapping between letters and flags is: 231.Bl -column XXXX RTF_BLACKHOLE 2321 RTF_PROTO1 Protocol specific routing flag #1 2332 RTF_PROTO2 Protocol specific routing flag #2 2343 RTF_PROTO3 Protocol specific routing flag #3 235B RTF_BLACKHOLE Just discard pkts (during updates) 236b RTF_BROADCAST The route represents a broadcast address 237C RTF_CLONING Generate new routes on use 238c RTF_PRCLONING Protocol-specified generate new routes on use 239D RTF_DYNAMIC Created dynamically (by redirect) 240G RTF_GATEWAY Destination requires forwarding by intermediary 241H RTF_HOST Host entry (net otherwise) 242L RTF_LLINFO Valid protocol to link address translation 243M RTF_MODIFIED Modified dynamically (by redirect) 244R RTF_REJECT Host or net unreachable 245S RTF_STATIC Manually added 246U RTF_UP Route usable 247W RTF_WASCLONED Route was generated as a result of cloning 248X RTF_XRESOLVE External daemon translates proto to link address 249.El 250.Pp 251Direct routes are created for each 252interface attached to the local host; 253the gateway field for such entries shows the address of the outgoing interface. 254The refcnt field gives the 255current number of active uses of the route. Connection oriented 256protocols normally hold on to a single route for the duration of 257a connection while connectionless protocols obtain a route while sending 258to the same destination. 259The use field provides a count of the number of packets 260sent using that route. The interface entry indicates the network 261interface utilized for the route. 262.Pp 263When 264.Nm netstat 265is invoked with the 266.Fl w 267option and a 268.Ar wait 269interval argument, it displays a running count of statistics related to 270network interfaces. 271An obsolescent version of this option used a numeric parameter 272with no option, and is currently supported for backward compatibility. 273By default, this display summarizes information for all interfaces. 274Information for a specific interface may be displayed with the 275.Fl I 276option. 277.Sh SEE ALSO 278.Xr nfsstat 1 , 279.Xr ps 1 , 280.Xr hosts 5 , 281.Xr networks 5 , 282.Xr protocols 5 , 283.Xr services 5 , 284.Xr iostat 8 , 285.Xr trpt 8 , 286.Xr vmstat 8 287.Sh HISTORY 288The 289.Nm netstat 290command appeared in 291.Bx 4.2 . 292.\" .Sh FILES 293.\" .Bl -tag -width /dev/kmem -compact 294.\" .It Pa /kernel 295.\" default kernel namelist 296.\" .It Pa /dev/kmem 297.\" default memory file 298.\" .El 299.Sh BUGS 300The notion of errors is ill-defined. 301