1.\" Copyright (c) 1983, 1990, 1992, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)netstat.1 8.8 (Berkeley) 4/18/94 33.\" $FreeBSD$ 34.\" 35.Dd April 18, 1994 36.Dt NETSTAT 1 37.Os BSD 4.2 38.Sh NAME 39.Nm netstat 40.Nd show network status 41.Sh SYNOPSIS 42.Nm 43.Op Fl AaLlnW 44.Op Fl f Ar address_family 45.Op Fl M Ar core 46.Op Fl N Ar system 47.Nm 48.Op Fl bdghilmnrs 49.Op Fl f Ar address_family 50.Op Fl M Ar core 51.Op Fl N Ar system 52.Nm 53.Op Fl bdn 54.Op Fl I Ar interface 55.Op Fl M Ar core 56.Op Fl N Ar system 57.Op Fl w Ar wait 58.Nm 59.Op Fl p Ar protocol 60.Op Fl M Ar core 61.Op Fl N Ar system 62.Nm 63.Op Fl p Ar protocol 64.Op Fl i 65.Op Fl I Ar Interface 66.Nm 67.Op Fl s 68.Op Fl f Ar address_family 69.Op Fl i 70.Op Fl I Ar Interface 71.Sh DESCRIPTION 72The 73.Nm 74command symbolically displays the contents of various network-related 75data structures. 76There are a number of output formats, 77depending on the options for the information presented. 78The first form of the command displays a list of active sockets for 79each protocol. 80The second form presents the contents of one of the other network 81data structures according to the option selected. 82Using the third form, with a 83.Ar wait 84interval specified, 85.Nm 86will continuously display the information regarding packet 87traffic on the configured network interfaces. 88The fourth form displays statistics about the named protocol. 89The fifth and sixth forms display per interface statistics for 90the specified protocol or address family. 91.Pp 92The options have the following meaning: 93.Bl -tag -width flag 94.It Fl A 95With the default display, 96show the address of any protocol control blocks associated with sockets; used 97for debugging. 98.It Fl a 99With the default display, 100show the state of all sockets; normally sockets used by 101server processes are not shown. 102With the routing table display (option 103.Fl r , 104as described below), show protocol-cloned routes (routes 105generated by a 106.Dv RTF_PRCLONING 107parent route); normally these routes are 108not shown. 109.It Fl b 110With the interface display (option 111.Fl i 112, as described below), 113show the number of bytes in and out. 114.It Fl d 115With either interface display (option 116.Fl i 117or an interval, as described below), 118show the number of dropped packets. 119.It Fl f Ar address_family 120Limit statistics or address control block reports to those 121of the specified 122.Ar address family . 123The following address families 124are recognized: 125.Ar inet , 126for 127.Dv AF_INET , 128.Ar inet6 , 129for 130.Dv AF_INET6 , 131.Ar ipx , 132for 133.Dv AF_IPX , 134.Ar atalk , 135for 136.Dv AF_APPLETALK (ddp) , 137.Ar netgraph 138or 139.Ar ng 140for 141.Dv AF_NETGRAPH , 142.\".Ar ns , 143.\"for 144.\".Dv AF_NS , 145.\".Ar iso , 146.\"for 147.\".Dv AF_ISO , 148and 149.Ar unix , 150for 151.Dv AF_UNIX . 152.It Fl g 153Show information related to multicast (group address) routing. 154By default, show the IP Multicast virtual-interface and routing tables. 155If the 156.Fl s 157option is also present, show multicast routing statistics. 158.It Fl h 159Show the state of the 160.Tn IMP 161host table (obsolete). 162.It Fl I Ar interface 163Show information about the specified interface; 164used with a 165.Ar wait 166interval as described below. 167If the 168.Fl f Ar address_family 169option (with the 170.Fl s 171option) or the 172.Fl p Ar protocol 173option is present, show per-interface statistics on the 174.Ar interface 175for the specfied 176.Ar address_family 177or 178.Ar protocol , 179respectively. 180.It Fl i 181Show the state of interfaces which have been auto-configured 182(interfaces statically configured into a system, but not 183located at boot time are not shown). 184If the 185.Fl a 186options is also present, multicast addresses currently in use are shown 187for each Ethernet interface and for each IP interface address. 188Multicast addresses are shown on separate lines following the interface 189address with which they are associated. 190If the 191.Fl f Ar address_family 192option (with the 193.Fl s 194option) or the 195.Fl p Ar protocol 196option is present, show per-interface statistics on all interfaces 197for the specfied 198.Ar address_family 199or 200.Ar protocol , 201respectively. 202.It Fl L 203Show the size of the various listen queues. 204The first count shows the 205number of unaccepted connections. 206The second count shows the amount of unaccepted incomplete connections. 207The third count is the maximum number of queued connections. 208.It Fl l 209Print full IPv6 address. 210.It Fl M 211Extract values associated with the name list from the specified core 212instead of the default 213.Pa /dev/kmem . 214.It Fl m 215Show statistics recorded by the memory management routines 216(the network manages a private pool of memory buffers). 217.It Fl N 218Extract the name list from the specified system instead of the default 219.Pa /kernel . 220.It Fl n 221Show network addresses as numbers (normally 222.Nm 223interprets addresses and attempts to display them 224symbolically). 225This option may be used with any of the display formats. 226.It Fl p Ar protocol 227Show statistics about 228.Ar protocol , 229which is either a well-known name for a protocol or an alias for it. Some 230protocol names and aliases are listed in the file 231.Pa /etc/protocols . 232The special protocol name 233.Dq bdg 234is used to show bridging statistics. 235A null response typically means that there are no interesting numbers to 236report. 237The program will complain if 238.Ar protocol 239is unknown or if there is no statistics routine for it. 240.It Fl s 241Show per-protocol statistics. 242If this option is repeated, counters with a value of zero are suppressed. 243.It Fl r 244Show the routing tables. 245Use with 246.Fl a 247to show protocol-cloned routes. 248When 249.Fl s 250is also present, show routing statistics instead. 251When 252.Fl l 253is also present, 254.Nm 255assumes more columns are there. 256.It Fl W 257In certain displays, avoid truncating addresses even if this causes 258some fields to overflow. 259.It Fl w Ar wait 260Show network interface statistics at intervals of 261.Ar wait 262seconds. 263.El 264.Pp 265The default display, for active sockets, shows the local 266and remote addresses, send and receive queue sizes (in bytes), protocol, 267and the internal state of the protocol. 268Address formats are of the form 269.Dq host.port 270or 271.Dq network.port 272if a socket's address specifies a network but no specific host address. 273When known the host and network addresses are displayed symbolically 274according to the data bases 275.Pa /etc/hosts 276and 277.Pa /etc/networks , 278respectively. If a symbolic name for an address is unknown, or if 279the 280.Fl n 281option is specified, the address is printed numerically, according 282to the address family. 283For more information regarding 284the Internet 285.Dq dot format , 286refer to 287.Xr inet 3 ) . 288Unspecified, 289or 290.Dq wildcard , 291addresses and ports appear as 292.Dq * . 293.Pp 294The interface display provides a table of cumulative 295statistics regarding packets transferred, errors, and collisions. 296The network addresses of the interface 297and the maximum transmission unit 298.Pq Dq mtu 299are also displayed. 300.Pp 301The routing table display indicates the available routes and 302their status. Each route consists of a destination host or network 303and a gateway to use in forwarding packets. The flags field shows 304a collection of information about the route stored as 305binary choices. The individual flags are discussed in more 306detail in the 307.Xr route 8 308and 309.Xr route 4 310manual pages. 311The mapping between letters and flags is: 312.Bl -column XXXX RTF_BLACKHOLE 3131 RTF_PROTO1 Protocol specific routing flag #1 3142 RTF_PROTO2 Protocol specific routing flag #2 3153 RTF_PROTO3 Protocol specific routing flag #3 316B RTF_BLACKHOLE Just discard pkts (during updates) 317b RTF_BROADCAST The route represents a broadcast address 318C RTF_CLONING Generate new routes on use 319c RTF_PRCLONING Protocol-specified generate new routes on use 320D RTF_DYNAMIC Created dynamically (by redirect) 321G RTF_GATEWAY Destination requires forwarding by intermediary 322H RTF_HOST Host entry (net otherwise) 323L RTF_LLINFO Valid protocol to link address translation 324M RTF_MODIFIED Modified dynamically (by redirect) 325R RTF_REJECT Host or net unreachable 326S RTF_STATIC Manually added 327U RTF_UP Route usable 328W RTF_WASCLONED Route was generated as a result of cloning 329X RTF_XRESOLVE External daemon translates proto to link address 330.El 331.Pp 332Direct routes are created for each 333interface attached to the local host; 334the gateway field for such entries shows the address of the outgoing interface. 335The refcnt field gives the 336current number of active uses of the route. Connection oriented 337protocols normally hold on to a single route for the duration of 338a connection while connectionless protocols obtain a route while sending 339to the same destination. 340The use field provides a count of the number of packets 341sent using that route. The interface entry indicates the network 342interface utilized for the route. 343.Pp 344When 345.Nm 346is invoked with the 347.Fl w 348option and a 349.Ar wait 350interval argument, it displays a running count of statistics related to 351network interfaces. 352An obsolescent version of this option used a numeric parameter 353with no option, and is currently supported for backward compatibility. 354By default, this display summarizes information for all interfaces. 355Information for a specific interface may be displayed with the 356.Fl I 357option. 358.Sh SEE ALSO 359.Xr fstat 1 , 360.Xr nfsstat 1 , 361.Xr sockstat 1 , 362.Xr ps 1 , 363.Xr inet 4 , 364.Xr unix 4 , 365.Xr hosts 5 , 366.Xr networks 5 , 367.Xr protocols 5 , 368.Xr services 5 , 369.Xr iostat 8 , 370.Xr trpt 8 , 371.Xr vmstat 8 372.Sh HISTORY 373The 374.Nm 375command appeared in 376.Bx 4.2 . 377.Pp 378IPv6 support was added by WIDE/KAME project. 379.Sh FILES 380.Bl -tag -width /dev/kmem -compact 381.It Pa /kernel 382default kernel namelist 383.It Pa /dev/kmem 384default memory file 385.El 386.Sh BUGS 387The notion of errors is ill-defined. 388