xref: /freebsd/usr.bin/netstat/netstat.1 (revision dd41de95a84d979615a2ef11df6850622bf6184e)
1.\" Copyright (c) 1983, 1990, 1992, 1993
2.\"	The Regents of the University of California.  All rights reserved.
3.\"
4.\" Redistribution and use in source and binary forms, with or without
5.\" modification, are permitted provided that the following conditions
6.\" are met:
7.\" 1. Redistributions of source code must retain the above copyright
8.\"    notice, this list of conditions and the following disclaimer.
9.\" 2. Redistributions in binary form must reproduce the above copyright
10.\"    notice, this list of conditions and the following disclaimer in the
11.\"    documentation and/or other materials provided with the distribution.
12.\" 3. Neither the name of the University nor the names of its contributors
13.\"    may be used to endorse or promote products derived from this software
14.\"    without specific prior written permission.
15.\"
16.\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
17.\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18.\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19.\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
20.\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21.\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22.\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23.\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24.\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25.\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
26.\" SUCH DAMAGE.
27.\"
28.\"	@(#)netstat.1	8.8 (Berkeley) 4/18/94
29.\" $FreeBSD$
30.\"
31.Dd September 25, 2020
32.Dt NETSTAT 1
33.Os
34.Sh NAME
35.Nm netstat
36.Nd show network status and statistics
37.Sh SYNOPSIS
38.Bk -words
39.Bl -tag -width "netstat"
40.It Nm
41.Op Fl -libxo
42.Op Fl 46AaCLnPRSTWx
43.Op Fl f Ar protocol_family | Fl p Ar protocol
44.Op Fl M Ar core
45.Op Fl N Ar system
46.It Nm Fl i | I Ar interface
47.Op Fl -libxo
48.Op Fl 46abdhnW
49.Op Fl f Ar address_family
50.Op Fl M Ar core
51.Op Fl N Ar system
52.It Nm Fl w Ar wait
53.Op Fl -libxo
54.Op Fl I Ar interface
55.Op Fl 46d
56.Op Fl M Ar core
57.Op Fl N Ar system
58.Op Fl q Ar howmany
59.It Nm Fl s
60.Op Fl -libxo
61.Op Fl 46sz
62.Op Fl f Ar protocol_family | Fl p Ar protocol
63.Op Fl M Ar core
64.Op Fl N Ar system
65.It Nm Fl i | I Ar interface Fl s
66.Op Fl -libxo
67.Op Fl 46s
68.Op Fl f Ar protocol_family | Fl p Ar protocol
69.Op Fl M Ar core
70.Op Fl N Ar system
71.It Nm Fl m
72.Op Fl -libxo
73.Op Fl M Ar core
74.Op Fl N Ar system
75.It Nm Fl B
76.Op Fl -libxo
77.Op Fl z
78.Op Fl I Ar interface
79.It Nm Fl r
80.Op Fl -libxo
81.Op Fl 46nW
82.Op Fl F Ar fibnum
83.Op Fl f Ar address_family
84.It Nm Fl rs
85.Op Fl -libxo
86.Op Fl s
87.Op Fl M Ar core
88.Op Fl N Ar system
89.It Nm Fl g
90.Op Fl -libxo
91.Op Fl 46W
92.Op Fl f Ar address_family
93.It Nm Fl gs
94.Op Fl -libxo
95.Op Fl 46s
96.Op Fl f Ar address_family
97.Op Fl M Ar core
98.Op Fl N Ar system
99.It Nm Fl Q
100.Op Fl -libxo
101.El
102.Ek
103.Sh DESCRIPTION
104The
105.Nm
106command symbolically displays the contents of various network-related
107data structures.
108There are a number of output formats,
109depending on the options for the information presented.
110.Bl -tag -width indent
111.It Xo
112.Bk -words
113.Nm
114.Op Fl 46AaCLnRSTWx
115.Op Fl f Ar protocol_family | Fl p Ar protocol
116.Op Fl M Ar core
117.Op Fl N Ar system
118.Ek
119.Xc
120Display a list of active sockets
121(protocol control blocks)
122for each network protocol.
123.Pp
124The default display for active sockets shows the local
125and remote addresses, send and receive queue sizes (in bytes), protocol,
126and the internal state of the protocol.
127Address formats are of the form
128.Dq host.port
129or
130.Dq network.port
131if a socket's address specifies a network but no specific host address.
132When known, the host and network addresses are displayed symbolically
133according to the databases
134.Xr hosts 5
135and
136.Xr networks 5 ,
137respectively.
138If a symbolic name for an address is unknown, or if
139the
140.Fl n
141option is specified, the address is printed numerically, according
142to the address family.
143For more information regarding
144the Internet IPv4
145.Dq dot format ,
146refer to
147.Xr inet 3 .
148Unspecified,
149or
150.Dq wildcard ,
151addresses and ports appear as
152.Dq Li * .
153.Bl -tag -width indent
154.It Fl -libxo
155Generate output via
156.Xr libxo 3
157in a selection of different human and machine readable formats.
158See
159.Xr xo_parse_args 3
160for details on command line arguments.
161.It Fl 4
162Show IPv4 only.
163See
164.Sx GENERAL OPTIONS .
165.It Fl 6
166Show IPv6 only.
167See
168.Sx GENERAL OPTIONS .
169.It Fl A
170Show the address of a protocol control block (PCB)
171associated with a socket; used for debugging.
172.It Fl a
173Show the state of all sockets;
174normally sockets used by server processes are not shown.
175.It Fl c
176Show the used TCP stack for each session.
177.It Fl C
178Show the congestion control algorithm and diagnostic information of TCP sockets.
179.It Fl L
180Show the size of the various listen queues.
181The first count shows the number of unaccepted connections,
182the second count shows the amount of unaccepted incomplete connections,
183and the third count is the maximum number of queued connections.
184.It Fl n
185Do not resolve numeric addresses and port numbers to names.
186See
187.Sx GENERAL OPTIONS .
188.It Fl P
189Display the log ID for each socket.
190.It Fl R
191Display the flowid and flowtype for each socket.
192flowid is a 32 bit hardware specific identifier for each flow.
193flowtype defines which protocol fields are hashed to produce the id.
194A complete listing is available in
195.Pa sys/mbuf.h
196under
197.Dv M_HASHTYPE_* .
198.It Fl S
199Show network addresses as numbers (as with
200.Fl n )
201but show ports symbolically.
202.It Fl T
203Display diagnostic information from the TCP control block.
204Fields include the number of packets requiring retransmission,
205received out-of-order, and those advertising a zero-sized window.
206.It Fl W
207Avoid truncating addresses even if this causes some fields to overflow.
208.It Fl x
209Display socket buffer and TCP timer statistics for each
210internet socket.
211.Pp
212The
213.Fl x
214flag causes
215.Nm
216to output all the information recorded about data
217stored in the socket buffers.
218The fields are:
219.Bl -column ".Li R-MBUF"
220.It Li R-MBUF Ta Number of mbufs in the receive queue.
221.It Li S-MBUF Ta Number of mbufs in the send queue.
222.It Li R-CLUS Ta Number of clusters, of any type, in the receive
223queue.
224.It Li S-CLUS Ta Number of clusters, of any type, in the send queue.
225.It Li R-HIWA Ta Receive buffer high water mark, in bytes.
226.It Li S-HIWA Ta Send buffer high water mark, in bytes.
227.It Li R-LOWA Ta Receive buffer low water mark, in bytes.
228.It Li S-LOWA Ta Send buffer low water mark, in bytes.
229.It Li R-BCNT Ta Receive buffer byte count.
230.It Li S-BCNT Ta Send buffer byte count.
231.It Li R-BMAX Ta Maximum bytes that can be used in the receive buffer.
232.It Li S-BMAX Ta Maximum bytes that can be used in the send buffer.
233.It Li rexmt Ta Time, in seconds, to fire Retransmit Timer, or 0 if not armed.
234.It Li persist Ta Time, in seconds, to fire Retransmit Persistence, or 0 if not armed.
235.It Li keep Ta Time, in seconds, to fire Keep Alive, or 0 if not armed.
236.It Li 2msl Ta Time, in seconds, to fire 2*msl TIME_WAIT Timer, or 0 if not armed.
237.It Li delack Ta Time, in seconds, to fire Delayed ACK Timer, or 0 if not armed.
238.It Li rcvtime Ta Time, in seconds, since last packet received.
239.El
240.It Fl f Ar protocol_family
241Filter by
242.Ar protocol_family .
243See
244.Sx GENERAL OPTIONS .
245.It Fl p Ar protocol
246Filter by
247.Ar protocol .
248See
249.Sx GENERAL OPTIONS .
250.It Fl M
251Use an alternative core.
252See
253.Sx GENERAL OPTIONS .
254.It Fl N
255Use an alternative kernel image.
256See
257.Sx GENERAL OPTIONS .
258.El
259.It Xo
260.Bk -words
261.Nm
262.Fl i | I Ar interface
263.Op Fl 46abdhnW
264.Op Fl f Ar address_family
265.Op Fl M Ar core
266.Op Fl N Ar system
267.Ek
268.Xc
269Show the state of all network interfaces or a single
270.Ar interface
271which have been auto-configured
272(interfaces statically configured into a system, but not
273located at boot time are not shown).
274An asterisk
275.Pq Dq Li *
276after an interface name indicates that the interface is
277.Dq down .
278.Pp
279When
280.Nm
281is invoked with
282.Fl i
283.Pq all interfaces
284or
285.Fl I Ar interface ,
286it provides a table of cumulative
287statistics regarding packets transferred, errors, and collisions.
288The network addresses of the interface
289and the maximum transmission unit
290.Pq Dq mtu
291are also displayed.
292.Bl -tag -width indent
293.It Fl 4
294Show IPv4 only.
295See
296.Sx GENERAL OPTIONS .
297.It Fl 6
298Show IPv6 only.
299See
300.Sx GENERAL OPTIONS .
301.It Fl a
302Multicast addresses currently in use are shown
303for each Ethernet interface and for each IP interface address.
304Multicast addresses are shown on separate lines following the interface
305address with which they are associated.
306.It Fl b
307Show the number of bytes in and out.
308.It Fl d
309Show the number of dropped packets.
310.It Fl h
311Print all counters in human readable form.
312.It Fl n
313Do not resolve numeric addresses and port numbers to names.
314See
315.Sx GENERAL OPTIONS .
316.It Fl W
317Avoid truncating interface names even if this causes some fields to overflow.
318.Sx GENERAL OPTIONS .
319.It Fl f Ar protocol_family
320Filter by
321.Ar protocol_family .
322See
323.Sx GENERAL OPTIONS .
324.El
325.It Xo
326.Bk -words
327.Nm
328.Fl w Ar wait
329.Op Fl I Ar interface
330.Op Fl 46d
331.Op Fl M Ar core
332.Op Fl N Ar system
333.Op Fl q Ar howmany
334.Ek
335.Xc
336At intervals of
337.Ar wait
338seconds, display the information regarding packet traffic on all
339configured network interfaces or a single
340.Ar interface .
341.Pp
342When
343.Nm
344is invoked with the
345.Fl w
346option and a
347.Ar wait
348interval argument, it displays a running count of statistics related to
349network interfaces.
350An obsolescent version of this option used a numeric parameter
351with no option, and is currently supported for backward compatibility.
352By default, this display summarizes information for all interfaces.
353Information for a specific interface may be displayed with the
354.Fl I Ar interface
355option.
356.Bl -tag -width indent
357.It Fl I Ar interface
358Only show information regarding
359.Ar interface
360.It Fl 4
361Show IPv4 only.
362See
363.Sx GENERAL OPTIONS .
364.It Fl 6
365Show IPv6 only.
366See
367.Sx GENERAL OPTIONS .
368.It Fl d
369Show the number of dropped packets.
370.It Fl M
371Use an alternative core.
372See
373.Sx GENERAL OPTIONS .
374.It Fl N
375Use an alternative kernel image.
376See
377.Sx GENERAL OPTIONS .
378.It Fl q
379Exit after
380.Ar howmany
381outputs.
382.El
383.It Xo
384.Bk -words
385.Nm
386.Fl s
387.Op Fl 46sz
388.Op Fl f Ar protocol_family | Fl p Ar protocol
389.Op Fl M Ar core
390.Op Fl N Ar system
391.Ek
392.Xc
393Display system-wide statistics for each network protocol.
394.Bl -tag -width indent
395.It Fl 4
396Show IPv4 only.
397See
398.Sx GENERAL OPTIONS .
399.It Fl 6
400Show IPv6 only.
401See
402.Sx GENERAL OPTIONS .
403.It Fl s
404If
405.Fl s
406is repeated, counters with a value of zero are suppressed.
407.It Fl z
408Reset statistic counters after displaying them.
409.It Fl f Ar protocol_family
410Filter by
411.Ar protocol_family .
412See
413.Sx GENERAL OPTIONS .
414.It Fl p Ar protocol
415Filter by
416.Ar protocol .
417See
418.Sx GENERAL OPTIONS .
419.It Fl M
420Use an alternative core.
421See
422.Sx GENERAL OPTIONS .
423.It Fl N
424Use an alternative kernel image
425See
426.Sx GENERAL OPTIONS .
427.El
428.It Xo
429.Bk -words
430.Nm
431.Fl i | I Ar interface Fl s
432.Op Fl 46s
433.Op Fl f Ar protocol_family | Fl p Ar protocol
434.Op Fl M Ar core
435.Op Fl N Ar system
436.Ek
437.Xc
438Display per-interface statistics for each network protocol.
439.Bl -tag -width indent
440.It Fl 4
441Show IPv4 only
442See
443.Sx GENERAL OPTIONS .
444.It Fl 6
445Show IPv6 only
446See
447.Sx GENERAL OPTIONS .
448.It Fl s
449If
450.Fl s
451is repeated, counters with a value of zero are suppressed.
452.It Fl f Ar protocol_family
453Filter by
454.Ar protocol_family .
455See
456.Sx GENERAL OPTIONS .
457.It Fl p Ar protocol
458Filter by
459.Ar protocol .
460See
461.Sx GENERAL OPTIONS .
462.It Fl M
463Use an alternative core
464See
465.Sx GENERAL OPTIONS .
466.It Fl N
467Use an alternative kernel image
468See
469.Sx GENERAL OPTIONS .
470.El
471.It Xo
472.Bk -words
473.Nm
474.Fl m
475.Op Fl M Ar core
476.Op Fl N Ar system
477.Ek
478.Xc
479Show statistics recorded by the memory management routines
480.Pq Xr mbuf 9 .
481The network manages a private pool of memory buffers.
482.Bl -tag -width indent
483.It Fl M
484Use an alternative core
485See
486.Sx GENERAL OPTIONS .
487.It Fl N
488Use an alternative kernel image
489See
490.Sx GENERAL OPTIONS .
491.El
492.It Xo
493.Bk -words
494.Nm
495.Fl B
496.Op Fl z
497.Op Fl I Ar interface
498.Ek
499.Xc
500Show statistics about
501.Xr bpf 4
502peers.
503This includes information like
504how many packets have been matched, dropped and received by the
505bpf device, also information about current buffer sizes and device
506states.
507.Pp
508The
509.Xr bpf 4
510flags displayed when
511.Nm
512is invoked with the
513.Fl B
514option represent the underlying parameters of the bpf peer.
515Each flag is
516represented as a single lower case letter.
517The mapping between the letters and flags in order of appearance are:
518.Bl -column ".Li i"
519.It Li p Ta Set if listening promiscuously
520.It Li i Ta Dv BIOCIMMEDIATE No has been set on the device
521.It Li f Ta Dv BIOCGHDRCMPLT No status: source link addresses are being
522filled automatically
523.It Li s Ta Dv BIOCGSEESENT No status: see packets originating locally and
524remotely on the interface.
525.It Li a Ta Packet reception generates a signal
526.It Li l Ta Dv BIOCLOCK No status: descriptor has been locked
527.El
528.Pp
529For more information about these flags, please refer to
530.Xr bpf 4 .
531.Bl -tag -width indent
532.It Fl z
533Reset statistic counters after displaying them.
534.El
535.It Xo
536.Bk -words
537.Nm
538.Fl r
539.Op Fl 46AnW
540.Op Fl F Ar fibnum
541.Op Fl f Ar address_family
542.Op Fl M Ar core
543.Op Fl N Ar system
544.Ek
545.Xc
546Display the contents of routing tables.
547.Pp
548When
549.Nm
550is invoked with the routing table option
551.Fl r ,
552it lists the available routes and their status.
553Each route consists of a destination host or network, and a gateway to use
554in forwarding packets.
555The flags field shows a collection of information about the route stored
556as binary choices.
557The individual flags are discussed in more detail in the
558.Xr route 8
559and
560.Xr route 4
561manual pages.
562The mapping between letters and flags is:
563.Bl -column ".Li W" ".Dv RTF_WASCLONED"
564.It Li 1 Ta Dv RTF_PROTO1 Ta "Protocol specific routing flag #1"
565.It Li 2 Ta Dv RTF_PROTO2 Ta "Protocol specific routing flag #2"
566.It Li 3 Ta Dv RTF_PROTO3 Ta "Protocol specific routing flag #3"
567.It Li B Ta Dv RTF_BLACKHOLE Ta "Just discard pkts (during updates)"
568.It Li b Ta Dv RTF_BROADCAST Ta "The route represents a broadcast address"
569.It Li D Ta Dv RTF_DYNAMIC Ta "Created dynamically (by redirect)"
570.It Li G Ta Dv RTF_GATEWAY Ta "Destination requires forwarding by intermediary"
571.It Li H Ta Dv RTF_HOST Ta "Host entry (net otherwise)"
572.It Li L Ta Dv RTF_LLINFO Ta "Valid protocol to link address translation"
573.It Li M Ta Dv RTF_MODIFIED Ta "Modified dynamically (by redirect)"
574.It Li R Ta Dv RTF_REJECT Ta "Host or net unreachable"
575.It Li S Ta Dv RTF_STATIC Ta "Manually added"
576.It Li U Ta Dv RTF_UP Ta "Route usable"
577.It Li X Ta Dv RTF_XRESOLVE Ta "External daemon translates proto to link address"
578.El
579.Pp
580Direct routes are created for each
581interface attached to the local host;
582the gateway field for such entries shows the address of the outgoing interface.
583The refcnt field gives the
584current number of active uses of the route.
585Connection oriented
586protocols normally hold on to a single route for the duration of
587a connection while connectionless protocols obtain a route while sending
588to the same destination.
589The use field provides a count of the number of packets
590sent using that route.
591The interface entry indicates the network interface utilized for the route.
592.Bl -tag -width indent
593.It Fl 4
594Show IPv4 only.
595See
596.Sx GENERAL OPTIONS .
597.It Fl 6
598Show IPv6 only.
599See
600.Sx GENERAL OPTIONS .
601.It Fl n
602Do not resolve numeric addresses and port numbers to names.
603See
604.Sx GENERAL OPTIONS .
605.It Fl W
606Show the path MTU for each route, and print interface names with a
607wider field size.
608.It Fl F
609Display the routing table with the number
610.Ar fibnum .
611If the specified
612.Ar fibnum
613is -1 or
614.Fl F
615is not specified,
616the default routing table is displayed.
617.It Fl f
618Display the routing table for a particular
619.Ar address_family .
620.It Fl M
621Use an alternative core
622See
623.Sx GENERAL OPTIONS .
624.It Fl N
625Use an alternative kernel image
626See
627.Sx GENERAL OPTIONS .
628.El
629.It Xo
630.Bk -words
631.Nm
632.Fl rs
633.Op Fl s
634.Op Fl M Ar core
635.Op Fl N Ar system
636.Ek
637.Xc
638Display routing statistics.
639.Bl -tag -width indent
640.It Fl s
641If
642.Fl s
643is repeated, counters with a value of zero are suppressed.
644.It Fl M
645Use an alternative core
646See
647.Sx GENERAL OPTIONS .
648.It Fl N
649Use an alternative kernel image
650See
651.Sx GENERAL OPTIONS .
652.El
653.It Xo
654.Bk -words
655.Nm
656.Fl g
657.Op Fl 46W
658.Op Fl f Ar address_family
659.Op Fl M Ar core
660.Op Fl N Ar system
661.Ek
662.Xc
663Display the contents of the multicast virtual interface tables,
664and multicast forwarding caches.
665Entries in these tables will appear only when the kernel is
666actively forwarding multicast sessions.
667This option is applicable only to the
668.Cm inet
669and
670.Cm inet6
671address families.
672.Bl -tag -width indent
673.It Fl 4
674Show IPv4 only
675See
676.Sx GENERAL OPTIONS .
677.It Fl 6
678Show IPv6 only
679See
680.Sx GENERAL OPTIONS .
681.It Fl W
682Avoid truncating addresses even if this causes some fields to overflow.
683.It Fl f Ar protocol_family
684Filter by
685.Ar protocol_family .
686See
687.Sx GENERAL OPTIONS .
688.It Fl M
689Use an alternative core
690See
691.Sx GENERAL OPTIONS .
692.It Fl N
693Use an alternative kernel image
694See
695.Sx GENERAL OPTIONS .
696.El
697.It Xo
698.Bk -words
699.Nm
700.Fl gs
701.Op Fl 46s
702.Op Fl f Ar address_family
703.Op Fl M Ar core
704.Op Fl N Ar system
705.Ek
706.Xc
707Show multicast routing statistics.
708.Bl -tag -width indent
709.It Fl 4
710Show IPv4 only
711See
712.Sx GENERAL OPTIONS .
713.It Fl 6
714Show IPv6 only
715See
716.Sx GENERAL OPTIONS .
717.It Fl s
718If
719.Fl s
720is repeated, counters with a value of zero are suppressed.
721.It Fl f Ar protocol_family
722Filter by
723.Ar protocol_family .
724See
725.Sx GENERAL OPTIONS .
726.It Fl M
727Use an alternative core
728See
729.Sx GENERAL OPTIONS .
730.It Fl N
731Use an alternative kernel image
732See
733.Sx GENERAL OPTIONS .
734.El
735.It Xo
736.Bk -words
737.Nm
738.Fl Q
739.Ek
740.Xc
741Show
742.Xr netisr 9
743statistics.
744The flags field shows available ISR handlers:
745.Bl -column ".Li W" ".Dv NETISR_SNP_FLAGS_DRAINEDCPU"
746.It Li C Ta Dv NETISR_SNP_FLAGS_M2CPUID Ta "Able to map mbuf to cpu id"
747.It Li D Ta Dv NETISR_SNP_FLAGS_DRAINEDCPU  Ta "Has queue drain handler"
748.It Li F Ta Dv NETISR_SNP_FLAGS_M2FLOW Ta "Able to map mbuf to flow id"
749.El
750.El
751.Ss GENERAL OPTIONS
752Some options have the general meaning:
753.Bl -tag -width flag
754.It Fl 4
755Is shorthand for
756.Fl f
757.Ar inet
758.Pq Show only IPv4
759.It Fl 6
760Is shorthand for
761.Fl f
762.Ar inet6
763.Pq Show only IPv6
764.It Fl f Ar address_family , Fl p Ar protocol
765Limit display to those records
766of the specified
767.Ar address_family
768or a single
769.Ar protocol .
770The following address families and protocols are recognized:
771.Pp
772.Bl -tag -width ".Cm netgraph , ng Pq Dv AF_NETGRAPH" -compact
773.It Em Family
774.Em Protocols
775.It Cm inet Pq Dv AF_INET
776.Cm divert , icmp , igmp , ip , ipsec , pim, sctp , tcp , udp
777.It Cm inet6 Pq Dv AF_INET6
778.Cm icmp6 , ip6 , ipsec6 , rip6 , sctp , tcp , udp
779.It Cm pfkey Pq Dv PF_KEY
780.Cm pfkey
781.It Cm netgraph , ng Pq Dv AF_NETGRAPH
782.Cm ctrl , data
783.It Cm unix Pq Dv AF_UNIX
784.It Cm link Pq Dv AF_LINK
785.El
786.Pp
787The program will complain if
788.Ar protocol
789is unknown or if there is no statistics routine for it.
790.It Fl M
791Extract values associated with the name list from the specified core
792instead of the default
793.Pa /dev/kmem .
794.It Fl N
795Extract the name list from the specified system instead of the default,
796which is the kernel image the system has booted from.
797.It Fl n
798Show network addresses and ports as numbers.
799Normally
800.Nm
801attempts to resolve addresses and ports,
802and display them symbolically.
803.El
804.Sh EXAMPLES
805Show packet traffic information (packets, bytes, errors, packet drops, etc) for
806interface re0 updated every 2 seconds and exit after 5 outputs:
807.Bd -literal -offset indent
808$ netstat -w 2 -q 5 -I re0
809.Ed
810.Pp
811Show statistics for ICMP on any interface:
812.Bd -literal -offset indent
813$ netstat -s -p icmp
814.Ed
815.Pp
816Show routing tables:
817.Bd -literal -offset indent
818$ netstat -r
819.Ed
820.Pp
821Same as above, but without resolving numeric addresses and port numbers to
822names:
823.Bd -literal -offset indent
824$ netstat -rn
825.Ed
826.Sh SEE ALSO
827.Xr fstat 1 ,
828.Xr nfsstat 1 ,
829.Xr procstat 1 ,
830.Xr ps 1 ,
831.Xr sockstat 1 ,
832.Xr libxo 3 ,
833.Xr xo_parse_args 3 ,
834.Xr bpf 4 ,
835.Xr inet 4 ,
836.Xr route 4 ,
837.Xr unix 4 ,
838.Xr hosts 5 ,
839.Xr networks 5 ,
840.Xr protocols 5 ,
841.Xr services 5 ,
842.Xr iostat 8 ,
843.Xr route 8 ,
844.Xr trpt 8 ,
845.Xr vmstat 8 ,
846.Xr mbuf 9
847.Sh HISTORY
848The
849.Nm
850command appeared in
851.Bx 4.2 .
852.Pp
853IPv6 support was added by WIDE/KAME project.
854.Sh BUGS
855The notion of errors is ill-defined.
856