1.\" Copyright (c) 1983, 1990, 1992, 1993 2.\" The Regents of the University of California. All rights reserved. 3.\" 4.\" Redistribution and use in source and binary forms, with or without 5.\" modification, are permitted provided that the following conditions 6.\" are met: 7.\" 1. Redistributions of source code must retain the above copyright 8.\" notice, this list of conditions and the following disclaimer. 9.\" 2. Redistributions in binary form must reproduce the above copyright 10.\" notice, this list of conditions and the following disclaimer in the 11.\" documentation and/or other materials provided with the distribution. 12.\" 3. All advertising materials mentioning features or use of this software 13.\" must display the following acknowledgement: 14.\" This product includes software developed by the University of 15.\" California, Berkeley and its contributors. 16.\" 4. Neither the name of the University nor the names of its contributors 17.\" may be used to endorse or promote products derived from this software 18.\" without specific prior written permission. 19.\" 20.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 21.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 22.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23.\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 24.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 25.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 26.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 27.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 28.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 29.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 30.\" SUCH DAMAGE. 31.\" 32.\" @(#)netstat.1 8.8 (Berkeley) 4/18/94 33.\" $FreeBSD$ 34.\" 35.Dd April 18, 1994 36.Dt NETSTAT 1 37.Os BSD 4.2 38.Sh NAME 39.Nm netstat 40.Nd show network status 41.Sh SYNOPSIS 42.Nm netstat 43.Op Fl AaLn 44.Op Fl f Ar address_family 45.Op Fl M Ar core 46.Op Fl N Ar system 47.Nm netstat 48.Op Fl bdghilmnrs 49.Op Fl f Ar address_family 50.Op Fl M Ar core 51.Op Fl N Ar system 52.Nm netstat 53.Op Fl bdn 54.Op Fl I Ar interface 55.Op Fl M Ar core 56.Op Fl N Ar system 57.Op Fl w Ar wait 58.Nm netstat 59.Op Fl p Ar protocol 60.Op Fl M Ar core 61.Op Fl N Ar system 62.Nm netstat 63.Op Fl p Ar protocol 64.Op Fl i 65.Op Fl I Ar Interface 66.Nm netstat 67.Op Fl s 68.Op Fl f Ar address_family 69.Op Fl i 70.Op Fl I Ar Interface 71.Sh DESCRIPTION 72The 73.Nm netstat 74command symbolically displays the contents of various network-related 75data structures. 76There are a number of output formats, 77depending on the options for the information presented. 78The first form of the command displays a list of active sockets for 79each protocol. 80The second form presents the contents of one of the other network 81data structures according to the option selected. 82Using the third form, with a 83.Ar wait 84interval specified, 85.Nm netstat 86will continuously display the information regarding packet 87traffic on the configured network interfaces. 88The fourth form displays statistics about the named protocol. 89The fifth and sixth forms display per interface statistics for 90the specified protocol or address family. 91.Pp 92The options have the following meaning: 93.Bl -tag -width flag 94.It Fl A 95With the default display, 96show the address of any protocol control blocks associated with sockets; used 97for debugging. 98.It Fl a 99With the default display, 100show the state of all sockets; normally sockets used by 101server processes are not shown. 102With the routing table display (option 103.Fl r 104, as described below), show protocol-cloned routes (routes 105generated by a RTF_PRCLONING parent route); normally these routes are 106not shown. 107.It Fl b 108With the interface display (option 109.Fl i 110, as described below), 111show the number of bytes in and out. 112.It Fl d 113With either interface display (option 114.Fl i 115or an interval, as described below), 116show the number of dropped packets. 117.It Fl f Ar address_family 118Limit statistics or address control block reports to those 119of the specified 120.Ar address family . 121The following address families 122are recognized: 123.Ar inet , 124for 125.Dv AF_INET , 126.Ar inet6 , 127for 128.Dv AF_INET6 , 129.Ar ipx , 130for 131.Dv AF_IPX , 132.Ar atalk , 133for 134.Dv AF_APPLETALK (ddp) , 135.Ar netgraph 136or 137.Ar ng 138for 139.Dv AF_NETGRAPH , 140.\".Ar ns , 141.\"for 142.\".Dv AF_NS , 143.\".Ar iso , 144.\"for 145.\".Dv AF_ISO , 146and 147.Ar unix , 148for 149.Dv AF_UNIX . 150.It Fl g 151Show information related to multicast (group address) routing. 152By default, show the IP Multicast virtual-interface and routing tables. 153If the 154.Fl s 155option is also present, show multicast routing statistics. 156.It Fl h 157Show the state of the 158.Tn IMP 159host table (obsolete). 160.It Fl I Ar interface 161Show information about the specified interface; 162used with a 163.Ar wait 164interval as described below. 165If the 166.Fl f Ar address_family 167option (with the 168.Fl s 169option) or the 170.Fl p Ar protocol 171option is present, show per-interface statistics on the 172.Ar interface 173for the specfied 174.Ar address_family 175or 176.Ar protocol, 177respectively. 178.It Fl i 179Show the state of interfaces which have been auto-configured 180(interfaces statically configured into a system, but not 181located at boot time are not shown). 182If the 183.Fl a 184options is also present, multicast addresses currently in use are shown 185for each Ethernet interface and for each IP interface address. 186Multicast addresses are shown on separate lines following the interface 187address with which they are associated. 188If the 189.Fl f Ar address_family 190option (with the 191.Fl s 192option) or the 193.Fl p Ar protocol 194option is present, show per-interface statistics on all interfaces 195for the specfied 196.Ar address_family 197or 198.Ar protocol, 199respectively. 200.It Fl L 201Show the size of the various listen queues. The first count shows the 202number of unaccepted connections. 203The second count shows the amount of unaccepted incomplete connections. 204The third count is the maximum number of queued connections. 205.It Fl M 206Extract values associated with the name list from the specified core 207instead of the default 208.Pa /dev/kmem . 209.It Fl m 210Show statistics recorded by the memory management routines 211(the network manages a private pool of memory buffers). 212.It Fl N 213Extract the name list from the specified system instead of the default 214.Pa /kernel . 215.It Fl n 216Show network addresses as numbers (normally 217.Nm netstat 218interprets addresses and attempts to display them 219symbolically). 220This option may be used with any of the display formats. 221.It Fl p Ar protocol 222Show statistics about 223.Ar protocol , 224which is either a well-known name for a protocol or an alias for it. Some 225protocol names and aliases are listed in the file 226.Pa /etc/protocols . 227The special protocol name 228.Dq bdg 229is used to show bridging statistics. 230A null response typically means that there are no interesting numbers to 231report. 232The program will complain if 233.Ar protocol 234is unknown or if there is no statistics routine for it. 235.It Fl s 236Show per-protocol statistics. 237If this option is repeated, counters with a value of zero are suppressed. 238.It Fl r 239Show the routing tables. 240Use with 241.Fl a 242to show protocol-cloned routes. 243When 244.Fl s 245is also present, show routing statistics instead. 246When 247.Fl l 248is also present, 249.Nm 250assumes more columns are there. 251.It Fl w Ar wait 252Show network interface statistics at intervals of 253.Ar wait 254seconds. 255.El 256.Pp 257The default display, for active sockets, shows the local 258and remote addresses, send and receive queue sizes (in bytes), protocol, 259and the internal state of the protocol. 260Address formats are of the form 261.Dq host.port 262or 263.Dq network.port 264if a socket's address specifies a network but no specific host address. 265When known the host and network addresses are displayed symbolically 266according to the data bases 267.Pa /etc/hosts 268and 269.Pa /etc/networks , 270respectively. If a symbolic name for an address is unknown, or if 271the 272.Fl n 273option is specified, the address is printed numerically, according 274to the address family. 275For more information regarding 276the Internet 277.Dq dot format , 278refer to 279.Xr inet 3 ) . 280Unspecified, 281or 282.Dq wildcard , 283addresses and ports appear as 284.Dq * . 285.Pp 286The interface display provides a table of cumulative 287statistics regarding packets transferred, errors, and collisions. 288The network addresses of the interface 289and the maximum transmission unit 290.Pq Dq mtu 291are also displayed. 292.Pp 293The routing table display indicates the available routes and 294their status. Each route consists of a destination host or network 295and a gateway to use in forwarding packets. The flags field shows 296a collection of information about the route stored as 297binary choices. The individual flags are discussed in more 298detail in the 299.Xr route 8 300and 301.Xr route 4 302manual pages. 303The mapping between letters and flags is: 304.Bl -column XXXX RTF_BLACKHOLE 3051 RTF_PROTO1 Protocol specific routing flag #1 3062 RTF_PROTO2 Protocol specific routing flag #2 3073 RTF_PROTO3 Protocol specific routing flag #3 308B RTF_BLACKHOLE Just discard pkts (during updates) 309b RTF_BROADCAST The route represents a broadcast address 310C RTF_CLONING Generate new routes on use 311c RTF_PRCLONING Protocol-specified generate new routes on use 312D RTF_DYNAMIC Created dynamically (by redirect) 313G RTF_GATEWAY Destination requires forwarding by intermediary 314H RTF_HOST Host entry (net otherwise) 315L RTF_LLINFO Valid protocol to link address translation 316M RTF_MODIFIED Modified dynamically (by redirect) 317R RTF_REJECT Host or net unreachable 318S RTF_STATIC Manually added 319U RTF_UP Route usable 320W RTF_WASCLONED Route was generated as a result of cloning 321X RTF_XRESOLVE External daemon translates proto to link address 322.El 323.Pp 324Direct routes are created for each 325interface attached to the local host; 326the gateway field for such entries shows the address of the outgoing interface. 327The refcnt field gives the 328current number of active uses of the route. Connection oriented 329protocols normally hold on to a single route for the duration of 330a connection while connectionless protocols obtain a route while sending 331to the same destination. 332The use field provides a count of the number of packets 333sent using that route. The interface entry indicates the network 334interface utilized for the route. 335.Pp 336When 337.Nm netstat 338is invoked with the 339.Fl w 340option and a 341.Ar wait 342interval argument, it displays a running count of statistics related to 343network interfaces. 344An obsolescent version of this option used a numeric parameter 345with no option, and is currently supported for backward compatibility. 346By default, this display summarizes information for all interfaces. 347Information for a specific interface may be displayed with the 348.Fl I 349option. 350.Sh SEE ALSO 351.Xr fstat 1 , 352.Xr nfsstat 1 , 353.Xr sockstat 1 , 354.Xr ps 1 , 355.Xr inet 4 , 356.Xr unix 4 , 357.Xr hosts 5 , 358.Xr networks 5 , 359.Xr protocols 5 , 360.Xr services 5 , 361.Xr iostat 8 , 362.Xr trpt 8 , 363.Xr vmstat 8 364.Sh HISTORY 365The 366.Nm netstat 367command appeared in 368.Bx 4.2 . 369.Pp 370IPv6 support was added by WIDE/KAME project. 371.Sh FILES 372.Bl -tag -width /dev/kmem -compact 373.It Pa /kernel 374default kernel namelist 375.It Pa /dev/kmem 376default memory file 377.El 378.Sh BUGS 379The notion of errors is ill-defined. 380