Annotation of src/usr.bin/netstat/netstat.1, Revision 1.66
1.66 ! jmc 1: .\" $OpenBSD: netstat.1,v 1.65 2011/08/19 19:59:51 jmc Exp $
1.1 deraadt 2: .\" $NetBSD: netstat.1,v 1.11 1995/10/03 21:42:43 thorpej Exp $
3: .\"
4: .\" Copyright (c) 1983, 1990, 1992, 1993
5: .\" The Regents of the University of California. All rights reserved.
6: .\"
7: .\" Redistribution and use in source and binary forms, with or without
8: .\" modification, are permitted provided that the following conditions
9: .\" are met:
10: .\" 1. Redistributions of source code must retain the above copyright
11: .\" notice, this list of conditions and the following disclaimer.
12: .\" 2. Redistributions in binary form must reproduce the above copyright
13: .\" notice, this list of conditions and the following disclaimer in the
14: .\" documentation and/or other materials provided with the distribution.
1.29 millert 15: .\" 3. Neither the name of the University nor the names of its contributors
1.1 deraadt 16: .\" may be used to endorse or promote products derived from this software
17: .\" without specific prior written permission.
18: .\"
19: .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
20: .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21: .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22: .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
23: .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24: .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25: .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26: .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27: .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28: .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29: .\" SUCH DAMAGE.
30: .\"
31: .\" from: @(#)netstat.1 8.8 (Berkeley) 4/18/94
32: .\"
1.66 ! jmc 33: .Dd $Mdocdate: August 19 2011 $
1.1 deraadt 34: .Dt NETSTAT 1
1.16 aaron 35: .Os
1.1 deraadt 36: .Sh NAME
37: .Nm netstat
38: .Nd show network status
39: .Sh SYNOPSIS
40: .Nm netstat
1.63 jsing 41: .Op Fl AaBn
1.1 deraadt 42: .Op Fl f Ar address_family
1.59 blambert 43: .Op Fl p Ar protocol
1.1 deraadt 44: .Op Fl M Ar core
45: .Op Fl N Ar system
46: .Nm netstat
1.52 claudio 47: .Bk -words
1.48 pyr 48: .Op Fl bdFgilmnqrstu
1.1 deraadt 49: .Op Fl f Ar address_family
1.59 blambert 50: .Op Fl p Ar protocol
1.1 deraadt 51: .Op Fl M Ar core
52: .Op Fl N Ar system
1.52 claudio 53: .Op Fl T Ar tableid
54: .Ek
1.1 deraadt 55: .Nm netstat
1.24 camield 56: .Op Fl bdn
1.57 tedu 57: .Op Fl c Ar count
1.1 deraadt 58: .Op Fl I Ar interface
59: .Op Fl M Ar core
60: .Op Fl N Ar system
61: .Op Fl w Ar wait
62: .Nm netstat
1.61 bluhm 63: .Op Fl v
1.45 jaredy 64: .Op Fl M Ar core
65: .Op Fl N Ar system
66: .Fl P Ar pcbaddr
67: .Nm netstat
1.35 markus 68: .Op Fl s
1.1 deraadt 69: .Op Fl M Ar core
70: .Op Fl N Ar system
1.31 jmc 71: .Op Fl p Ar protocol
1.19 itojun 72: .Nm netstat
1.34 jmc 73: .Op Fl a
1.19 itojun 74: .Op Fl f Ar address_family
1.59 blambert 75: .Op Fl p Ar protocol
1.34 jmc 76: .Op Fl i | I Ar interface
1.42 reyk 77: .Nm netstat
78: .Op Fl W Ar interface
1.1 deraadt 79: .Sh DESCRIPTION
80: The
1.21 aaron 81: .Nm
1.1 deraadt 82: command symbolically displays the contents of various network-related
83: data structures.
84: There are a number of output formats,
85: depending on the options for the information presented.
1.21 aaron 86: .Pp
1.1 deraadt 87: The first form of the command displays a list of active sockets for
88: each protocol.
89: The second form presents the contents of one of the other network
90: data structures according to the option selected.
91: Using the third form, with a
92: .Ar wait
93: interval specified,
1.21 aaron 94: .Nm
1.1 deraadt 95: will continuously display the information regarding packet
96: traffic on the configured network interfaces.
1.61 bluhm 97: The fourth form displays internals of the protocol control block (PCB)
98: and the socket structure.
1.46 jmc 99: The fifth form displays statistics about the named protocol.
100: The sixth form displays per interface statistics for
1.30 jmc 101: the specified address family.
1.43 jmc 102: The final form displays per interface statistics for
103: the specified wireless (802.11) device.
1.1 deraadt 104: .Pp
1.12 aaron 105: The options are as follows:
1.22 aaron 106: .Bl -tag -width Ds
1.1 deraadt 107: .It Fl A
108: With the default display,
109: show the address of any protocol control blocks associated with sockets; used
1.45 jaredy 110: for debugging, e.g. with the
111: .Fl P
112: flag.
1.1 deraadt 113: .It Fl a
114: With the default display,
115: show the state of all sockets; normally sockets used by
116: server processes are not shown.
1.34 jmc 117: With the interface display (options
118: .Fl I
119: or
120: .Fl i ) ,
121: show multicast addresses.
1.63 jsing 122: .It Fl B
123: With the default display,
124: show buffer sizes for TCP sockets.
125: This includes the send window size, receive window size and congestion
126: window size.
1.24 camield 127: .It Fl b
1.34 jmc 128: With the interface display (options
129: .Fl I
130: or
1.24 camield 131: .Fl i ) ,
132: show bytes in and out, instead of packet statistics.
1.57 tedu 133: .It Fl c Ar count
134: Display
135: .Ar count
136: updates, then exit.
137: This option has no effect unless
138: .Fl w
139: is specified as well.
1.1 deraadt 140: .It Fl d
1.34 jmc 141: With either the interface display (options
142: .Fl I
143: or
144: .Fl i )
145: or an interval (option
146: .Fl w ) ,
1.1 deraadt 147: show the number of dropped packets.
1.48 pyr 148: .It Fl F
149: When showing routes, only show routes whose gateway are in the
150: same address family as the destination.
1.16 aaron 151: .It Fl f Ar address_family
1.1 deraadt 152: Limit statistics or address control block reports to those
153: of the specified
1.12 aaron 154: .Ar address_family .
1.21 aaron 155: .Pp
156: The following address families are recognized:
1.65 jmc 157: .Bl -column "Address Family" "AF_APPLETA" "Description" -offset indent
1.21 aaron 158: .It Sy "Address Family" Ta Sy "Constant" Ta Sy "Description"
1.55 mk 159: .It "encap" Ta Dv "PF_KEY" Ta "IPsec"
1.32 jmc 160: .It "inet" Ta Dv "AF_INET" Ta "IP Version 4"
161: .It "inet6" Ta Dv "AF_INET6" Ta "IP Version 6"
162: .It "local" Ta Dv "AF_LOCAL" Ta "Local to Host (i.e., pipes)"
1.55 mk 163: .It "mpls" Ta Dv "AF_MPLS" Ta "MPLS"
164: .It "pflow" Ta Dv "PF_FLOW" Ta "pflow data export"
1.32 jmc 165: .It "unix" Ta Dv "AF_UNIX" Ta "Local to Host (i.e., pipes)"
1.21 aaron 166: .El
167: .Pp
1.1 deraadt 168: .It Fl g
169: Show information related to multicast (group address) routing.
1.34 jmc 170: By default, show the IP multicast virtual-interface and routing tables.
1.1 deraadt 171: If the
172: .Fl s
173: option is also present, show multicast routing statistics.
1.16 aaron 174: .It Fl I Ar interface
1.21 aaron 175: Show information about the specified
176: .Ar interface ;
1.1 deraadt 177: used with a
178: .Ar wait
179: interval as described below.
1.21 aaron 180: .Pp
1.19 itojun 181: If the
1.34 jmc 182: .Fl a
183: option is also present, multicast addresses currently in use are shown
184: for the given interface and for each IP interface address.
185: Multicast addresses are shown on separate lines following the interface
186: address with which they are associated.
187: .Pp
188: If the
1.19 itojun 189: .Fl f Ar address_family
190: option (with the
191: .Fl s
1.30 jmc 192: option) is present, show per-interface
193: statistics on the given interface for the specified
194: .Ar address_family .
1.1 deraadt 195: .It Fl i
196: Show the state of interfaces which have been auto-configured
1.21 aaron 197: (interfaces statically configured into a system but not
198: located at boot-time are not shown).
199: .Pp
1.1 deraadt 200: If the
201: .Fl a
1.21 aaron 202: option is also present, multicast addresses currently in use are shown
1.1 deraadt 203: for each Ethernet interface and for each IP interface address.
204: Multicast addresses are shown on separate lines following the interface
205: address with which they are associated.
1.21 aaron 206: .Pp
1.19 itojun 207: If the
208: .Fl f Ar address_family
209: option (with the
210: .Fl s
1.30 jmc 211: option) is present, show per-interface statistics on all interfaces
1.21 aaron 212: for the specified
1.30 jmc 213: .Ar address_family .
1.31 jmc 214: .It Fl l
215: With the
216: .Fl g
217: option, display wider fields for the IPv6 multicast routing table
218: .Qq Origin
219: and
220: .Qq Group
221: columns.
1.17 deraadt 222: .It Fl M Ar core
1.1 deraadt 223: Extract values associated with the name list from the specified core
1.27 miod 224: instead of the running kernel.
1.1 deraadt 225: .It Fl m
226: Show statistics recorded by the memory management routines
227: (the network manages a private pool of memory buffers).
1.17 deraadt 228: .It Fl N Ar system
1.27 miod 229: Extract the name list from the specified system instead of the running kernel.
1.1 deraadt 230: .It Fl n
231: Show network addresses as numbers (normally
1.21 aaron 232: .Nm
1.1 deraadt 233: interprets addresses and attempts to display them
234: symbolically).
235: This option may be used with any of the display formats.
1.45 jaredy 236: .It Fl P Ar pcbaddr
1.61 bluhm 237: Display the contents of the socket or protocol control block (PCB)
238: located at the kernel virtual address
1.45 jaredy 239: .Ar pcbaddr .
240: PCB addresses can be obtained using the
241: .Fl A
242: flag.
1.61 bluhm 243: When used with the
244: .Fl v
245: option, also print socket, domain and protocol specific structures.
1.16 aaron 246: .It Fl p Ar protocol
1.35 markus 247: Restrict the output to
1.12 aaron 248: .Ar protocol ,
1.21 aaron 249: which is either a well-known name for a protocol or an alias for it.
250: Some protocol names and aliases are listed in the file
1.1 deraadt 251: .Pa /etc/protocols .
252: The program will complain if
253: .Ar protocol
1.35 markus 254: is unknown.
255: If the
256: .Fl s
257: option is specified, the per-protocol statistics are displayed.
258: Otherwise the states of the matching sockets are shown.
1.26 brian 259: .It Fl q
260: Only show interfaces that have seen packets (or bytes if
261: .Fl b
1.34 jmc 262: is specified).
1.1 deraadt 263: .It Fl r
264: Show the routing tables.
1.21 aaron 265: If the
1.1 deraadt 266: .Fl s
1.21 aaron 267: option is also specified, show routing statistics instead.
1.60 sobrado 268: When used with the
269: .Fl v
270: option, also print routing labels.
1.26 brian 271: .It Fl s
272: Show per-protocol statistics.
273: If this option is repeated, counters with a value of zero are suppressed.
1.51 claudio 274: .It Fl T Ar tableid
275: Select an alternate routing table to modify or query.
276: Table 0 is the default table.
1.31 jmc 277: .It Fl t
278: With the
279: .Fl i
280: option, display the current value of the watchdog timer function.
281: .It Fl u
282: Limit statistics or address control block reports to the
283: .Dv AF_UNIX
284: address family.
1.10 peter 285: .It Fl v
1.60 sobrado 286: Show extra (verbose) detail for the routing tables
287: .Pq Fl r ,
288: or avoid truncation of long addresses.
1.61 bluhm 289: When used with the
290: .Fl P
291: option, also print socket, domain and protocol specific structures.
1.42 reyk 292: .It Fl W Ar interface
293: (IEEE 802.11 devices only)
294: Show per-interface IEEE 802.11 wireless statistics.
1.1 deraadt 295: .It Fl w Ar wait
296: Show network interface statistics at intervals of
297: .Ar wait
298: seconds.
299: .El
300: .Pp
301: The default display, for active sockets, shows the local
302: and remote addresses, send and receive queue sizes (in bytes), protocol,
303: and the internal state of the protocol.
1.21 aaron 304: .Pp
305: Address formats are of the form
306: .Dq host.port
307: or
308: .Dq network.port
1.1 deraadt 309: if a socket's address specifies a network but no specific host address.
1.21 aaron 310: When known, the host and network addresses are displayed symbolically
311: according to the databases
1.1 deraadt 312: .Pa /etc/hosts
313: and
314: .Pa /etc/networks ,
1.21 aaron 315: respectively.
316: If a symbolic name for an address is unknown, or if the
1.1 deraadt 317: .Fl n
318: option is specified, the address is printed numerically, according
319: to the address family.
1.21 aaron 320: .Pp
321: For more information regarding the Internet
322: .Dq dot format ,
1.1 deraadt 323: refer to
1.12 aaron 324: .Xr inet 3 .
1.34 jmc 325: Unspecified or
1.21 aaron 326: .Dq wildcard
327: addresses and ports appear as a single
1.34 jmc 328: .Sq * .
1.6 deraadt 329: If a local port number is registered as being in use for RPC by
1.12 aaron 330: .Xr portmap 8 ,
1.11 aaron 331: its RPC service name or RPC service number will be printed in
1.21 aaron 332: .Dq []
333: immediately after the port number.
1.1 deraadt 334: .Pp
335: The interface display provides a table of cumulative
336: statistics regarding packets transferred, errors, and collisions.
337: The network addresses of the interface
1.21 aaron 338: and the maximum transmission unit (MTU) are also displayed.
1.1 deraadt 339: .Pp
1.21 aaron 340: The routing table display indicates the available routes and their status.
341: Each route consists of a destination host or network and
342: a gateway to use in forwarding packets.
343: If the destination is a
344: network in numeric format, the netmask (in /24 style format) is appended.
345: The flags field shows a collection of information about
346: the route stored as binary choices.
347: The individual flags are discussed in more detail in the
1.1 deraadt 348: .Xr route 8
349: and
350: .Xr route 4
351: manual pages.
1.21 aaron 352: .Pp
1.1 deraadt 353: The mapping between letters and flags is:
1.66 ! jmc 354: .Bl -column "1" "RTF_BLACKHOLE" "Protocol specific routing flag #1."
! 355: .It 1 Ta RTF_PROTO1 Ta "Protocol specific routing flag #1."
! 356: .It 2 Ta RTF_PROTO2 Ta "Protocol specific routing flag #2."
! 357: .It 3 Ta RTF_PROTO3 Ta "Protocol specific routing flag #3."
! 358: .It B Ta RTF_BLACKHOLE Ta "Just discard pkts (during updates)."
! 359: .It C Ta RTF_CLONING Ta "Generate new routes on use."
! 360: .It c Ta RTF_CLONED Ta "Cloned routes (generated from RTF_CLONING)."
! 361: .It D Ta RTF_DYNAMIC Ta "Created dynamically (by redirect)."
! 362: .It G Ta RTF_GATEWAY Ta "Destination requires forwarding by intermediary."
! 363: .It H Ta RTF_HOST Ta "Host entry (net otherwise)."
! 364: .It L Ta RTF_LLINFO Ta "Valid protocol to link address translation."
! 365: .It M Ta RTF_MODIFIED Ta "Modified dynamically (by redirect)."
! 366: .It P Ta RTF_MPATH Ta "Multipath route."
! 367: .It R Ta RTF_REJECT Ta "Host or net unreachable."
! 368: .It S Ta RTF_STATIC Ta "Manually added."
! 369: .It T Ta RTF_MPLS Ta "MPLS route."
! 370: .It U Ta RTF_UP Ta "Route usable."
! 371: .It X Ta RTF_XRESOLVE Ta "External daemon translates proto to link address."
1.1 deraadt 372: .El
373: .Pp
1.21 aaron 374: Direct routes are created for each interface attached to the local host;
1.1 deraadt 375: the gateway field for such entries shows the address of the outgoing interface.
1.21 aaron 376: The refcnt field gives the current number of active uses of the route.
377: Connection oriented protocols normally hold on to a single route for the
378: duration of a connection while connectionless protocols obtain a route while
379: sending to the same destination.
380: The use field provides a count of the number of packets sent using that route.
381: The MTU entry shows the MTU associated with that route.
382: This MTU value is used as the basis for the TCP maximum segment size (MSS).
1.34 jmc 383: The
384: .Sq L
385: flag appended to the MTU value indicates that the value is
386: locked, and that path MTU discovery is turned off for that route.
1.21 aaron 387: A
1.1 deraadt 388: .Sq -
1.12 aaron 389: indicates that the MTU for this route has not been set, and a default
1.21 aaron 390: TCP maximum segment size will be used.
391: The interface entry indicates the network interface utilized for the route.
1.1 deraadt 392: .Pp
393: When
1.21 aaron 394: .Nm
1.1 deraadt 395: is invoked with the
396: .Fl w
397: option and a
398: .Ar wait
399: interval argument, it displays a running count of statistics related to
400: network interfaces.
401: An obsolescent version of this option used a numeric parameter
402: with no option, and is currently supported for backward compatibility.
403: This display consists of a column for the primary interface (the first
404: interface found during autoconfiguration) and a column summarizing
405: information for all interfaces.
406: The primary interface may be replaced with another interface with the
407: .Fl I
408: option.
409: The first line of each screen of information contains a summary since the
1.21 aaron 410: system was last rebooted.
411: Subsequent lines of output show values accumulated over the preceding interval.
1.1 deraadt 412: .Sh SEE ALSO
1.47 jmc 413: .Xr fstat 1 ,
1.1 deraadt 414: .Xr nfsstat 1 ,
415: .Xr ps 1 ,
1.47 jmc 416: .Xr systat 1 ,
1.53 jmc 417: .Xr tcpbench 1 ,
1.47 jmc 418: .Xr top 1 ,
1.34 jmc 419: .Xr inet 3 ,
1.21 aaron 420: .Xr netintro 4 ,
1.34 jmc 421: .Xr route 4 ,
1.1 deraadt 422: .Xr hosts 5 ,
423: .Xr networks 5 ,
424: .Xr protocols 5 ,
425: .Xr services 5 ,
1.15 alex 426: .Xr iostat 8 ,
1.34 jmc 427: .Xr portmap 8 ,
1.47 jmc 428: .Xr pstat 8 ,
1.34 jmc 429: .Xr route 8 ,
1.40 jmc 430: .Xr tcpdrop 8 ,
1.1 deraadt 431: .Xr trpt 8 ,
432: .Xr vmstat 8
433: .Sh HISTORY
434: The
1.21 aaron 435: .Nm
1.1 deraadt 436: command appeared in
437: .Bx 4.2 .
1.62 schwarze 438: IPv6 support was added by the WIDE/KAME project.
1.1 deraadt 439: .Sh BUGS
440: The notion of errors is ill-defined.
![[BACK]](/icons/back.gif){kind=icon}
Return to netstat.1 CVS log ![[TXT]](/icons/text.gif){kind=icon}
![[DIR]](/icons/dir.gif){kind=icon}
Up to [local] / src / usr.bin / netstat