1.\" Copyright (c) 1983, 1990, 1992, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.Dd July 16, 2025 29.Dt NETSTAT 1 30.Os 31.Sh NAME 32.Nm netstat 33.Nd show network status and statistics 34.Sh SYNOPSIS 35.Bk -words 36.Bl -tag -width "netstat" 37.It Nm 38.Op Fl j Ar jail 39.Op Fl -libxo 40.Op Fl 46AaCLnPRSTWx 41.Op Fl f Ar protocol_family | Fl p Ar protocol 42.It Nm Fl i | I Ar interface 43.Op Fl j Ar jail 44.Op Fl -libxo 45.Op Fl 46abdhnW 46.Op Fl f Ar address_family 47.Op Fl M Ar core 48.Op Fl N Ar system 49.It Nm Fl w Ar wait 50.Op Fl j Ar jail 51.Op Fl -libxo 52.Op Fl I Ar interface 53.Op Fl 46d 54.Op Fl M Ar core 55.Op Fl N Ar system 56.Op Fl q Ar howmany 57.It Nm Fl s 58.Op Fl j Ar jail 59.Op Fl -libxo 60.Op Fl 46sz 61.Op Fl f Ar protocol_family | Fl p Ar protocol 62.Op Fl M Ar core 63.Op Fl N Ar system 64.It Nm Fl i | I Ar interface Fl s 65.Op Fl j Ar jail 66.Op Fl -libxo 67.Op Fl 46s 68.Op Fl f Ar protocol_family | Fl p Ar protocol 69.Op Fl M Ar core 70.Op Fl N Ar system 71.It Nm Fl m 72.Op Fl j Ar jail 73.Op Fl -libxo 74.Op Fl M Ar core 75.Op Fl N Ar system 76.It Nm Fl B 77.Op Fl j Ar jail 78.Op Fl -libxo 79.Op Fl z 80.Op Fl I Ar interface 81.It Nm Fl r 82.Op Fl j Ar jail 83.Op Fl -libxo 84.Op Fl 46nW 85.Op Fl F Ar fibnum 86.Op Fl f Ar address_family 87.It Nm Fl rs 88.Op Fl j Ar jail 89.Op Fl -libxo 90.Op Fl s 91.Op Fl M Ar core 92.Op Fl N Ar system 93.It Nm Fl g 94.Op Fl j Ar jail 95.Op Fl -libxo 96.Op Fl 46W 97.Op Fl f Ar address_family 98.It Nm Fl gs 99.Op Fl j Ar jail 100.Op Fl -libxo 101.Op Fl 46s 102.Op Fl f Ar address_family 103.Op Fl M Ar core 104.Op Fl N Ar system 105.It Nm Fl Q 106.Op Fl j Ar jail 107.Op Fl -libxo 108.It Nm Fl o 109.Fl 4 | Fl 6 110.It Nm Fl O 111.Fl 4 | Fl 6 112.El 113.Ek 114.Sh DESCRIPTION 115The 116.Nm 117command shows the contents of various network-related 118data structures. 119The arguments passed determine which of the below output formats the 120command uses. 121.Bl -tag -width indent 122.It Xo 123.Bk -words 124.Nm 125.Op Fl 46AaCLnRSTWx 126.Op Fl f Ar protocol_family | Fl p Ar protocol 127.Op Fl j Ar jail 128.Ek 129.Xc 130Display a list of active sockets 131(protocol control blocks) 132for each network protocol. 133.Pp 134The default display for active sockets shows the local 135and remote addresses, send and receive queue sizes (in bytes), protocol, 136and the internal state of the protocol. 137Address formats are of the form 138.Dq host.port 139or 140.Dq network.port 141if a socket's address specifies a network but no specific host address. 142When known, the host and network addresses are displayed symbolically 143according to the databases 144.Xr hosts 5 145and 146.Xr networks 5 , 147respectively. 148If a symbolic name for an address is unknown, or if 149the 150.Fl n 151option is specified, the address is printed numerically, according 152to the address family. 153For more information regarding 154the Internet IPv4 155.Dq dot format , 156refer to 157.Xr inet 3 . 158Unspecified, 159or 160.Dq wildcard , 161addresses and ports appear as 162.Dq Li * . 163.Bl -tag -width indent 164.It Fl -libxo 165Generate output via 166.Xr libxo 3 167in a selection of different human and machine readable formats. 168See 169.Xr xo_options 7 170for details on command line arguments. 171.It Fl 4 172Show IPv4 only. 173See 174.Sx GENERAL OPTIONS . 175.It Fl 6 176Show IPv6 only. 177See 178.Sx GENERAL OPTIONS . 179.It Fl A 180Show the address of a protocol control block (PCB) 181associated with a socket; used for debugging. 182.It Fl a 183Show the state of all sockets; 184normally sockets used by server processes are not shown. 185.It Fl c 186Show the used TCP stack for each session. 187.It Fl C 188Show the congestion control algorithm and diagnostic information of TCP sockets. 189.It Fl L 190Show the size of the various listen queues. 191The first count shows the number of unaccepted connections, 192the second count shows the amount of unaccepted incomplete connections, 193and the third count is the maximum number of queued connections. 194.It Fl n 195Do not resolve numeric addresses and port numbers to names. 196See 197.Sx GENERAL OPTIONS . 198.It Fl P 199Display the log ID for each socket. 200.It Fl R 201Display the flowid and flowtype for each socket. 202flowid is a 32 bit hardware specific identifier for each flow. 203flowtype defines which protocol fields are hashed to produce the id. 204A complete listing is available in 205.Pa sys/mbuf.h 206under 207.Dv M_HASHTYPE_* . 208.It Fl S 209Show network addresses as numbers (as with 210.Fl n ) 211but show ports symbolically. 212.It Fl T 213Display diagnostic information from the TCP control block. 214Fields include the number of packets requiring retransmission, 215received out-of-order, and those advertising a zero-sized window. 216.It Fl W 217Avoid truncating addresses even if this causes some fields to overflow. 218.It Fl x 219Display socket buffer and TCP timer statistics for each 220internet socket. 221.Pp 222The 223.Fl x 224flag causes 225.Nm 226to output all the information recorded about data 227stored in the socket buffers. 228The fields are: 229.Bl -column ".Li R-HIWA" 230.It Li R-HIWA Ta Receive buffer high water mark, in bytes. 231.It Li S-HIWA Ta Send buffer high water mark, in bytes. 232.It Li R-LOWA Ta Receive buffer low water mark, in bytes. 233.It Li S-LOWA Ta Send buffer low water mark, in bytes. 234.It Li R-BCNT Ta Receive buffer byte count. 235.It Li S-BCNT Ta Send buffer byte count. 236.It Li R-BMAX Ta Maximum bytes that can be used in the receive buffer. 237.It Li S-BMAX Ta Maximum bytes that can be used in the send buffer. 238.It Li rexmt Ta Time, in seconds, to fire Retransmit Timer, or 0 if not armed. 239.It Li persist Ta Time, in seconds, to fire Retransmit Persistence, or 0 if not armed. 240.It Li keep Ta Time, in seconds, to fire Keep Alive, or 0 if not armed. 241.It Li 2msl Ta Time, in seconds, to fire 2*msl TIME_WAIT Timer, or 0 if not armed. 242.It Li delack Ta Time, in seconds, to fire Delayed ACK Timer, or 0 if not armed. 243.It Li rcvtime Ta Time, in seconds, since last packet received. 244.El 245.It Fl f Ar protocol_family 246Filter by 247.Ar protocol_family . 248See 249.Sx GENERAL OPTIONS . 250.It Fl p Ar protocol 251Filter by 252.Ar protocol . 253See 254.Sx GENERAL OPTIONS . 255.It Fl j Ar jail 256Run inside a jail. 257See 258.Sx GENERAL OPTIONS . 259.El 260.It Xo 261.Bk -words 262.Nm 263.Fl i | I Ar interface 264.Op Fl 46abdhnW 265.Op Fl f Ar address_family 266.Op Fl M Ar core 267.Op Fl N Ar system 268.Op Fl j Ar jail 269.Ek 270.Xc 271Show the state of all network interfaces or a single 272.Ar interface 273which have been auto-configured 274(interfaces statically configured into a system, but not 275located at boot time are not shown). 276An asterisk 277.Pq Dq Li * 278after an interface name indicates that the interface is 279.Dq down . 280.Pp 281When 282.Nm 283is invoked with 284.Fl i 285.Pq all interfaces 286or 287.Fl I Ar interface , 288it provides a table of cumulative 289statistics regarding packets transferred, errors, and collisions. 290The network addresses of the interface 291and the maximum transmission unit 292.Pq Dq mtu 293are also displayed. 294If both 295.Fl i 296and 297.Fl I 298are specified, 299.Fl I 300overrides any instances of 301.Fl i . 302.Bl -tag -width indent 303.It Fl 4 304Show IPv4 only. 305See 306.Sx GENERAL OPTIONS . 307.It Fl 6 308Show IPv6 only. 309See 310.Sx GENERAL OPTIONS . 311.It Fl a 312Multicast addresses currently in use are shown 313for each Ethernet interface and for each IP interface address. 314Multicast addresses are shown on separate lines following the interface 315address with which they are associated. 316.It Fl b 317Show the number of bytes in and out. 318.It Fl d 319Show the number of dropped output packets. 320.It Fl h 321Print all counters in human readable form. 322.It Fl n 323Do not resolve numeric addresses and port numbers to names. 324See 325.Sx GENERAL OPTIONS . 326.It Fl W 327Avoid truncating addresses even if this causes some fields to overflow. 328See 329.Sx GENERAL OPTIONS . 330However, in most cases field widths are determined automatically with the 331.Fl i 332option, and this option has little effect. 333.It Fl f Ar protocol_family 334Filter by 335.Ar protocol_family . 336See 337.Sx GENERAL OPTIONS . 338.It Fl j Ar jail 339Run inside a jail. 340See 341.Sx GENERAL OPTIONS . 342.El 343.It Xo 344.Bk -words 345.Nm 346.Fl w Ar wait 347.Op Fl I Ar interface 348.Op Fl 46d 349.Op Fl M Ar core 350.Op Fl N Ar system 351.Op Fl q Ar howmany 352.Op Fl j Ar jail 353.Ek 354.Xc 355At intervals of 356.Ar wait 357seconds, display the information regarding packet traffic on all 358configured network interfaces or a single 359.Ar interface . 360.Pp 361When 362.Nm 363is invoked with the 364.Fl w 365option and a 366.Ar wait 367interval argument, it displays a running count of statistics related to 368network interfaces. 369An obsolescent version of this option used a numeric parameter 370with no option, and is currently supported for backward compatibility. 371By default, this display summarizes information for all interfaces. 372Information for a specific interface may be displayed with the 373.Fl I Ar interface 374option. 375.Bl -tag -width indent 376.It Fl I Ar interface 377Only show information regarding 378.Ar interface 379.It Fl 4 380Show IPv4 only. 381See 382.Sx GENERAL OPTIONS . 383.It Fl 6 384Show IPv6 only. 385See 386.Sx GENERAL OPTIONS . 387.It Fl d 388Show the number of dropped output packets. 389.It Fl M 390Use an alternative core. 391See 392.Sx GENERAL OPTIONS . 393.It Fl N 394Use an alternative kernel image. 395See 396.Sx GENERAL OPTIONS . 397.It Fl q 398Exit after 399.Ar howmany 400outputs. 401.It Fl j Ar jail 402Run inside a jail. 403See 404.Sx GENERAL OPTIONS . 405.El 406.It Xo 407.Bk -words 408.Nm netstat 409.Fl o 410.Fl 4 | Fl 6 411.Ek 412.Xc 413Print nexthop (nhops) information associated with routing entries. 414When used with 415.Fl 4 416or 417.Fl 6 , 418limit the output to IPv4 or IPv6 routes respectively. 419This option provides details about individual nexthop addresses 420used in routing decisions. 421.It Xo 422.Bk -words 423.Nm netstat 424.Fl O 425.Fl 4 | Fl 6 426.Ek 427.Xc 428Print nexthop groups (nhgrp) information associated with routing entries. 429When used with 430.Fl 4 431or 432.Fl 6 , 433restrict the output to IPv4 or IPv6 nexthop groups respectively. 434This option shows grouped nexthop entries for multipath or 435load-balanced routing setups. 436.It Xo 437.Bk -words 438.Nm 439.Fl s 440.Op Fl 46sz 441.Op Fl f Ar protocol_family | Fl p Ar protocol 442.Op Fl M Ar core 443.Op Fl N Ar system 444.Op Fl j Ar jail 445.Ek 446.Xc 447Display system-wide statistics for each network protocol. 448.Bl -tag -width indent 449.It Fl 4 450Show IPv4 only. 451See 452.Sx GENERAL OPTIONS . 453.It Fl 6 454Show IPv6 only. 455See 456.Sx GENERAL OPTIONS . 457.It Fl s 458If 459.Fl s 460is repeated, counters with a value of zero are suppressed. 461.It Fl z 462Reset statistic counters after displaying them. 463.It Fl f Ar protocol_family 464Filter by 465.Ar protocol_family . 466See 467.Sx GENERAL OPTIONS . 468.It Fl p Ar protocol 469Filter by 470.Ar protocol . 471See 472.Sx GENERAL OPTIONS . 473.It Fl M 474Use an alternative core. 475See 476.Sx GENERAL OPTIONS . 477.It Fl N 478Use an alternative kernel image 479See 480.Sx GENERAL OPTIONS . 481.It Fl j Ar jail 482Run inside a jail. 483See 484.Sx GENERAL OPTIONS . 485.El 486.It Xo 487.Bk -words 488.Nm 489.Fl i | I Ar interface Fl s 490.Op Fl 46s 491.Op Fl f Ar protocol_family | Fl p Ar protocol 492.Op Fl M Ar core 493.Op Fl N Ar system 494.Op Fl j Ar jail 495.Ek 496.Xc 497Display per-interface statistics for each network protocol. 498If both 499.Fl i 500and 501.Fl I 502are specified, 503.Fl I 504overrides any instances of 505.Fl i . 506.Bl -tag -width indent 507.It Fl 4 508Show IPv4 only 509See 510.Sx GENERAL OPTIONS . 511.It Fl 6 512Show IPv6 only 513See 514.Sx GENERAL OPTIONS . 515.It Fl s 516If 517.Fl s 518is repeated, counters with a value of zero are suppressed. 519.It Fl f Ar protocol_family 520Filter by 521.Ar protocol_family . 522See 523.Sx GENERAL OPTIONS . 524.It Fl p Ar protocol 525Filter by 526.Ar protocol . 527See 528.Sx GENERAL OPTIONS . 529.It Fl M 530Use an alternative core 531See 532.Sx GENERAL OPTIONS . 533.It Fl N 534Use an alternative kernel image 535See 536.Sx GENERAL OPTIONS . 537.It Fl j Ar jail 538Run inside a jail. 539See 540.Sx GENERAL OPTIONS . 541.El 542.It Xo 543.Bk -words 544.Nm 545.Fl m 546.Op Fl M Ar core 547.Op Fl N Ar system 548.Op Fl j Ar jail 549.Ek 550.Xc 551Show statistics recorded by the memory management routines 552.Pq Xr mbuf 9 . 553The network manages a private pool of memory buffers. 554.Bl -tag -width indent 555.It Fl M 556Use an alternative core 557See 558.Sx GENERAL OPTIONS . 559.It Fl N 560Use an alternative kernel image 561See 562.Sx GENERAL OPTIONS . 563.It Fl j Ar jail 564Run inside a jail. 565See 566.Sx GENERAL OPTIONS . 567.El 568.It Xo 569.Bk -words 570.Nm 571.Fl B 572.Op Fl z 573.Op Fl I Ar interface 574.Op Fl j Ar jail 575.Ek 576.Xc 577Show statistics about 578.Xr bpf 4 579peers. 580This includes information like 581how many packets have been matched, dropped and received by the 582bpf device, also information about current buffer sizes and device 583states. 584.Pp 585The 586.Xr bpf 4 587flags displayed when 588.Nm 589is invoked with the 590.Fl B 591option represent the underlying parameters of the bpf peer. 592Each flag is 593represented as a single lower case letter. 594The mapping between the letters and flags in order of appearance are: 595.Bl -column ".Li i" 596.It Li p Ta Set if listening promiscuously 597.It Li i Ta Dv BIOCIMMEDIATE No has been set on the device 598.It Li f Ta Dv BIOCGHDRCMPLT No status: source link addresses are being 599filled automatically 600.It Li s Ta Dv BIOCGSEESENT No status: see packets originating locally and 601remotely on the interface. 602.It Li a Ta Packet reception generates a signal 603.It Li l Ta Dv BIOCLOCK No status: descriptor has been locked 604.El 605.Pp 606For more information about these flags, please refer to 607.Xr bpf 4 . 608.Bl -tag -width indent 609.It Fl z 610Reset statistic counters after displaying them. 611.It Fl j Ar jail 612Run inside a jail. 613See 614.Sx GENERAL OPTIONS . 615.El 616.It Xo 617.Bk -words 618.Nm 619.Fl r 620.Op Fl 46AnW 621.Op Fl F Ar fibnum 622.Op Fl f Ar address_family 623.Op Fl M Ar core 624.Op Fl N Ar system 625.Op Fl j Ar jail 626.Ek 627.Xc 628Display the contents of routing tables. 629.Pp 630When 631.Nm 632is invoked with the routing table option 633.Fl r , 634it lists the available routes and their status. 635Each route consists of a destination host or network, and a gateway to use 636in forwarding packets. 637The flags field shows a collection of information about the route stored 638as binary choices. 639The individual flags are discussed in more detail in the 640.Xr route 8 641and 642.Xr route 4 643manual pages. 644The mapping between letters and flags is: 645.Bl -column ".Li W" ".Dv RTF_WASCLONED" 646.It Li 1 Ta Dv RTF_PROTO1 Ta "Protocol specific routing flag #1" 647.It Li 2 Ta Dv RTF_PROTO2 Ta "Protocol specific routing flag #2" 648.It Li 3 Ta Dv RTF_PROTO3 Ta "Protocol specific routing flag #3" 649.It Li B Ta Dv RTF_BLACKHOLE Ta "Just discard pkts (during updates)" 650.It Li b Ta Dv RTF_BROADCAST Ta "The route represents a broadcast address" 651.It Li D Ta Dv RTF_DYNAMIC Ta "Created dynamically (by redirect)" 652.It Li G Ta Dv RTF_GATEWAY Ta "Destination requires forwarding by intermediary" 653.It Li H Ta Dv RTF_HOST Ta "Host entry (net otherwise)" 654.It Li L Ta Dv RTF_LLINFO Ta "Valid protocol to link address translation" 655.It Li M Ta Dv RTF_MODIFIED Ta "Modified dynamically (by redirect)" 656.It Li R Ta Dv RTF_REJECT Ta "Host or net unreachable" 657.It Li S Ta Dv RTF_STATIC Ta "Manually added" 658.It Li U Ta Dv RTF_UP Ta "Route usable" 659.It Li X Ta Dv RTF_XRESOLVE Ta "External daemon translates proto to link address" 660.El 661.Pp 662Direct routes are created for each 663interface attached to the local host; 664the gateway field for such entries shows the address of the outgoing interface. 665The refcnt field gives the 666current number of active uses of the route. 667Connection oriented 668protocols normally hold on to a single route for the duration of 669a connection while connectionless protocols obtain a route while sending 670to the same destination. 671The use field provides a count of the number of packets 672sent using that route. 673The interface entry indicates the network interface utilized for the route. 674.Bl -tag -width indent 675.It Fl 4 676Show IPv4 only. 677See 678.Sx GENERAL OPTIONS . 679.It Fl 6 680Show IPv6 only. 681See 682.Sx GENERAL OPTIONS . 683.It Fl n 684Do not resolve numeric addresses and port numbers to names. 685See 686.Sx GENERAL OPTIONS . 687.It Fl W 688Show the path MTU for each route, and print interface names with a 689wider field size. 690.It Fl F 691Display the routing table with the number 692.Ar fibnum . 693If the specified 694.Ar fibnum 695is -1 or 696.Fl F 697is not specified, 698the default routing table is displayed. 699.It Fl f 700Display the routing table for a particular 701.Ar address_family . 702.It Fl M 703Use an alternative core 704See 705.Sx GENERAL OPTIONS . 706.It Fl N 707Use an alternative kernel image 708See 709.Sx GENERAL OPTIONS . 710.It Fl j Ar jail 711Run inside a jail. 712See 713.Sx GENERAL OPTIONS . 714.El 715.It Xo 716.Bk -words 717.Nm 718.Fl rs 719.Op Fl s 720.Op Fl M Ar core 721.Op Fl N Ar system 722.Op Fl j Ar jail 723.Ek 724.Xc 725Display routing statistics. 726.Bl -tag -width indent 727.It Fl s 728If 729.Fl s 730is repeated, counters with a value of zero are suppressed. 731.It Fl M 732Use an alternative core 733See 734.Sx GENERAL OPTIONS . 735.It Fl N 736Use an alternative kernel image 737See 738.Sx GENERAL OPTIONS . 739.It Fl j Ar jail 740Run inside a jail. 741See 742.Sx GENERAL OPTIONS . 743.El 744.It Xo 745.Bk -words 746.Nm 747.Fl g 748.Op Fl 46W 749.Op Fl f Ar address_family 750.Op Fl M Ar core 751.Op Fl N Ar system 752.Op Fl j Ar jail 753.Ek 754.Xc 755Display the contents of the multicast virtual interface tables, 756and multicast forwarding caches. 757Entries in these tables will appear only when the kernel is 758actively forwarding multicast sessions. 759This option is applicable only to the 760.Cm inet 761and 762.Cm inet6 763address families. 764.Bl -tag -width indent 765.It Fl 4 766Show IPv4 only 767See 768.Sx GENERAL OPTIONS . 769.It Fl 6 770Show IPv6 only 771See 772.Sx GENERAL OPTIONS . 773.It Fl W 774Avoid truncating addresses even if this causes some fields to overflow. 775.It Fl f Ar protocol_family 776Filter by 777.Ar protocol_family . 778See 779.Sx GENERAL OPTIONS . 780.It Fl M 781Use an alternative core 782See 783.Sx GENERAL OPTIONS . 784.It Fl N 785Use an alternative kernel image 786See 787.Sx GENERAL OPTIONS . 788.It Fl j Ar jail 789Run inside a jail. 790See 791.Sx GENERAL OPTIONS . 792.El 793.It Xo 794.Bk -words 795.Nm 796.Fl gs 797.Op Fl 46s 798.Op Fl f Ar address_family 799.Op Fl M Ar core 800.Op Fl N Ar system 801.Op Fl j Ar jail 802.Ek 803.Xc 804Show multicast routing statistics. 805.Bl -tag -width indent 806.It Fl 4 807Show IPv4 only 808See 809.Sx GENERAL OPTIONS . 810.It Fl 6 811Show IPv6 only 812See 813.Sx GENERAL OPTIONS . 814.It Fl s 815If 816.Fl s 817is repeated, counters with a value of zero are suppressed. 818.It Fl f Ar protocol_family 819Filter by 820.Ar protocol_family . 821See 822.Sx GENERAL OPTIONS . 823.It Fl M 824Use an alternative core 825See 826.Sx GENERAL OPTIONS . 827.It Fl N 828Use an alternative kernel image 829See 830.Sx GENERAL OPTIONS . 831.It Fl j Ar jail 832Run inside a jail. 833See 834.Sx GENERAL OPTIONS . 835.El 836.It Xo 837.Bk -words 838.Nm 839.Fl Q 840.Op Fl j Ar jail 841.Ek 842.Xc 843Show 844.Xr netisr 9 845statistics. 846The flags field shows available ISR handlers: 847.Bl -column ".Li W" ".Dv NETISR_SNP_FLAGS_DRAINEDCPU" 848.It Li C Ta Dv NETISR_SNP_FLAGS_M2CPUID Ta "Able to map mbuf to cpu id" 849.It Li D Ta Dv NETISR_SNP_FLAGS_DRAINEDCPU Ta "Has queue drain handler" 850.It Li F Ta Dv NETISR_SNP_FLAGS_M2FLOW Ta "Able to map mbuf to flow id" 851.It Fl j Ar jail 852Run inside a jail. 853See 854.Sx GENERAL OPTIONS . 855.El 856.El 857.Ss GENERAL OPTIONS 858Some options have the general meaning: 859.Bl -tag -width flag 860.It Fl 4 861Is shorthand for 862.Fl f 863.Ar inet 864.Pq Show only IPv4 865.It Fl 6 866Is shorthand for 867.Fl f 868.Ar inet6 869.Pq Show only IPv6 870.It Fl f Ar address_family , Fl p Ar protocol 871Limit display to those records 872of the specified 873.Ar address_family 874or a single 875.Ar protocol . 876The following address families and protocols are recognized: 877.Pp 878.Bl -tag -width ".Cm netgraph , ng Pq Dv AF_NETGRAPH" -compact 879.It Em Family 880.Em Protocols 881.It Cm inet Pq Dv AF_INET 882.Cm divert , icmp , igmp , ip , ipsec , pim, sctp , tcp , udp 883.It Cm inet6 Pq Dv AF_INET6 884.Cm icmp6 , ip6 , ipsec6 , rip6 , sctp , tcp , udp 885.It Cm pfkey Pq Dv PF_KEY 886.Cm pfkey 887.It Cm netgraph , ng Pq Dv AF_NETGRAPH 888.Cm ctrl , data 889.It Cm unix Pq Dv AF_UNIX 890.It Cm link Pq Dv AF_LINK 891.El 892.Pp 893The program will complain if 894.Ar protocol 895is unknown or if there is no statistics routine for it. 896.It Fl M 897Extract values associated with the name list from the specified core 898instead of the default 899.Pa /dev/kmem . 900.It Fl N 901Extract the name list from the specified system instead of the default, 902which is the kernel image the system has booted from. 903.It Fl n 904Show network addresses and ports as numbers. 905Normally 906.Nm 907attempts to resolve addresses and ports, 908and display them symbolically. 909Specifying 910.Fl n 911twice will also disable printing the keyword 912.Qq Dv default 913for the default IPv4 and IPv6 routes when displaying contents of routing 914tables. 915.It Fl W 916Wider output; expand address fields, etc, to avoid truncation. 917Non-numeric values such as domain names may still be truncated; use the 918.Fl n 919option if necessary to avoid ambiguity. 920.It Fl j Ar jail 921Perform the actions inside the 922.Ar jail . 923This allows network state to be accessed even if the 924.Cm netstat 925binary is not available in the 926.Ar jail . 927.El 928.Sh EXAMPLES 929Show packet traffic information (packets, bytes, errors, packet drops, etc) for 930interface re0 updated every 2 seconds and exit after 5 outputs: 931.Pp 932.Dl netstat -w 2 -q 5 -I re0 933.Pp 934Show statistics for ICMP on any interface: 935.Pp 936.Dl netstat -s -p icmp 937.Pp 938Show routing tables: 939.Pp 940.Dl netstat -r 941.Pp 942Same as above, but without resolving numeric addresses and port numbers to 943names: 944.Pp 945.Dl netstat -rn 946.Pp 947Show IPv4 listening sockets: 948.Pp 949.Dl netstat -4l 950.Sh SEE ALSO 951.Xr fstat 1 , 952.Xr nfsstat 1 , 953.Xr procstat 1 , 954.Xr ps 1 , 955.Xr sockstat 1 , 956.Xr libxo 3 , 957.Xr xo_options 7 , 958.Xr bpf 4 , 959.Xr inet 4 , 960.Xr route 4 , 961.Xr unix 4 , 962.Xr hosts 5 , 963.Xr networks 5 , 964.Xr protocols 5 , 965.Xr services 5 , 966.Xr iostat 8 , 967.Xr route 8 , 968.Xr vmstat 8 , 969.Xr mbuf 9 970.Sh HISTORY 971The 972.Nm 973command appeared in 974.Bx 4.2 . 975.Pp 976IPv6 support was added by WIDE/KAME project. 977.Sh BUGS 978The notion of errors is ill-defined. 979