1.\" Copyright (c) 1983, 1990, 1992, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)netstat.1 8.8 (Berkeley) 4/18/94 33.\" $FreeBSD$ 34.\" 35.Dd April 18, 1994 36.Dt NETSTAT 1 37.Os BSD 4.2 38.Sh NAME 39.Nm netstat 40.Nd show network status 41.Sh SYNOPSIS 42.Nm netstat 43.Op Fl Aan 44.Op Fl f Ar address_family 45.Op Fl M Ar core 46.Op Fl N Ar system 47.Nm netstat 48.Op Fl bdghimnrs 49.Op Fl f Ar address_family 50.Op Fl M Ar core 51.Op Fl N Ar system 52.Nm netstat 53.Op Fl bdn 54.Op Fl I Ar interface 55.Op Fl M Ar core 56.Op Fl N Ar system 57.Op Fl w Ar wait 58.Nm netstat 59.Op Fl p Ar protocol 60.Op Fl M Ar core 61.Op Fl N Ar system 62.Sh DESCRIPTION 63The 64.Nm netstat 65command symbolically displays the contents of various network-related 66data structures. 67There are a number of output formats, 68depending on the options for the information presented. 69The first form of the command displays a list of active sockets for 70each protocol. 71The second form presents the contents of one of the other network 72data structures according to the option selected. 73Using the third form, with a 74.Ar wait 75interval specified, 76.Nm netstat 77will continuously display the information regarding packet 78traffic on the configured network interfaces. 79The fourth form displays statistics about the named protocol. 80.Pp 81The options have the following meaning: 82.Bl -tag -width flag 83.It Fl A 84With the default display, 85show the address of any protocol control blocks associated with sockets; used 86for debugging. 87.It Fl a 88With the default display, 89show the state of all sockets; normally sockets used by 90server processes are not shown. 91With the routing table display (option 92.Fl r 93, as described below), show protocol-cloned routes (routes 94generated by a RTF_PRCLONING parent route); normally these routes are 95not shown. 96.It Fl b 97With the interface display (option 98.Fl i 99, as described below), 100show the number of bytes in and out. 101.It Fl d 102With either interface display (option 103.Fl i 104or an interval, as described below), 105show the number of dropped packets. 106.It Fl f Ar address_family 107Limit statistics or address control block reports to those 108of the specified 109.Ar address family . 110The following address families 111are recognized: 112.Ar inet , 113for 114.Dv AF_INET , 115.Ar ipx , 116for 117.Dv AF_IPX , 118.Ar atalk , 119for 120.Dv AF_APPLETALK (ddp) , 121.Ar netgraph 122or 123.Ar ng 124for 125.Dv AF_NETGRAPH , 126.\".Ar ns , 127.\"for 128.\".Dv AF_NS , 129.\".Ar iso , 130.\"for 131.\".Dv AF_ISO , 132and 133.Ar unix , 134for 135.Dv AF_UNIX . 136.It Fl g 137Show information related to multicast (group address) routing. 138By default, show the IP Multicast virtual-interface and routing tables. 139If the 140.Fl s 141option is also present, show multicast routing statistics. 142.It Fl h 143Show the state of the 144.Tn IMP 145host table (obsolete). 146.It Fl I Ar interface 147Show information about the specified interface; 148used with a 149.Ar wait 150interval as described below. 151.It Fl i 152Show the state of interfaces which have been auto-configured 153(interfaces statically configured into a system, but not 154located at boot time are not shown). 155If the 156.Fl a 157options is also present, multicast addresses currently in use are shown 158for each Ethernet interface and for each IP interface address. 159Multicast addresses are shown on separate lines following the interface 160address with which they are associated. 161.It Fl M 162Extract values associated with the name list from the specified core 163instead of the default 164.Pa /dev/kmem . 165.It Fl m 166Show statistics recorded by the memory management routines 167(the network manages a private pool of memory buffers). 168.It Fl N 169Extract the name list from the specified system instead of the default 170.Pa /kernel . 171.It Fl n 172Show network addresses as numbers (normally 173.Nm netstat 174interprets addresses and attempts to display them 175symbolically). 176This option may be used with any of the display formats. 177.It Fl p Ar protocol 178Show statistics about 179.Ar protocol , 180which is either a well-known name for a protocol or an alias for it. Some 181protocol names and aliases are listed in the file 182.Pa /etc/protocols . 183The special protocol name 184.Dq bdg 185is used to show bridging statistics. 186A null response typically means that there are no interesting numbers to 187report. 188The program will complain if 189.Ar protocol 190is unknown or if there is no statistics routine for it. 191.It Fl s 192Show per-protocol statistics. 193If this option is repeated, counters with a value of zero are suppressed. 194.It Fl r 195Show the routing tables. 196Use with 197.Fl a 198to show protocol-cloned routes. 199When 200.Fl s 201is also present, show routing statistics instead. 202.It Fl w Ar wait 203Show network interface statistics at intervals of 204.Ar wait 205seconds. 206.El 207.Pp 208The default display, for active sockets, shows the local 209and remote addresses, send and receive queue sizes (in bytes), protocol, 210and the internal state of the protocol. 211Address formats are of the form 212.Dq host.port 213or 214.Dq network.port 215if a socket's address specifies a network but no specific host address. 216When known the host and network addresses are displayed symbolically 217according to the data bases 218.Pa /etc/hosts 219and 220.Pa /etc/networks , 221respectively. If a symbolic name for an address is unknown, or if 222the 223.Fl n 224option is specified, the address is printed numerically, according 225to the address family. 226For more information regarding 227the Internet 228.Dq dot format , 229refer to 230.Xr inet 3 ) . 231Unspecified, 232or 233.Dq wildcard , 234addresses and ports appear as 235.Dq * . 236.Pp 237The interface display provides a table of cumulative 238statistics regarding packets transferred, errors, and collisions. 239The network addresses of the interface 240and the maximum transmission unit 241.Pq Dq mtu 242are also displayed. 243.Pp 244The routing table display indicates the available routes and 245their status. Each route consists of a destination host or network 246and a gateway to use in forwarding packets. The flags field shows 247a collection of information about the route stored as 248binary choices. The individual flags are discussed in more 249detail in the 250.Xr route 8 251and 252.Xr route 4 253manual pages. 254The mapping between letters and flags is: 255.Bl -column XXXX RTF_BLACKHOLE 2561 RTF_PROTO1 Protocol specific routing flag #1 2572 RTF_PROTO2 Protocol specific routing flag #2 2583 RTF_PROTO3 Protocol specific routing flag #3 259B RTF_BLACKHOLE Just discard pkts (during updates) 260b RTF_BROADCAST The route represents a broadcast address 261C RTF_CLONING Generate new routes on use 262c RTF_PRCLONING Protocol-specified generate new routes on use 263D RTF_DYNAMIC Created dynamically (by redirect) 264G RTF_GATEWAY Destination requires forwarding by intermediary 265H RTF_HOST Host entry (net otherwise) 266L RTF_LLINFO Valid protocol to link address translation 267M RTF_MODIFIED Modified dynamically (by redirect) 268R RTF_REJECT Host or net unreachable 269S RTF_STATIC Manually added 270U RTF_UP Route usable 271W RTF_WASCLONED Route was generated as a result of cloning 272X RTF_XRESOLVE External daemon translates proto to link address 273.El 274.Pp 275Direct routes are created for each 276interface attached to the local host; 277the gateway field for such entries shows the address of the outgoing interface. 278The refcnt field gives the 279current number of active uses of the route. Connection oriented 280protocols normally hold on to a single route for the duration of 281a connection while connectionless protocols obtain a route while sending 282to the same destination. 283The use field provides a count of the number of packets 284sent using that route. The interface entry indicates the network 285interface utilized for the route. 286.Pp 287When 288.Nm netstat 289is invoked with the 290.Fl w 291option and a 292.Ar wait 293interval argument, it displays a running count of statistics related to 294network interfaces. 295An obsolescent version of this option used a numeric parameter 296with no option, and is currently supported for backward compatibility. 297By default, this display summarizes information for all interfaces. 298Information for a specific interface may be displayed with the 299.Fl I 300option. 301.Sh SEE ALSO 302.Xr fstat 1 , 303.Xr nfsstat 1 , 304.Xr sockstat 1 , 305.Xr ps 1 , 306.Xr inet 4 , 307.Xr unix 4 , 308.Xr hosts 5 , 309.Xr networks 5 , 310.Xr protocols 5 , 311.Xr services 5 , 312.Xr iostat 8 , 313.Xr trpt 8 , 314.Xr vmstat 8 315.Sh HISTORY 316The 317.Nm netstat 318command appeared in 319.Bx 4.2 . 320.Sh FILES 321.Bl -tag -width /dev/kmem -compact 322.It Pa /kernel 323default kernel namelist 324.It Pa /dev/kmem 325default memory file 326.El 327.Sh BUGS 328The notion of errors is ill-defined. 329