Annotation of src/usr.bin/netstat/netstat.1, Revision 1.50
1.50 ! henning 1: .\" $OpenBSD: netstat.1,v 1.49 2007/05/31 19:20:13 jmc Exp $
1.1 deraadt 2: .\" $NetBSD: netstat.1,v 1.11 1995/10/03 21:42:43 thorpej Exp $
3: .\"
4: .\" Copyright (c) 1983, 1990, 1992, 1993
5: .\" The Regents of the University of California. All rights reserved.
6: .\"
7: .\" Redistribution and use in source and binary forms, with or without
8: .\" modification, are permitted provided that the following conditions
9: .\" are met:
10: .\" 1. Redistributions of source code must retain the above copyright
11: .\" notice, this list of conditions and the following disclaimer.
12: .\" 2. Redistributions in binary form must reproduce the above copyright
13: .\" notice, this list of conditions and the following disclaimer in the
14: .\" documentation and/or other materials provided with the distribution.
1.29 millert 15: .\" 3. Neither the name of the University nor the names of its contributors
1.1 deraadt 16: .\" may be used to endorse or promote products derived from this software
17: .\" without specific prior written permission.
18: .\"
19: .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20: .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21: .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22: .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23: .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24: .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25: .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26: .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27: .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28: .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29: .\" SUCH DAMAGE.
30: .\"
31: .\" from: @(#)netstat.1 8.8 (Berkeley) 4/18/94
32: .\"
1.50 ! henning 33: .Dd $Mdocdate: May 31 2007 $
1.1 deraadt 34: .Dt NETSTAT 1
1.16 aaron 35: .Os
1.1 deraadt 36: .Sh NAME
37: .Nm netstat
38: .Nd show network status
39: .Sh SYNOPSIS
40: .Nm netstat
41: .Op Fl Aan
42: .Op Fl f Ar address_family
43: .Op Fl M Ar core
44: .Op Fl N Ar system
45: .Nm netstat
1.48 pyr 46: .Op Fl bdFgilmnqrstu
1.1 deraadt 47: .Op Fl f Ar address_family
48: .Op Fl M Ar core
49: .Op Fl N Ar system
50: .Nm netstat
1.24 camield 51: .Op Fl bdn
1.1 deraadt 52: .Op Fl I Ar interface
53: .Op Fl M Ar core
54: .Op Fl N Ar system
55: .Op Fl w Ar wait
56: .Nm netstat
1.45 jaredy 57: .Op Fl M Ar core
58: .Op Fl N Ar system
59: .Fl P Ar pcbaddr
60: .Nm netstat
1.35 markus 61: .Op Fl s
1.1 deraadt 62: .Op Fl M Ar core
63: .Op Fl N Ar system
1.31 jmc 64: .Op Fl p Ar protocol
1.19 itojun 65: .Nm netstat
1.34 jmc 66: .Op Fl a
1.19 itojun 67: .Op Fl f Ar address_family
1.34 jmc 68: .Op Fl i | I Ar interface
1.42 reyk 69: .Nm netstat
70: .Op Fl W Ar interface
1.1 deraadt 71: .Sh DESCRIPTION
72: The
1.21 aaron 73: .Nm
1.1 deraadt 74: command symbolically displays the contents of various network-related
75: data structures.
76: There are a number of output formats,
77: depending on the options for the information presented.
1.21 aaron 78: .Pp
1.1 deraadt 79: The first form of the command displays a list of active sockets for
80: each protocol.
81: The second form presents the contents of one of the other network
82: data structures according to the option selected.
83: Using the third form, with a
84: .Ar wait
85: interval specified,
1.21 aaron 86: .Nm
1.1 deraadt 87: will continuously display the information regarding packet
88: traffic on the configured network interfaces.
1.46 jmc 89: The fourth form displays statistics about the protocol control block (PCB).
90: The fifth form displays statistics about the named protocol.
91: The sixth form displays per interface statistics for
1.30 jmc 92: the specified address family.
1.43 jmc 93: The final form displays per interface statistics for
94: the specified wireless (802.11) device.
1.1 deraadt 95: .Pp
1.12 aaron 96: The options are as follows:
1.22 aaron 97: .Bl -tag -width Ds
1.1 deraadt 98: .It Fl A
99: With the default display,
100: show the address of any protocol control blocks associated with sockets; used
1.45 jaredy 101: for debugging, e.g. with the
102: .Fl P
103: flag.
1.1 deraadt 104: .It Fl a
105: With the default display,
106: show the state of all sockets; normally sockets used by
107: server processes are not shown.
1.34 jmc 108: With the interface display (options
109: .Fl I
110: or
111: .Fl i ) ,
112: show multicast addresses.
1.24 camield 113: .It Fl b
1.34 jmc 114: With the interface display (options
115: .Fl I
116: or
1.24 camield 117: .Fl i ) ,
118: show bytes in and out, instead of packet statistics.
1.1 deraadt 119: .It Fl d
1.34 jmc 120: With either the interface display (options
121: .Fl I
122: or
123: .Fl i )
124: or an interval (option
125: .Fl w ) ,
1.1 deraadt 126: show the number of dropped packets.
1.48 pyr 127: .It Fl F
128: When showing routes, only show routes whose gateway are in the
129: same address family as the destination.
1.16 aaron 130: .It Fl f Ar address_family
1.1 deraadt 131: Limit statistics or address control block reports to those
132: of the specified
1.12 aaron 133: .Ar address_family .
1.21 aaron 134: .Pp
135: The following address families are recognized:
136: .Pp
137: .Bl -column "Address Family" "AF_APPLETA" "Description" -offset indent -compact
138: .It Sy "Address Family" Ta Sy "Constant" Ta Sy "Description"
1.32 jmc 139: .It "inet" Ta Dv "AF_INET" Ta "IP Version 4"
140: .It "inet6" Ta Dv "AF_INET6" Ta "IP Version 6"
141: .It "atalk" Ta Dv "AF_APPLETALK" Ta "AppleTalk"
142: .It "encap" Ta Dv "PF_KEY" Ta "IPsec"
143: .It "local" Ta Dv "AF_LOCAL" Ta "Local to Host (i.e., pipes)"
144: .It "unix" Ta Dv "AF_UNIX" Ta "Local to Host (i.e., pipes)"
1.21 aaron 145: .El
146: .Pp
1.1 deraadt 147: .It Fl g
148: Show information related to multicast (group address) routing.
1.34 jmc 149: By default, show the IP multicast virtual-interface and routing tables.
1.1 deraadt 150: If the
151: .Fl s
152: option is also present, show multicast routing statistics.
1.16 aaron 153: .It Fl I Ar interface
1.21 aaron 154: Show information about the specified
155: .Ar interface ;
1.1 deraadt 156: used with a
157: .Ar wait
158: interval as described below.
1.21 aaron 159: .Pp
1.19 itojun 160: If the
1.34 jmc 161: .Fl a
162: option is also present, multicast addresses currently in use are shown
163: for the given interface and for each IP interface address.
164: Multicast addresses are shown on separate lines following the interface
165: address with which they are associated.
166: .Pp
167: If the
1.19 itojun 168: .Fl f Ar address_family
169: option (with the
170: .Fl s
1.30 jmc 171: option) is present, show per-interface
172: statistics on the given interface for the specified
173: .Ar address_family .
1.1 deraadt 174: .It Fl i
175: Show the state of interfaces which have been auto-configured
1.21 aaron 176: (interfaces statically configured into a system but not
177: located at boot-time are not shown).
178: .Pp
1.1 deraadt 179: If the
180: .Fl a
1.21 aaron 181: option is also present, multicast addresses currently in use are shown
1.1 deraadt 182: for each Ethernet interface and for each IP interface address.
183: Multicast addresses are shown on separate lines following the interface
184: address with which they are associated.
1.21 aaron 185: .Pp
1.19 itojun 186: If the
187: .Fl f Ar address_family
188: option (with the
189: .Fl s
1.30 jmc 190: option) is present, show per-interface statistics on all interfaces
1.21 aaron 191: for the specified
1.30 jmc 192: .Ar address_family .
1.31 jmc 193: .It Fl l
194: With the
195: .Fl g
196: option, display wider fields for the IPv6 multicast routing table
197: .Qq Origin
198: and
199: .Qq Group
200: columns.
1.17 deraadt 201: .It Fl M Ar core
1.1 deraadt 202: Extract values associated with the name list from the specified core
1.27 miod 203: instead of the running kernel.
1.1 deraadt 204: .It Fl m
205: Show statistics recorded by the memory management routines
206: (the network manages a private pool of memory buffers).
1.17 deraadt 207: .It Fl N Ar system
1.27 miod 208: Extract the name list from the specified system instead of the running kernel.
1.1 deraadt 209: .It Fl n
210: Show network addresses as numbers (normally
1.21 aaron 211: .Nm
1.1 deraadt 212: interprets addresses and attempts to display them
213: symbolically).
214: This option may be used with any of the display formats.
1.45 jaredy 215: .It Fl P Ar pcbaddr
216: Display the contents of the protocol control block (PCB) located at
217: the kernel virtual address
218: .Ar pcbaddr .
219: PCB addresses can be obtained using the
220: .Fl A
221: flag.
222: This option can currently only be used to display TCP control blocks.
1.16 aaron 223: .It Fl p Ar protocol
1.35 markus 224: Restrict the output to
1.12 aaron 225: .Ar protocol ,
1.21 aaron 226: which is either a well-known name for a protocol or an alias for it.
227: Some protocol names and aliases are listed in the file
1.1 deraadt 228: .Pa /etc/protocols .
229: The program will complain if
230: .Ar protocol
1.35 markus 231: is unknown.
232: If the
233: .Fl s
234: option is specified, the per-protocol statistics are displayed.
235: Otherwise the states of the matching sockets are shown.
1.26 brian 236: .It Fl q
237: Only show interfaces that have seen packets (or bytes if
238: .Fl b
1.34 jmc 239: is specified).
1.1 deraadt 240: .It Fl r
241: Show the routing tables.
1.21 aaron 242: If the
1.1 deraadt 243: .Fl s
1.21 aaron 244: option is also specified, show routing statistics instead.
1.26 brian 245: .It Fl s
246: Show per-protocol statistics.
247: If this option is repeated, counters with a value of zero are suppressed.
1.31 jmc 248: .It Fl t
249: With the
250: .Fl i
251: option, display the current value of the watchdog timer function.
252: .It Fl u
253: Limit statistics or address control block reports to the
254: .Dv AF_UNIX
255: address family.
1.10 peter 256: .It Fl v
1.19 itojun 257: Be verbose.
258: Avoids truncation of long addresses.
1.42 reyk 259: .It Fl W Ar interface
260: (IEEE 802.11 devices only)
261: Show per-interface IEEE 802.11 wireless statistics.
1.1 deraadt 262: .It Fl w Ar wait
263: Show network interface statistics at intervals of
264: .Ar wait
265: seconds.
266: .El
267: .Pp
268: The default display, for active sockets, shows the local
269: and remote addresses, send and receive queue sizes (in bytes), protocol,
270: and the internal state of the protocol.
1.21 aaron 271: .Pp
272: Address formats are of the form
273: .Dq host.port
274: or
275: .Dq network.port
1.1 deraadt 276: if a socket's address specifies a network but no specific host address.
1.21 aaron 277: When known, the host and network addresses are displayed symbolically
278: according to the databases
1.1 deraadt 279: .Pa /etc/hosts
280: and
281: .Pa /etc/networks ,
1.21 aaron 282: respectively.
283: If a symbolic name for an address is unknown, or if the
1.1 deraadt 284: .Fl n
285: option is specified, the address is printed numerically, according
286: to the address family.
1.21 aaron 287: .Pp
288: For more information regarding the Internet
289: .Dq dot format ,
1.1 deraadt 290: refer to
1.12 aaron 291: .Xr inet 3 .
1.34 jmc 292: Unspecified or
1.21 aaron 293: .Dq wildcard
294: addresses and ports appear as a single
1.34 jmc 295: .Sq * .
1.6 deraadt 296: If a local port number is registered as being in use for RPC by
1.12 aaron 297: .Xr portmap 8 ,
1.11 aaron 298: its RPC service name or RPC service number will be printed in
1.21 aaron 299: .Dq []
300: immediately after the port number.
1.1 deraadt 301: .Pp
302: The interface display provides a table of cumulative
303: statistics regarding packets transferred, errors, and collisions.
304: The network addresses of the interface
1.21 aaron 305: and the maximum transmission unit (MTU) are also displayed.
1.1 deraadt 306: .Pp
1.21 aaron 307: The routing table display indicates the available routes and their status.
308: Each route consists of a destination host or network and
309: a gateway to use in forwarding packets.
310: If the destination is a
311: network in numeric format, the netmask (in /24 style format) is appended.
312: The flags field shows a collection of information about
313: the route stored as binary choices.
314: The individual flags are discussed in more detail in the
1.1 deraadt 315: .Xr route 8
316: and
317: .Xr route 4
318: manual pages.
1.21 aaron 319: .Pp
1.1 deraadt 320: The mapping between letters and flags is:
321: .Bl -column XXXX RTF_BLACKHOLE
1.12 aaron 322: 1 RTF_PROTO1 Protocol specific routing flag #1.
323: 2 RTF_PROTO2 Protocol specific routing flag #2.
1.25 niklas 324: 3 RTF_PROTO3 Protocol specific routing flag #3.
1.16 aaron 325: B RTF_BLACKHOLE Just discard pkts (during updates).
1.12 aaron 326: C RTF_CLONING Generate new routes on use.
1.34 jmc 327: c RTF_CLONED Cloned routes (generated from RTF_CLONING).
1.12 aaron 328: D RTF_DYNAMIC Created dynamically (by redirect).
329: G RTF_GATEWAY Destination requires forwarding by intermediary.
330: H RTF_HOST Host entry (net otherwise).
1.1 deraadt 331: L RTF_LLINFO Valid protocol to link address translation.
1.12 aaron 332: M RTF_MODIFIED Modified dynamically (by redirect).
333: R RTF_REJECT Host or net unreachable.
334: S RTF_STATIC Manually added.
335: U RTF_UP Route usable.
336: X RTF_XRESOLVE External daemon translates proto to link address.
1.1 deraadt 337: .El
338: .Pp
1.21 aaron 339: Direct routes are created for each interface attached to the local host;
1.1 deraadt 340: the gateway field for such entries shows the address of the outgoing interface.
1.21 aaron 341: The refcnt field gives the current number of active uses of the route.
342: Connection oriented protocols normally hold on to a single route for the
343: duration of a connection while connectionless protocols obtain a route while
344: sending to the same destination.
345: The use field provides a count of the number of packets sent using that route.
346: The MTU entry shows the MTU associated with that route.
347: This MTU value is used as the basis for the TCP maximum segment size (MSS).
1.34 jmc 348: The
349: .Sq L
350: flag appended to the MTU value indicates that the value is
351: locked, and that path MTU discovery is turned off for that route.
1.21 aaron 352: A
1.1 deraadt 353: .Sq -
1.12 aaron 354: indicates that the MTU for this route has not been set, and a default
1.21 aaron 355: TCP maximum segment size will be used.
356: The interface entry indicates the network interface utilized for the route.
1.1 deraadt 357: .Pp
358: When
1.21 aaron 359: .Nm
1.1 deraadt 360: is invoked with the
361: .Fl w
362: option and a
363: .Ar wait
364: interval argument, it displays a running count of statistics related to
365: network interfaces.
366: An obsolescent version of this option used a numeric parameter
367: with no option, and is currently supported for backward compatibility.
368: This display consists of a column for the primary interface (the first
369: interface found during autoconfiguration) and a column summarizing
370: information for all interfaces.
371: The primary interface may be replaced with another interface with the
372: .Fl I
373: option.
374: The first line of each screen of information contains a summary since the
1.21 aaron 375: system was last rebooted.
376: Subsequent lines of output show values accumulated over the preceding interval.
1.1 deraadt 377: .Sh SEE ALSO
1.47 jmc 378: .Xr fstat 1 ,
1.1 deraadt 379: .Xr nfsstat 1 ,
380: .Xr ps 1 ,
1.47 jmc 381: .Xr systat 1 ,
382: .Xr top 1 ,
1.34 jmc 383: .Xr inet 3 ,
1.21 aaron 384: .Xr netintro 4 ,
1.34 jmc 385: .Xr route 4 ,
1.1 deraadt 386: .Xr hosts 5 ,
387: .Xr networks 5 ,
388: .Xr protocols 5 ,
389: .Xr services 5 ,
1.15 alex 390: .Xr iostat 8 ,
1.34 jmc 391: .Xr portmap 8 ,
1.47 jmc 392: .Xr pstat 8 ,
1.34 jmc 393: .Xr route 8 ,
1.40 jmc 394: .Xr tcpdrop 8 ,
1.1 deraadt 395: .Xr trpt 8 ,
396: .Xr vmstat 8
397: .Sh HISTORY
398: The
1.21 aaron 399: .Nm
1.1 deraadt 400: command appeared in
401: .Bx 4.2 .
1.19 itojun 402: IPv6 support was added by WIDE/KAME project.
1.1 deraadt 403: .Sh BUGS
404: The notion of errors is ill-defined.