Annotation of src/usr.bin/netstat/netstat.1, Revision 1.60
1.60 ! sobrado 1: .\" $OpenBSD: netstat.1,v 1.59 2010/06/29 03:09:29 blambert Exp $
1.1 deraadt 2: .\" $NetBSD: netstat.1,v 1.11 1995/10/03 21:42:43 thorpej Exp $
3: .\"
4: .\" Copyright (c) 1983, 1990, 1992, 1993
5: .\" The Regents of the University of California. All rights reserved.
6: .\"
7: .\" Redistribution and use in source and binary forms, with or without
8: .\" modification, are permitted provided that the following conditions
9: .\" are met:
10: .\" 1. Redistributions of source code must retain the above copyright
11: .\" notice, this list of conditions and the following disclaimer.
12: .\" 2. Redistributions in binary form must reproduce the above copyright
13: .\" notice, this list of conditions and the following disclaimer in the
14: .\" documentation and/or other materials provided with the distribution.
1.29 millert 15: .\" 3. Neither the name of the University nor the names of its contributors
1.1 deraadt 16: .\" may be used to endorse or promote products derived from this software
17: .\" without specific prior written permission.
18: .\"
19: .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20: .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21: .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22: .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23: .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24: .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25: .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26: .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27: .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28: .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29: .\" SUCH DAMAGE.
30: .\"
31: .\" from: @(#)netstat.1 8.8 (Berkeley) 4/18/94
32: .\"
1.60 ! sobrado 33: .Dd $Mdocdate: June 29 2010 $
1.1 deraadt 34: .Dt NETSTAT 1
1.16 aaron 35: .Os
1.1 deraadt 36: .Sh NAME
37: .Nm netstat
38: .Nd show network status
39: .Sh SYNOPSIS
40: .Nm netstat
41: .Op Fl Aan
42: .Op Fl f Ar address_family
1.59 blambert 43: .Op Fl p Ar protocol
1.1 deraadt 44: .Op Fl M Ar core
45: .Op Fl N Ar system
46: .Nm netstat
1.52 claudio 47: .Bk -words
1.48 pyr 48: .Op Fl bdFgilmnqrstu
1.1 deraadt 49: .Op Fl f Ar address_family
1.59 blambert 50: .Op Fl p Ar protocol
1.1 deraadt 51: .Op Fl M Ar core
52: .Op Fl N Ar system
1.52 claudio 53: .Op Fl T Ar tableid
54: .Ek
1.1 deraadt 55: .Nm netstat
1.24 camield 56: .Op Fl bdn
1.57 tedu 57: .Op Fl c Ar count
1.1 deraadt 58: .Op Fl I Ar interface
59: .Op Fl M Ar core
60: .Op Fl N Ar system
61: .Op Fl w Ar wait
62: .Nm netstat
1.45 jaredy 63: .Op Fl M Ar core
64: .Op Fl N Ar system
65: .Fl P Ar pcbaddr
66: .Nm netstat
1.35 markus 67: .Op Fl s
1.1 deraadt 68: .Op Fl M Ar core
69: .Op Fl N Ar system
1.31 jmc 70: .Op Fl p Ar protocol
1.19 itojun 71: .Nm netstat
1.34 jmc 72: .Op Fl a
1.19 itojun 73: .Op Fl f Ar address_family
1.59 blambert 74: .Op Fl p Ar protocol
1.34 jmc 75: .Op Fl i | I Ar interface
1.42 reyk 76: .Nm netstat
77: .Op Fl W Ar interface
1.1 deraadt 78: .Sh DESCRIPTION
79: The
1.21 aaron 80: .Nm
1.1 deraadt 81: command symbolically displays the contents of various network-related
82: data structures.
83: There are a number of output formats,
84: depending on the options for the information presented.
1.21 aaron 85: .Pp
1.1 deraadt 86: The first form of the command displays a list of active sockets for
87: each protocol.
88: The second form presents the contents of one of the other network
89: data structures according to the option selected.
90: Using the third form, with a
91: .Ar wait
92: interval specified,
1.21 aaron 93: .Nm
1.1 deraadt 94: will continuously display the information regarding packet
95: traffic on the configured network interfaces.
1.46 jmc 96: The fourth form displays statistics about the protocol control block (PCB).
97: The fifth form displays statistics about the named protocol.
98: The sixth form displays per interface statistics for
1.30 jmc 99: the specified address family.
1.43 jmc 100: The final form displays per interface statistics for
101: the specified wireless (802.11) device.
1.1 deraadt 102: .Pp
1.12 aaron 103: The options are as follows:
1.22 aaron 104: .Bl -tag -width Ds
1.1 deraadt 105: .It Fl A
106: With the default display,
107: show the address of any protocol control blocks associated with sockets; used
1.45 jaredy 108: for debugging, e.g. with the
109: .Fl P
110: flag.
1.1 deraadt 111: .It Fl a
112: With the default display,
113: show the state of all sockets; normally sockets used by
114: server processes are not shown.
1.34 jmc 115: With the interface display (options
116: .Fl I
117: or
118: .Fl i ) ,
119: show multicast addresses.
1.24 camield 120: .It Fl b
1.34 jmc 121: With the interface display (options
122: .Fl I
123: or
1.24 camield 124: .Fl i ) ,
125: show bytes in and out, instead of packet statistics.
1.57 tedu 126: .It Fl c Ar count
127: Display
128: .Ar count
129: updates, then exit.
130: This option has no effect unless
131: .Fl w
132: is specified as well.
1.1 deraadt 133: .It Fl d
1.34 jmc 134: With either the interface display (options
135: .Fl I
136: or
137: .Fl i )
138: or an interval (option
139: .Fl w ) ,
1.1 deraadt 140: show the number of dropped packets.
1.48 pyr 141: .It Fl F
142: When showing routes, only show routes whose gateway are in the
143: same address family as the destination.
1.16 aaron 144: .It Fl f Ar address_family
1.1 deraadt 145: Limit statistics or address control block reports to those
146: of the specified
1.12 aaron 147: .Ar address_family .
1.21 aaron 148: .Pp
149: The following address families are recognized:
150: .Pp
151: .Bl -column "Address Family" "AF_APPLETA" "Description" -offset indent -compact
152: .It Sy "Address Family" Ta Sy "Constant" Ta Sy "Description"
1.55 mk 153: .It "atalk" Ta Dv "AF_APPLETALK" Ta "AppleTalk"
154: .It "encap" Ta Dv "PF_KEY" Ta "IPsec"
1.32 jmc 155: .It "inet" Ta Dv "AF_INET" Ta "IP Version 4"
156: .It "inet6" Ta Dv "AF_INET6" Ta "IP Version 6"
157: .It "local" Ta Dv "AF_LOCAL" Ta "Local to Host (i.e., pipes)"
1.55 mk 158: .It "mpls" Ta Dv "AF_MPLS" Ta "MPLS"
159: .It "pflow" Ta Dv "PF_FLOW" Ta "pflow data export"
1.32 jmc 160: .It "unix" Ta Dv "AF_UNIX" Ta "Local to Host (i.e., pipes)"
1.21 aaron 161: .El
162: .Pp
1.1 deraadt 163: .It Fl g
164: Show information related to multicast (group address) routing.
1.34 jmc 165: By default, show the IP multicast virtual-interface and routing tables.
1.1 deraadt 166: If the
167: .Fl s
168: option is also present, show multicast routing statistics.
1.16 aaron 169: .It Fl I Ar interface
1.21 aaron 170: Show information about the specified
171: .Ar interface ;
1.1 deraadt 172: used with a
173: .Ar wait
174: interval as described below.
1.21 aaron 175: .Pp
1.19 itojun 176: If the
1.34 jmc 177: .Fl a
178: option is also present, multicast addresses currently in use are shown
179: for the given interface and for each IP interface address.
180: Multicast addresses are shown on separate lines following the interface
181: address with which they are associated.
182: .Pp
183: If the
1.19 itojun 184: .Fl f Ar address_family
185: option (with the
186: .Fl s
1.30 jmc 187: option) is present, show per-interface
188: statistics on the given interface for the specified
189: .Ar address_family .
1.1 deraadt 190: .It Fl i
191: Show the state of interfaces which have been auto-configured
1.21 aaron 192: (interfaces statically configured into a system but not
193: located at boot-time are not shown).
194: .Pp
1.1 deraadt 195: If the
196: .Fl a
1.21 aaron 197: option is also present, multicast addresses currently in use are shown
1.1 deraadt 198: for each Ethernet interface and for each IP interface address.
199: Multicast addresses are shown on separate lines following the interface
200: address with which they are associated.
1.21 aaron 201: .Pp
1.19 itojun 202: If the
203: .Fl f Ar address_family
204: option (with the
205: .Fl s
1.30 jmc 206: option) is present, show per-interface statistics on all interfaces
1.21 aaron 207: for the specified
1.30 jmc 208: .Ar address_family .
1.31 jmc 209: .It Fl l
210: With the
211: .Fl g
212: option, display wider fields for the IPv6 multicast routing table
213: .Qq Origin
214: and
215: .Qq Group
216: columns.
1.17 deraadt 217: .It Fl M Ar core
1.1 deraadt 218: Extract values associated with the name list from the specified core
1.27 miod 219: instead of the running kernel.
1.1 deraadt 220: .It Fl m
221: Show statistics recorded by the memory management routines
222: (the network manages a private pool of memory buffers).
1.17 deraadt 223: .It Fl N Ar system
1.27 miod 224: Extract the name list from the specified system instead of the running kernel.
1.1 deraadt 225: .It Fl n
226: Show network addresses as numbers (normally
1.21 aaron 227: .Nm
1.1 deraadt 228: interprets addresses and attempts to display them
229: symbolically).
230: This option may be used with any of the display formats.
1.45 jaredy 231: .It Fl P Ar pcbaddr
232: Display the contents of the protocol control block (PCB) located at
233: the kernel virtual address
234: .Ar pcbaddr .
235: PCB addresses can be obtained using the
236: .Fl A
237: flag.
238: This option can currently only be used to display TCP control blocks.
1.16 aaron 239: .It Fl p Ar protocol
1.35 markus 240: Restrict the output to
1.12 aaron 241: .Ar protocol ,
1.21 aaron 242: which is either a well-known name for a protocol or an alias for it.
243: Some protocol names and aliases are listed in the file
1.1 deraadt 244: .Pa /etc/protocols .
245: The program will complain if
246: .Ar protocol
1.35 markus 247: is unknown.
248: If the
249: .Fl s
250: option is specified, the per-protocol statistics are displayed.
251: Otherwise the states of the matching sockets are shown.
1.26 brian 252: .It Fl q
253: Only show interfaces that have seen packets (or bytes if
254: .Fl b
1.34 jmc 255: is specified).
1.1 deraadt 256: .It Fl r
257: Show the routing tables.
1.21 aaron 258: If the
1.1 deraadt 259: .Fl s
1.21 aaron 260: option is also specified, show routing statistics instead.
1.60 ! sobrado 261: When used with the
! 262: .Fl v
! 263: option, also print routing labels.
1.26 brian 264: .It Fl s
265: Show per-protocol statistics.
266: If this option is repeated, counters with a value of zero are suppressed.
1.51 claudio 267: .It Fl T Ar tableid
268: Select an alternate routing table to modify or query.
269: Table 0 is the default table.
1.31 jmc 270: .It Fl t
271: With the
272: .Fl i
273: option, display the current value of the watchdog timer function.
274: .It Fl u
275: Limit statistics or address control block reports to the
276: .Dv AF_UNIX
277: address family.
1.10 peter 278: .It Fl v
1.60 ! sobrado 279: Show extra (verbose) detail for the routing tables
! 280: .Pq Fl r ,
! 281: or avoid truncation of long addresses.
1.42 reyk 282: .It Fl W Ar interface
283: (IEEE 802.11 devices only)
284: Show per-interface IEEE 802.11 wireless statistics.
1.1 deraadt 285: .It Fl w Ar wait
286: Show network interface statistics at intervals of
287: .Ar wait
288: seconds.
289: .El
290: .Pp
291: The default display, for active sockets, shows the local
292: and remote addresses, send and receive queue sizes (in bytes), protocol,
293: and the internal state of the protocol.
1.21 aaron 294: .Pp
295: Address formats are of the form
296: .Dq host.port
297: or
298: .Dq network.port
1.1 deraadt 299: if a socket's address specifies a network but no specific host address.
1.21 aaron 300: When known, the host and network addresses are displayed symbolically
301: according to the databases
1.1 deraadt 302: .Pa /etc/hosts
303: and
304: .Pa /etc/networks ,
1.21 aaron 305: respectively.
306: If a symbolic name for an address is unknown, or if the
1.1 deraadt 307: .Fl n
308: option is specified, the address is printed numerically, according
309: to the address family.
1.21 aaron 310: .Pp
311: For more information regarding the Internet
312: .Dq dot format ,
1.1 deraadt 313: refer to
1.12 aaron 314: .Xr inet 3 .
1.34 jmc 315: Unspecified or
1.21 aaron 316: .Dq wildcard
317: addresses and ports appear as a single
1.34 jmc 318: .Sq * .
1.6 deraadt 319: If a local port number is registered as being in use for RPC by
1.12 aaron 320: .Xr portmap 8 ,
1.11 aaron 321: its RPC service name or RPC service number will be printed in
1.21 aaron 322: .Dq []
323: immediately after the port number.
1.1 deraadt 324: .Pp
325: The interface display provides a table of cumulative
326: statistics regarding packets transferred, errors, and collisions.
327: The network addresses of the interface
1.21 aaron 328: and the maximum transmission unit (MTU) are also displayed.
1.1 deraadt 329: .Pp
1.21 aaron 330: The routing table display indicates the available routes and their status.
331: Each route consists of a destination host or network and
332: a gateway to use in forwarding packets.
333: If the destination is a
334: network in numeric format, the netmask (in /24 style format) is appended.
335: The flags field shows a collection of information about
336: the route stored as binary choices.
337: The individual flags are discussed in more detail in the
1.1 deraadt 338: .Xr route 8
339: and
340: .Xr route 4
341: manual pages.
1.21 aaron 342: .Pp
1.1 deraadt 343: The mapping between letters and flags is:
344: .Bl -column XXXX RTF_BLACKHOLE
1.58 schwarze 345: .It 1 RTF_PROTO1 Protocol specific routing flag #1.
346: .It 2 RTF_PROTO2 Protocol specific routing flag #2.
347: .It 3 RTF_PROTO3 Protocol specific routing flag #3.
348: .It B RTF_BLACKHOLE Just discard pkts (during updates).
349: .It C RTF_CLONING Generate new routes on use.
350: .It c RTF_CLONED Cloned routes (generated from RTF_CLONING).
351: .It D RTF_DYNAMIC Created dynamically (by redirect).
352: .It G RTF_GATEWAY Destination requires forwarding by intermediary.
353: .It H RTF_HOST Host entry (net otherwise).
354: .It L RTF_LLINFO Valid protocol to link address translation.
355: .It M RTF_MODIFIED Modified dynamically (by redirect).
356: .It P RTF_MPATH Multipath route.
357: .It R RTF_REJECT Host or net unreachable.
358: .It S RTF_STATIC Manually added.
359: .It T RTF_MPLS MPLS route.
360: .It U RTF_UP Route usable.
361: .It X RTF_XRESOLVE External daemon translates proto to link address.
1.1 deraadt 362: .El
363: .Pp
1.21 aaron 364: Direct routes are created for each interface attached to the local host;
1.1 deraadt 365: the gateway field for such entries shows the address of the outgoing interface.
1.21 aaron 366: The refcnt field gives the current number of active uses of the route.
367: Connection oriented protocols normally hold on to a single route for the
368: duration of a connection while connectionless protocols obtain a route while
369: sending to the same destination.
370: The use field provides a count of the number of packets sent using that route.
371: The MTU entry shows the MTU associated with that route.
372: This MTU value is used as the basis for the TCP maximum segment size (MSS).
1.34 jmc 373: The
374: .Sq L
375: flag appended to the MTU value indicates that the value is
376: locked, and that path MTU discovery is turned off for that route.
1.21 aaron 377: A
1.1 deraadt 378: .Sq -
1.12 aaron 379: indicates that the MTU for this route has not been set, and a default
1.21 aaron 380: TCP maximum segment size will be used.
381: The interface entry indicates the network interface utilized for the route.
1.1 deraadt 382: .Pp
383: When
1.21 aaron 384: .Nm
1.1 deraadt 385: is invoked with the
386: .Fl w
387: option and a
388: .Ar wait
389: interval argument, it displays a running count of statistics related to
390: network interfaces.
391: An obsolescent version of this option used a numeric parameter
392: with no option, and is currently supported for backward compatibility.
393: This display consists of a column for the primary interface (the first
394: interface found during autoconfiguration) and a column summarizing
395: information for all interfaces.
396: The primary interface may be replaced with another interface with the
397: .Fl I
398: option.
399: The first line of each screen of information contains a summary since the
1.21 aaron 400: system was last rebooted.
401: Subsequent lines of output show values accumulated over the preceding interval.
1.1 deraadt 402: .Sh SEE ALSO
1.47 jmc 403: .Xr fstat 1 ,
1.1 deraadt 404: .Xr nfsstat 1 ,
405: .Xr ps 1 ,
1.47 jmc 406: .Xr systat 1 ,
1.53 jmc 407: .Xr tcpbench 1 ,
1.47 jmc 408: .Xr top 1 ,
1.34 jmc 409: .Xr inet 3 ,
1.21 aaron 410: .Xr netintro 4 ,
1.34 jmc 411: .Xr route 4 ,
1.1 deraadt 412: .Xr hosts 5 ,
413: .Xr networks 5 ,
414: .Xr protocols 5 ,
415: .Xr services 5 ,
1.15 alex 416: .Xr iostat 8 ,
1.34 jmc 417: .Xr portmap 8 ,
1.47 jmc 418: .Xr pstat 8 ,
1.34 jmc 419: .Xr route 8 ,
1.40 jmc 420: .Xr tcpdrop 8 ,
1.1 deraadt 421: .Xr trpt 8 ,
422: .Xr vmstat 8
423: .Sh HISTORY
424: The
1.21 aaron 425: .Nm
1.1 deraadt 426: command appeared in
427: .Bx 4.2 .
1.19 itojun 428: IPv6 support was added by WIDE/KAME project.
1.1 deraadt 429: .Sh BUGS
1.58 schwarze 430: B
1.1 deraadt 431: The notion of errors is ill-defined.