Annotation of src/usr.bin/netstat/netstat.1, Revision 1.30
1.30 ! jmc 1: .\" $OpenBSD: netstat.1,v 1.29 2003/06/03 02:56:13 millert Exp $
1.1 deraadt 2: .\" $NetBSD: netstat.1,v 1.11 1995/10/03 21:42:43 thorpej Exp $
3: .\"
4: .\" Copyright (c) 1983, 1990, 1992, 1993
5: .\" The Regents of the University of California. All rights reserved.
6: .\"
7: .\" Redistribution and use in source and binary forms, with or without
8: .\" modification, are permitted provided that the following conditions
9: .\" are met:
10: .\" 1. Redistributions of source code must retain the above copyright
11: .\" notice, this list of conditions and the following disclaimer.
12: .\" 2. Redistributions in binary form must reproduce the above copyright
13: .\" notice, this list of conditions and the following disclaimer in the
14: .\" documentation and/or other materials provided with the distribution.
1.29 millert 15: .\" 3. Neither the name of the University nor the names of its contributors
1.1 deraadt 16: .\" may be used to endorse or promote products derived from this software
17: .\" without specific prior written permission.
18: .\"
19: .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20: .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21: .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22: .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23: .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24: .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25: .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26: .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27: .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28: .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29: .\" SUCH DAMAGE.
30: .\"
31: .\" from: @(#)netstat.1 8.8 (Berkeley) 4/18/94
32: .\"
33: .Dd April 18, 1994
34: .Dt NETSTAT 1
1.16 aaron 35: .Os
1.1 deraadt 36: .Sh NAME
37: .Nm netstat
38: .Nd show network status
39: .Sh SYNOPSIS
40: .Nm netstat
41: .Op Fl Aan
42: .Op Fl f Ar address_family
43: .Op Fl M Ar core
44: .Op Fl N Ar system
45: .Nm netstat
1.26 brian 46: .Op Fl bdgimnqrs
1.1 deraadt 47: .Op Fl f Ar address_family
48: .Op Fl M Ar core
49: .Op Fl N Ar system
50: .Nm netstat
1.24 camield 51: .Op Fl bdn
1.1 deraadt 52: .Op Fl I Ar interface
53: .Op Fl M Ar core
54: .Op Fl N Ar system
55: .Op Fl w Ar wait
56: .Nm netstat
57: .Op Fl p Ar protocol
58: .Op Fl M Ar core
59: .Op Fl N Ar system
1.19 itojun 60: .Nm netstat
61: .Op Fl s
62: .Op Fl f Ar address_family
63: .Op Fl i
64: .Op Fl I Ar Interface
1.1 deraadt 65: .Sh DESCRIPTION
66: The
1.21 aaron 67: .Nm
1.1 deraadt 68: command symbolically displays the contents of various network-related
69: data structures.
70: There are a number of output formats,
71: depending on the options for the information presented.
1.21 aaron 72: .Pp
1.1 deraadt 73: The first form of the command displays a list of active sockets for
74: each protocol.
75: The second form presents the contents of one of the other network
76: data structures according to the option selected.
77: Using the third form, with a
78: .Ar wait
79: interval specified,
1.21 aaron 80: .Nm
1.1 deraadt 81: will continuously display the information regarding packet
82: traffic on the configured network interfaces.
83: The fourth form displays statistics about the named protocol.
1.30 ! jmc 84: The fifth form displays per interface statistics for
! 85: the specified address family.
1.1 deraadt 86: .Pp
1.12 aaron 87: The options are as follows:
1.22 aaron 88: .Bl -tag -width Ds
1.1 deraadt 89: .It Fl A
90: With the default display,
91: show the address of any protocol control blocks associated with sockets; used
92: for debugging.
93: .It Fl a
94: With the default display,
95: show the state of all sockets; normally sockets used by
96: server processes are not shown.
1.24 camield 97: .It Fl b
98: With the interface display (option
99: .Fl i ) ,
100: show bytes in and out, instead of packet statistics.
1.1 deraadt 101: .It Fl d
102: With either interface display (option
103: .Fl i
104: or an interval, as described below),
105: show the number of dropped packets.
1.16 aaron 106: .It Fl f Ar address_family
1.1 deraadt 107: Limit statistics or address control block reports to those
108: of the specified
1.12 aaron 109: .Ar address_family .
1.21 aaron 110: .Pp
111: The following address families are recognized:
112: .Pp
113: .Bl -column "Address Family" "AF_APPLETA" "Description" -offset indent -compact
114: .It Sy "Address Family" Ta Sy "Constant" Ta Sy "Description"
115: .It "inet" Dv Ta "AF_INET" Ta "IP Version 4"
116: .It "inet6" Dv Ta "AF_INET6" Ta "IP Version 6"
117: .It "ipx" Dv Ta "AF_IPX" Ta "Novell IPX"
118: .It "atalk" Dv Ta "AF_APPLETALK" Ta "AppleTalk"
119: .It "ns" Dv Ta "AF_NS" Ta "Xerox NS Protocols"
120: .It "iso" Dv Ta "AF_ISO" Ta "ISO Protocol Family"
121: .It "encap" Dv Ta "PF_KEY" Ta "IPsec"
122: .It "local" Dv Ta "AF_LOCAL" Ta "Local to Host (i.e., pipes)"
123: .It "unix" Dv Ta "AF_UNIX" Ta "Local to Host (i.e., pipes)"
124: .El
125: .Pp
1.1 deraadt 126: .It Fl g
127: Show information related to multicast (group address) routing.
128: By default, show the IP Multicast virtual-interface and routing tables.
129: If the
130: .Fl s
131: option is also present, show multicast routing statistics.
1.16 aaron 132: .It Fl I Ar interface
1.21 aaron 133: Show information about the specified
134: .Ar interface ;
1.1 deraadt 135: used with a
136: .Ar wait
137: interval as described below.
1.30 ! jmc 138: .br
1.21 aaron 139: .Pp
1.19 itojun 140: If the
141: .Fl f Ar address_family
142: option (with the
143: .Fl s
1.30 ! jmc 144: option) is present, show per-interface
! 145: statistics on the given interface for the specified
! 146: .Ar address_family .
1.1 deraadt 147: .It Fl i
148: Show the state of interfaces which have been auto-configured
1.21 aaron 149: (interfaces statically configured into a system but not
150: located at boot-time are not shown).
151: .Pp
1.1 deraadt 152: If the
153: .Fl a
1.21 aaron 154: option is also present, multicast addresses currently in use are shown
1.1 deraadt 155: for each Ethernet interface and for each IP interface address.
156: Multicast addresses are shown on separate lines following the interface
157: address with which they are associated.
1.21 aaron 158: .Pp
1.19 itojun 159: If the
160: .Fl f Ar address_family
161: option (with the
162: .Fl s
1.30 ! jmc 163: option) is present, show per-interface statistics on all interfaces
1.21 aaron 164: for the specified
1.30 ! jmc 165: .Ar address_family .
1.17 deraadt 166: .It Fl M Ar core
1.1 deraadt 167: Extract values associated with the name list from the specified core
1.27 miod 168: instead of the running kernel.
1.1 deraadt 169: .It Fl m
170: Show statistics recorded by the memory management routines
171: (the network manages a private pool of memory buffers).
1.17 deraadt 172: .It Fl N Ar system
1.27 miod 173: Extract the name list from the specified system instead of the running kernel.
1.1 deraadt 174: .It Fl n
175: Show network addresses as numbers (normally
1.21 aaron 176: .Nm
1.1 deraadt 177: interprets addresses and attempts to display them
178: symbolically).
179: This option may be used with any of the display formats.
1.16 aaron 180: .It Fl p Ar protocol
1.1 deraadt 181: Show statistics about
1.12 aaron 182: .Ar protocol ,
1.21 aaron 183: which is either a well-known name for a protocol or an alias for it.
184: Some protocol names and aliases are listed in the file
1.1 deraadt 185: .Pa /etc/protocols .
186: A null response typically means that there are no interesting numbers to
187: report.
188: The program will complain if
189: .Ar protocol
190: is unknown or if there is no statistics routine for it.
1.26 brian 191: .It Fl q
192: Only show interfaces that have seen packets (or bytes if
193: .Fl b
194: is specified)
1.1 deraadt 195: .It Fl r
196: Show the routing tables.
1.21 aaron 197: If the
1.1 deraadt 198: .Fl s
1.21 aaron 199: option is also specified, show routing statistics instead.
1.26 brian 200: .It Fl s
201: Show per-protocol statistics.
202: If this option is repeated, counters with a value of zero are suppressed.
1.10 peter 203: .It Fl v
1.19 itojun 204: Be verbose.
205: Avoids truncation of long addresses.
1.1 deraadt 206: .It Fl w Ar wait
207: Show network interface statistics at intervals of
208: .Ar wait
209: seconds.
210: .El
211: .Pp
212: The default display, for active sockets, shows the local
213: and remote addresses, send and receive queue sizes (in bytes), protocol,
214: and the internal state of the protocol.
1.21 aaron 215: .Pp
216: Address formats are of the form
217: .Dq host.port
218: or
219: .Dq network.port
1.1 deraadt 220: if a socket's address specifies a network but no specific host address.
1.21 aaron 221: When known, the host and network addresses are displayed symbolically
222: according to the databases
1.1 deraadt 223: .Pa /etc/hosts
224: and
225: .Pa /etc/networks ,
1.21 aaron 226: respectively.
227: If a symbolic name for an address is unknown, or if the
1.1 deraadt 228: .Fl n
229: option is specified, the address is printed numerically, according
230: to the address family.
1.21 aaron 231: .Pp
232: For more information regarding the Internet
233: .Dq dot format ,
1.1 deraadt 234: refer to
1.12 aaron 235: .Xr inet 3 .
1.21 aaron 236: Unspecified, or
237: .Dq wildcard
238: addresses and ports appear as a single
239: .Dq \&* .
1.6 deraadt 240: If a local port number is registered as being in use for RPC by
1.12 aaron 241: .Xr portmap 8 ,
1.11 aaron 242: its RPC service name or RPC service number will be printed in
1.21 aaron 243: .Dq []
244: immediately after the port number.
1.1 deraadt 245: .Pp
246: The interface display provides a table of cumulative
247: statistics regarding packets transferred, errors, and collisions.
248: The network addresses of the interface
1.21 aaron 249: and the maximum transmission unit (MTU) are also displayed.
1.1 deraadt 250: .Pp
1.21 aaron 251: The routing table display indicates the available routes and their status.
252: Each route consists of a destination host or network and
253: a gateway to use in forwarding packets.
254: If the destination is a
255: network in numeric format, the netmask (in /24 style format) is appended.
256: The flags field shows a collection of information about
257: the route stored as binary choices.
258: The individual flags are discussed in more detail in the
1.1 deraadt 259: .Xr route 8
260: and
261: .Xr route 4
262: manual pages.
1.21 aaron 263: .Pp
1.1 deraadt 264: The mapping between letters and flags is:
265: .Bl -column XXXX RTF_BLACKHOLE
1.12 aaron 266: 1 RTF_PROTO1 Protocol specific routing flag #1.
267: 2 RTF_PROTO2 Protocol specific routing flag #2.
1.25 niklas 268: 3 RTF_PROTO3 Protocol specific routing flag #3.
1.16 aaron 269: B RTF_BLACKHOLE Just discard pkts (during updates).
1.12 aaron 270: C RTF_CLONING Generate new routes on use.
271: D RTF_DYNAMIC Created dynamically (by redirect).
272: G RTF_GATEWAY Destination requires forwarding by intermediary.
273: H RTF_HOST Host entry (net otherwise).
1.1 deraadt 274: L RTF_LLINFO Valid protocol to link address translation.
1.12 aaron 275: M RTF_MODIFIED Modified dynamically (by redirect).
276: R RTF_REJECT Host or net unreachable.
277: S RTF_STATIC Manually added.
278: U RTF_UP Route usable.
279: X RTF_XRESOLVE External daemon translates proto to link address.
1.1 deraadt 280: .El
281: .Pp
1.21 aaron 282: Direct routes are created for each interface attached to the local host;
1.1 deraadt 283: the gateway field for such entries shows the address of the outgoing interface.
1.21 aaron 284: The refcnt field gives the current number of active uses of the route.
285: Connection oriented protocols normally hold on to a single route for the
286: duration of a connection while connectionless protocols obtain a route while
287: sending to the same destination.
288: The use field provides a count of the number of packets sent using that route.
289: The MTU entry shows the MTU associated with that route.
290: This MTU value is used as the basis for the TCP maximum segment size (MSS).
1.23 provos 291: The 'L' flag appended to the mtu value indicates that the value is
292: locked, and that path mtu discovery is turned off for that route.
1.21 aaron 293: A
1.1 deraadt 294: .Sq -
1.12 aaron 295: indicates that the MTU for this route has not been set, and a default
1.21 aaron 296: TCP maximum segment size will be used.
297: The interface entry indicates the network interface utilized for the route.
1.1 deraadt 298: .Pp
299: When
1.21 aaron 300: .Nm
1.1 deraadt 301: is invoked with the
302: .Fl w
303: option and a
304: .Ar wait
305: interval argument, it displays a running count of statistics related to
306: network interfaces.
307: An obsolescent version of this option used a numeric parameter
308: with no option, and is currently supported for backward compatibility.
309: This display consists of a column for the primary interface (the first
310: interface found during autoconfiguration) and a column summarizing
311: information for all interfaces.
312: The primary interface may be replaced with another interface with the
313: .Fl I
314: option.
315: The first line of each screen of information contains a summary since the
1.21 aaron 316: system was last rebooted.
317: Subsequent lines of output show values accumulated over the preceding interval.
1.1 deraadt 318: .Sh SEE ALSO
319: .Xr nfsstat 1 ,
320: .Xr ps 1 ,
1.21 aaron 321: .Xr netintro 4 ,
1.1 deraadt 322: .Xr hosts 5 ,
323: .Xr networks 5 ,
324: .Xr protocols 5 ,
325: .Xr services 5 ,
1.15 alex 326: .Xr iostat 8 ,
1.1 deraadt 327: .Xr trpt 8 ,
328: .Xr vmstat 8
329: .Sh HISTORY
330: The
1.21 aaron 331: .Nm
1.1 deraadt 332: command appeared in
333: .Bx 4.2 .
1.19 itojun 334: IPv6 support was added by WIDE/KAME project.
1.1 deraadt 335: .Sh BUGS
336: The notion of errors is ill-defined.