1.\" Copyright (c) 1983, 1990, 1992, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. Neither the name of the University nor the names of its contributors 13.\" may be used to endorse or promote products derived from this software 14.\" without specific prior written permission. 15.\" 16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 19.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 26.\" SUCH DAMAGE. 27.\" 28.Dd April 30, 2025 29.Dt NETSTAT 1 30.Os 31.Sh NAME 32.Nm netstat 33.Nd show network status and statistics 34.Sh SYNOPSIS 35.Bk -words 36.Bl -tag -width "netstat" 37.It Nm 38.Op Fl j Ar jail 39.Op Fl -libxo 40.Op Fl 46AaCLnPRSTWx 41.Op Fl f Ar protocol_family | Fl p Ar protocol 42.It Nm Fl i | I Ar interface 43.Op Fl j Ar jail 44.Op Fl -libxo 45.Op Fl 46abdhnW 46.Op Fl f Ar address_family 47.Op Fl M Ar core 48.Op Fl N Ar system 49.It Nm Fl w Ar wait 50.Op Fl j Ar jail 51.Op Fl -libxo 52.Op Fl I Ar interface 53.Op Fl 46d 54.Op Fl M Ar core 55.Op Fl N Ar system 56.Op Fl q Ar howmany 57.It Nm Fl s 58.Op Fl j Ar jail 59.Op Fl -libxo 60.Op Fl 46sz 61.Op Fl f Ar protocol_family | Fl p Ar protocol 62.Op Fl M Ar core 63.Op Fl N Ar system 64.It Nm Fl i | I Ar interface Fl s 65.Op Fl j Ar jail 66.Op Fl -libxo 67.Op Fl 46s 68.Op Fl f Ar protocol_family | Fl p Ar protocol 69.Op Fl M Ar core 70.Op Fl N Ar system 71.It Nm Fl m 72.Op Fl j Ar jail 73.Op Fl -libxo 74.Op Fl M Ar core 75.Op Fl N Ar system 76.It Nm Fl B 77.Op Fl j Ar jail 78.Op Fl -libxo 79.Op Fl z 80.Op Fl I Ar interface 81.It Nm Fl r 82.Op Fl j Ar jail 83.Op Fl -libxo 84.Op Fl 46nW 85.Op Fl F Ar fibnum 86.Op Fl f Ar address_family 87.It Nm Fl rs 88.Op Fl j Ar jail 89.Op Fl -libxo 90.Op Fl s 91.Op Fl M Ar core 92.Op Fl N Ar system 93.It Nm Fl g 94.Op Fl j Ar jail 95.Op Fl -libxo 96.Op Fl 46W 97.Op Fl f Ar address_family 98.It Nm Fl gs 99.Op Fl j Ar jail 100.Op Fl -libxo 101.Op Fl 46s 102.Op Fl f Ar address_family 103.Op Fl M Ar core 104.Op Fl N Ar system 105.It Nm Fl Q 106.Op Fl j Ar jail 107.Op Fl -libxo 108.It Nm Fl o 109.Fl 4 | Fl 6 110.It Nm Fl O 111.Fl 4 | Fl 6 112.El 113.Ek 114.Sh DESCRIPTION 115The 116.Nm 117command shows the contents of various network-related 118data structures. 119The arguments passed determine which of the below output formats the 120command uses. 121.Bl -tag -width indent 122.It Xo 123.Bk -words 124.Nm 125.Op Fl 46AaCLnRSTWx 126.Op Fl f Ar protocol_family | Fl p Ar protocol 127.Op Fl j Ar jail 128.Ek 129.Xc 130Display a list of active sockets 131(protocol control blocks) 132for each network protocol. 133.Pp 134The default display for active sockets shows the local 135and remote addresses, send and receive queue sizes (in bytes), protocol, 136and the internal state of the protocol. 137Address formats are of the form 138.Dq host.port 139or 140.Dq network.port 141if a socket's address specifies a network but no specific host address. 142When known, the host and network addresses are displayed symbolically 143according to the databases 144.Xr hosts 5 145and 146.Xr networks 5 , 147respectively. 148If a symbolic name for an address is unknown, or if 149the 150.Fl n 151option is specified, the address is printed numerically, according 152to the address family. 153For more information regarding 154the Internet IPv4 155.Dq dot format , 156refer to 157.Xr inet 3 . 158Unspecified, 159or 160.Dq wildcard , 161addresses and ports appear as 162.Dq Li * . 163.Bl -tag -width indent 164.It Fl -libxo 165Generate output via 166.Xr libxo 3 167in a selection of different human and machine readable formats. 168See 169.Xr xo_parse_args 3 170for details on command line arguments. 171.It Fl 4 172Show IPv4 only. 173See 174.Sx GENERAL OPTIONS . 175.It Fl 6 176Show IPv6 only. 177See 178.Sx GENERAL OPTIONS . 179.It Fl A 180Show the address of a protocol control block (PCB) 181associated with a socket; used for debugging. 182.It Fl a 183Show the state of all sockets; 184normally sockets used by server processes are not shown. 185.It Fl c 186Show the used TCP stack for each session. 187.It Fl C 188Show the congestion control algorithm and diagnostic information of TCP sockets. 189.It Fl L 190Show the size of the various listen queues. 191The first count shows the number of unaccepted connections, 192the second count shows the amount of unaccepted incomplete connections, 193and the third count is the maximum number of queued connections. 194.It Fl n 195Do not resolve numeric addresses and port numbers to names. 196See 197.Sx GENERAL OPTIONS . 198.It Fl P 199Display the log ID for each socket. 200.It Fl R 201Display the flowid and flowtype for each socket. 202flowid is a 32 bit hardware specific identifier for each flow. 203flowtype defines which protocol fields are hashed to produce the id. 204A complete listing is available in 205.Pa sys/mbuf.h 206under 207.Dv M_HASHTYPE_* . 208.It Fl S 209Show network addresses as numbers (as with 210.Fl n ) 211but show ports symbolically. 212.It Fl T 213Display diagnostic information from the TCP control block. 214Fields include the number of packets requiring retransmission, 215received out-of-order, and those advertising a zero-sized window. 216.It Fl W 217Avoid truncating addresses even if this causes some fields to overflow. 218.It Fl x 219Display socket buffer and TCP timer statistics for each 220internet socket. 221.Pp 222The 223.Fl x 224flag causes 225.Nm 226to output all the information recorded about data 227stored in the socket buffers. 228The fields are: 229.Bl -column ".Li R-HIWA" 230.It Li R-HIWA Ta Receive buffer high water mark, in bytes. 231.It Li S-HIWA Ta Send buffer high water mark, in bytes. 232.It Li R-LOWA Ta Receive buffer low water mark, in bytes. 233.It Li S-LOWA Ta Send buffer low water mark, in bytes. 234.It Li R-BCNT Ta Receive buffer byte count. 235.It Li S-BCNT Ta Send buffer byte count. 236.It Li R-BMAX Ta Maximum bytes that can be used in the receive buffer. 237.It Li S-BMAX Ta Maximum bytes that can be used in the send buffer. 238.It Li rexmt Ta Time, in seconds, to fire Retransmit Timer, or 0 if not armed. 239.It Li persist Ta Time, in seconds, to fire Retransmit Persistence, or 0 if not armed. 240.It Li keep Ta Time, in seconds, to fire Keep Alive, or 0 if not armed. 241.It Li 2msl Ta Time, in seconds, to fire 2*msl TIME_WAIT Timer, or 0 if not armed. 242.It Li delack Ta Time, in seconds, to fire Delayed ACK Timer, or 0 if not armed. 243.It Li rcvtime Ta Time, in seconds, since last packet received. 244.El 245.It Fl f Ar protocol_family 246Filter by 247.Ar protocol_family . 248See 249.Sx GENERAL OPTIONS . 250.It Fl p Ar protocol 251Filter by 252.Ar protocol . 253See 254.Sx GENERAL OPTIONS . 255.It Fl j Ar jail 256Run inside a jail. 257See 258.Sx GENERAL OPTIONS . 259.El 260.It Xo 261.Bk -words 262.Nm 263.Fl i | I Ar interface 264.Op Fl 46abdhnW 265.Op Fl f Ar address_family 266.Op Fl M Ar core 267.Op Fl N Ar system 268.Op Fl j Ar jail 269.Ek 270.Xc 271Show the state of all network interfaces or a single 272.Ar interface 273which have been auto-configured 274(interfaces statically configured into a system, but not 275located at boot time are not shown). 276An asterisk 277.Pq Dq Li * 278after an interface name indicates that the interface is 279.Dq down . 280.Pp 281When 282.Nm 283is invoked with 284.Fl i 285.Pq all interfaces 286or 287.Fl I Ar interface , 288it provides a table of cumulative 289statistics regarding packets transferred, errors, and collisions. 290The network addresses of the interface 291and the maximum transmission unit 292.Pq Dq mtu 293are also displayed. 294If both 295.Fl i 296and 297.Fl I 298are specified, 299.Fl I 300overrides any instances of 301.Fl i . 302.Bl -tag -width indent 303.It Fl 4 304Show IPv4 only. 305See 306.Sx GENERAL OPTIONS . 307.It Fl 6 308Show IPv6 only. 309See 310.Sx GENERAL OPTIONS . 311.It Fl a 312Multicast addresses currently in use are shown 313for each Ethernet interface and for each IP interface address. 314Multicast addresses are shown on separate lines following the interface 315address with which they are associated. 316.It Fl b 317Show the number of bytes in and out. 318.It Fl d 319Show the number of dropped output packets. 320.It Fl h 321Print all counters in human readable form. 322.It Fl n 323Do not resolve numeric addresses and port numbers to names. 324See 325.Sx GENERAL OPTIONS . 326.It Fl W 327Avoid truncating addresses even if this causes some fields to overflow. 328See 329.Sx GENERAL OPTIONS . 330However, in most cases field widths are determined automatically with the 331.Fl i 332option, and this option has little effect. 333.It Fl f Ar protocol_family 334Filter by 335.Ar protocol_family . 336See 337.Sx GENERAL OPTIONS . 338.It Fl j Ar jail 339Run inside a jail. 340See 341.Sx GENERAL OPTIONS . 342.El 343.It Xo 344.Bk -words 345.Nm 346.Fl w Ar wait 347.Op Fl I Ar interface 348.Op Fl 46d 349.Op Fl M Ar core 350.Op Fl N Ar system 351.Op Fl q Ar howmany 352.Op Fl j Ar jail 353.Ek 354.Xc 355At intervals of 356.Ar wait 357seconds, display the information regarding packet traffic on all 358configured network interfaces or a single 359.Ar interface . 360.Pp 361When 362.Nm 363is invoked with the 364.Fl w 365option and a 366.Ar wait 367interval argument, it displays a running count of statistics related to 368network interfaces. 369An obsolescent version of this option used a numeric parameter 370with no option, and is currently supported for backward compatibility. 371By default, this display summarizes information for all interfaces. 372Information for a specific interface may be displayed with the 373.Fl I Ar interface 374option. 375.Bl -tag -width indent 376.It Fl I Ar interface 377Only show information regarding 378.Ar interface 379.It Fl 4 380Show IPv4 only. 381See 382.Sx GENERAL OPTIONS . 383.It Fl 6 384Show IPv6 only. 385See 386.Sx GENERAL OPTIONS . 387.It Fl d 388Show the number of dropped output packets. 389.It Fl M 390Use an alternative core. 391See 392.Sx GENERAL OPTIONS . 393.It Fl N 394Use an alternative kernel image. 395See 396.Sx GENERAL OPTIONS . 397.It Fl q 398Exit after 399.Ar howmany 400outputs. 401.It Fl j Ar jail 402Run inside a jail. 403See 404.Sx GENERAL OPTIONS . 405.El 406.It Xo 407.Bk -words 408.Nm netstat 409.Fl o 410.Fl 4 | Fl 6 411.Ek 412.Xc 413Print nexthop (nhops) information associated with routing entries. 414When used with 415.Fl 4 416or 417.Fl 6 , 418limit the output to IPv4 or IPv6 routes respectively. 419This option provides details about individual nexthop addresses used in routing decisions. 420.It Xo 421.Bk -words 422.Nm netstat 423.Fl O 424.Fl 4 | Fl 6 425.Ek 426.Xc 427Print nexthop groups (nhgrp) information associated with routing entries. 428When used with 429.Fl 4 430or 431.Fl 6 , 432restrict the output to IPv4 or IPv6 nexthop groups respectively. 433This option shows grouped nexthop entries for multipath or load-balanced routing setups. 434.It Xo 435.Bk -words 436.Nm 437.Fl s 438.Op Fl 46sz 439.Op Fl f Ar protocol_family | Fl p Ar protocol 440.Op Fl M Ar core 441.Op Fl N Ar system 442.Op Fl j Ar jail 443.Ek 444.Xc 445Display system-wide statistics for each network protocol. 446.Bl -tag -width indent 447.It Fl 4 448Show IPv4 only. 449See 450.Sx GENERAL OPTIONS . 451.It Fl 6 452Show IPv6 only. 453See 454.Sx GENERAL OPTIONS . 455.It Fl s 456If 457.Fl s 458is repeated, counters with a value of zero are suppressed. 459.It Fl z 460Reset statistic counters after displaying them. 461.It Fl f Ar protocol_family 462Filter by 463.Ar protocol_family . 464See 465.Sx GENERAL OPTIONS . 466.It Fl p Ar protocol 467Filter by 468.Ar protocol . 469See 470.Sx GENERAL OPTIONS . 471.It Fl M 472Use an alternative core. 473See 474.Sx GENERAL OPTIONS . 475.It Fl N 476Use an alternative kernel image 477See 478.Sx GENERAL OPTIONS . 479.It Fl j Ar jail 480Run inside a jail. 481See 482.Sx GENERAL OPTIONS . 483.El 484.It Xo 485.Bk -words 486.Nm 487.Fl i | I Ar interface Fl s 488.Op Fl 46s 489.Op Fl f Ar protocol_family | Fl p Ar protocol 490.Op Fl M Ar core 491.Op Fl N Ar system 492.Op Fl j Ar jail 493.Ek 494.Xc 495Display per-interface statistics for each network protocol. 496If both 497.Fl i 498and 499.Fl I 500are specified, 501.Fl I 502overrides any instances of 503.Fl i . 504.Bl -tag -width indent 505.It Fl 4 506Show IPv4 only 507See 508.Sx GENERAL OPTIONS . 509.It Fl 6 510Show IPv6 only 511See 512.Sx GENERAL OPTIONS . 513.It Fl s 514If 515.Fl s 516is repeated, counters with a value of zero are suppressed. 517.It Fl f Ar protocol_family 518Filter by 519.Ar protocol_family . 520See 521.Sx GENERAL OPTIONS . 522.It Fl p Ar protocol 523Filter by 524.Ar protocol . 525See 526.Sx GENERAL OPTIONS . 527.It Fl M 528Use an alternative core 529See 530.Sx GENERAL OPTIONS . 531.It Fl N 532Use an alternative kernel image 533See 534.Sx GENERAL OPTIONS . 535.It Fl j Ar jail 536Run inside a jail. 537See 538.Sx GENERAL OPTIONS . 539.El 540.It Xo 541.Bk -words 542.Nm 543.Fl m 544.Op Fl M Ar core 545.Op Fl N Ar system 546.Op Fl j Ar jail 547.Ek 548.Xc 549Show statistics recorded by the memory management routines 550.Pq Xr mbuf 9 . 551The network manages a private pool of memory buffers. 552.Bl -tag -width indent 553.It Fl M 554Use an alternative core 555See 556.Sx GENERAL OPTIONS . 557.It Fl N 558Use an alternative kernel image 559See 560.Sx GENERAL OPTIONS . 561.It Fl j Ar jail 562Run inside a jail. 563See 564.Sx GENERAL OPTIONS . 565.El 566.It Xo 567.Bk -words 568.Nm 569.Fl B 570.Op Fl z 571.Op Fl I Ar interface 572.Op Fl j Ar jail 573.Ek 574.Xc 575Show statistics about 576.Xr bpf 4 577peers. 578This includes information like 579how many packets have been matched, dropped and received by the 580bpf device, also information about current buffer sizes and device 581states. 582.Pp 583The 584.Xr bpf 4 585flags displayed when 586.Nm 587is invoked with the 588.Fl B 589option represent the underlying parameters of the bpf peer. 590Each flag is 591represented as a single lower case letter. 592The mapping between the letters and flags in order of appearance are: 593.Bl -column ".Li i" 594.It Li p Ta Set if listening promiscuously 595.It Li i Ta Dv BIOCIMMEDIATE No has been set on the device 596.It Li f Ta Dv BIOCGHDRCMPLT No status: source link addresses are being 597filled automatically 598.It Li s Ta Dv BIOCGSEESENT No status: see packets originating locally and 599remotely on the interface. 600.It Li a Ta Packet reception generates a signal 601.It Li l Ta Dv BIOCLOCK No status: descriptor has been locked 602.El 603.Pp 604For more information about these flags, please refer to 605.Xr bpf 4 . 606.Bl -tag -width indent 607.It Fl z 608Reset statistic counters after displaying them. 609.It Fl j Ar jail 610Run inside a jail. 611See 612.Sx GENERAL OPTIONS . 613.El 614.It Xo 615.Bk -words 616.Nm 617.Fl r 618.Op Fl 46AnW 619.Op Fl F Ar fibnum 620.Op Fl f Ar address_family 621.Op Fl M Ar core 622.Op Fl N Ar system 623.Op Fl j Ar jail 624.Ek 625.Xc 626Display the contents of routing tables. 627.Pp 628When 629.Nm 630is invoked with the routing table option 631.Fl r , 632it lists the available routes and their status. 633Each route consists of a destination host or network, and a gateway to use 634in forwarding packets. 635The flags field shows a collection of information about the route stored 636as binary choices. 637The individual flags are discussed in more detail in the 638.Xr route 8 639and 640.Xr route 4 641manual pages. 642The mapping between letters and flags is: 643.Bl -column ".Li W" ".Dv RTF_WASCLONED" 644.It Li 1 Ta Dv RTF_PROTO1 Ta "Protocol specific routing flag #1" 645.It Li 2 Ta Dv RTF_PROTO2 Ta "Protocol specific routing flag #2" 646.It Li 3 Ta Dv RTF_PROTO3 Ta "Protocol specific routing flag #3" 647.It Li B Ta Dv RTF_BLACKHOLE Ta "Just discard pkts (during updates)" 648.It Li b Ta Dv RTF_BROADCAST Ta "The route represents a broadcast address" 649.It Li D Ta Dv RTF_DYNAMIC Ta "Created dynamically (by redirect)" 650.It Li G Ta Dv RTF_GATEWAY Ta "Destination requires forwarding by intermediary" 651.It Li H Ta Dv RTF_HOST Ta "Host entry (net otherwise)" 652.It Li L Ta Dv RTF_LLINFO Ta "Valid protocol to link address translation" 653.It Li M Ta Dv RTF_MODIFIED Ta "Modified dynamically (by redirect)" 654.It Li R Ta Dv RTF_REJECT Ta "Host or net unreachable" 655.It Li S Ta Dv RTF_STATIC Ta "Manually added" 656.It Li U Ta Dv RTF_UP Ta "Route usable" 657.It Li X Ta Dv RTF_XRESOLVE Ta "External daemon translates proto to link address" 658.El 659.Pp 660Direct routes are created for each 661interface attached to the local host; 662the gateway field for such entries shows the address of the outgoing interface. 663The refcnt field gives the 664current number of active uses of the route. 665Connection oriented 666protocols normally hold on to a single route for the duration of 667a connection while connectionless protocols obtain a route while sending 668to the same destination. 669The use field provides a count of the number of packets 670sent using that route. 671The interface entry indicates the network interface utilized for the route. 672.Bl -tag -width indent 673.It Fl 4 674Show IPv4 only. 675See 676.Sx GENERAL OPTIONS . 677.It Fl 6 678Show IPv6 only. 679See 680.Sx GENERAL OPTIONS . 681.It Fl n 682Do not resolve numeric addresses and port numbers to names. 683See 684.Sx GENERAL OPTIONS . 685.It Fl W 686Show the path MTU for each route, and print interface names with a 687wider field size. 688.It Fl F 689Display the routing table with the number 690.Ar fibnum . 691If the specified 692.Ar fibnum 693is -1 or 694.Fl F 695is not specified, 696the default routing table is displayed. 697.It Fl f 698Display the routing table for a particular 699.Ar address_family . 700.It Fl M 701Use an alternative core 702See 703.Sx GENERAL OPTIONS . 704.It Fl N 705Use an alternative kernel image 706See 707.Sx GENERAL OPTIONS . 708.It Fl j Ar jail 709Run inside a jail. 710See 711.Sx GENERAL OPTIONS . 712.El 713.It Xo 714.Bk -words 715.Nm 716.Fl rs 717.Op Fl s 718.Op Fl M Ar core 719.Op Fl N Ar system 720.Op Fl j Ar jail 721.Ek 722.Xc 723Display routing statistics. 724.Bl -tag -width indent 725.It Fl s 726If 727.Fl s 728is repeated, counters with a value of zero are suppressed. 729.It Fl M 730Use an alternative core 731See 732.Sx GENERAL OPTIONS . 733.It Fl N 734Use an alternative kernel image 735See 736.Sx GENERAL OPTIONS . 737.It Fl j Ar jail 738Run inside a jail. 739See 740.Sx GENERAL OPTIONS . 741.El 742.It Xo 743.Bk -words 744.Nm 745.Fl g 746.Op Fl 46W 747.Op Fl f Ar address_family 748.Op Fl M Ar core 749.Op Fl N Ar system 750.Op Fl j Ar jail 751.Ek 752.Xc 753Display the contents of the multicast virtual interface tables, 754and multicast forwarding caches. 755Entries in these tables will appear only when the kernel is 756actively forwarding multicast sessions. 757This option is applicable only to the 758.Cm inet 759and 760.Cm inet6 761address families. 762.Bl -tag -width indent 763.It Fl 4 764Show IPv4 only 765See 766.Sx GENERAL OPTIONS . 767.It Fl 6 768Show IPv6 only 769See 770.Sx GENERAL OPTIONS . 771.It Fl W 772Avoid truncating addresses even if this causes some fields to overflow. 773.It Fl f Ar protocol_family 774Filter by 775.Ar protocol_family . 776See 777.Sx GENERAL OPTIONS . 778.It Fl M 779Use an alternative core 780See 781.Sx GENERAL OPTIONS . 782.It Fl N 783Use an alternative kernel image 784See 785.Sx GENERAL OPTIONS . 786.It Fl j Ar jail 787Run inside a jail. 788See 789.Sx GENERAL OPTIONS . 790.El 791.It Xo 792.Bk -words 793.Nm 794.Fl gs 795.Op Fl 46s 796.Op Fl f Ar address_family 797.Op Fl M Ar core 798.Op Fl N Ar system 799.Op Fl j Ar jail 800.Ek 801.Xc 802Show multicast routing statistics. 803.Bl -tag -width indent 804.It Fl 4 805Show IPv4 only 806See 807.Sx GENERAL OPTIONS . 808.It Fl 6 809Show IPv6 only 810See 811.Sx GENERAL OPTIONS . 812.It Fl s 813If 814.Fl s 815is repeated, counters with a value of zero are suppressed. 816.It Fl f Ar protocol_family 817Filter by 818.Ar protocol_family . 819See 820.Sx GENERAL OPTIONS . 821.It Fl M 822Use an alternative core 823See 824.Sx GENERAL OPTIONS . 825.It Fl N 826Use an alternative kernel image 827See 828.Sx GENERAL OPTIONS . 829.It Fl j Ar jail 830Run inside a jail. 831See 832.Sx GENERAL OPTIONS . 833.El 834.It Xo 835.Bk -words 836.Nm 837.Fl Q 838.Op Fl j Ar jail 839.Ek 840.Xc 841Show 842.Xr netisr 9 843statistics. 844The flags field shows available ISR handlers: 845.Bl -column ".Li W" ".Dv NETISR_SNP_FLAGS_DRAINEDCPU" 846.It Li C Ta Dv NETISR_SNP_FLAGS_M2CPUID Ta "Able to map mbuf to cpu id" 847.It Li D Ta Dv NETISR_SNP_FLAGS_DRAINEDCPU Ta "Has queue drain handler" 848.It Li F Ta Dv NETISR_SNP_FLAGS_M2FLOW Ta "Able to map mbuf to flow id" 849.It Fl j Ar jail 850Run inside a jail. 851See 852.Sx GENERAL OPTIONS . 853.El 854.El 855.Ss GENERAL OPTIONS 856Some options have the general meaning: 857.Bl -tag -width flag 858.It Fl 4 859Is shorthand for 860.Fl f 861.Ar inet 862.Pq Show only IPv4 863.It Fl 6 864Is shorthand for 865.Fl f 866.Ar inet6 867.Pq Show only IPv6 868.It Fl f Ar address_family , Fl p Ar protocol 869Limit display to those records 870of the specified 871.Ar address_family 872or a single 873.Ar protocol . 874The following address families and protocols are recognized: 875.Pp 876.Bl -tag -width ".Cm netgraph , ng Pq Dv AF_NETGRAPH" -compact 877.It Em Family 878.Em Protocols 879.It Cm inet Pq Dv AF_INET 880.Cm divert , icmp , igmp , ip , ipsec , pim, sctp , tcp , udp 881.It Cm inet6 Pq Dv AF_INET6 882.Cm icmp6 , ip6 , ipsec6 , rip6 , sctp , tcp , udp 883.It Cm pfkey Pq Dv PF_KEY 884.Cm pfkey 885.It Cm netgraph , ng Pq Dv AF_NETGRAPH 886.Cm ctrl , data 887.It Cm unix Pq Dv AF_UNIX 888.It Cm link Pq Dv AF_LINK 889.El 890.Pp 891The program will complain if 892.Ar protocol 893is unknown or if there is no statistics routine for it. 894.It Fl M 895Extract values associated with the name list from the specified core 896instead of the default 897.Pa /dev/kmem . 898.It Fl N 899Extract the name list from the specified system instead of the default, 900which is the kernel image the system has booted from. 901.It Fl n 902Show network addresses and ports as numbers. 903Normally 904.Nm 905attempts to resolve addresses and ports, 906and display them symbolically. 907Specifying 908.Fl n 909twice will also disable printing the keyword 910.Qq Dv default 911for the default IPv4 and IPv6 routes when displaying contents of routing 912tables. 913.It Fl W 914Wider output; expand address fields, etc, to avoid truncation. 915Non-numeric values such as domain names may still be truncated; use the 916.Fl n 917option if necessary to avoid ambiguity. 918.It Fl j Ar jail 919Perform the actions inside the 920.Ar jail . 921This allows network state to be accessed even if the 922.Cm netstat 923binary is not available in the 924.Ar jail . 925.El 926.Sh EXAMPLES 927Show packet traffic information (packets, bytes, errors, packet drops, etc) for 928interface re0 updated every 2 seconds and exit after 5 outputs: 929.Bd -literal -offset indent 930$ netstat -w 2 -q 5 -I re0 931.Ed 932.Pp 933Show statistics for ICMP on any interface: 934.Bd -literal -offset indent 935$ netstat -s -p icmp 936.Ed 937.Pp 938Show routing tables: 939.Bd -literal -offset indent 940$ netstat -r 941.Ed 942.Pp 943Same as above, but without resolving numeric addresses and port numbers to 944names: 945.Bd -literal -offset indent 946$ netstat -rn 947.Ed 948.Sh SEE ALSO 949.Xr fstat 1 , 950.Xr nfsstat 1 , 951.Xr procstat 1 , 952.Xr ps 1 , 953.Xr sockstat 1 , 954.Xr libxo 3 , 955.Xr xo_parse_args 3 , 956.Xr bpf 4 , 957.Xr inet 4 , 958.Xr route 4 , 959.Xr unix 4 , 960.Xr hosts 5 , 961.Xr networks 5 , 962.Xr protocols 5 , 963.Xr services 5 , 964.Xr iostat 8 , 965.Xr route 8 , 966.Xr vmstat 8 , 967.Xr mbuf 9 968.Sh HISTORY 969The 970.Nm 971command appeared in 972.Bx 4.2 . 973.Pp 974IPv6 support was added by WIDE/KAME project. 975.Sh BUGS 976The notion of errors is ill-defined. 977