Annotation of src/usr.bin/netstat/netstat.1, Revision 1.9
1.9 ! deraadt 1: .\" $OpenBSD: netstat.1,v 1.8 1997/07/28 08:29:48 denny Exp $
1.1 deraadt 2: .\" $NetBSD: netstat.1,v 1.11 1995/10/03 21:42:43 thorpej Exp $
3: .\"
4: .\" Copyright (c) 1983, 1990, 1992, 1993
5: .\" The Regents of the University of California. All rights reserved.
6: .\"
7: .\" Redistribution and use in source and binary forms, with or without
8: .\" modification, are permitted provided that the following conditions
9: .\" are met:
10: .\" 1. Redistributions of source code must retain the above copyright
11: .\" notice, this list of conditions and the following disclaimer.
12: .\" 2. Redistributions in binary form must reproduce the above copyright
13: .\" notice, this list of conditions and the following disclaimer in the
14: .\" documentation and/or other materials provided with the distribution.
15: .\" 3. All advertising materials mentioning features or use of this software
16: .\" must display the following acknowledgement:
17: .\" This product includes software developed by the University of
18: .\" California, Berkeley and its contributors.
19: .\" 4. Neither the name of the University nor the names of its contributors
20: .\" may be used to endorse or promote products derived from this software
21: .\" without specific prior written permission.
22: .\"
23: .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
24: .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
25: .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
26: .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
27: .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
28: .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
29: .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
30: .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
31: .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
32: .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
33: .\" SUCH DAMAGE.
34: .\"
35: .\" from: @(#)netstat.1 8.8 (Berkeley) 4/18/94
36: .\"
37: .Dd April 18, 1994
38: .Dt NETSTAT 1
39: .Os BSD 4.2
40: .Sh NAME
41: .Nm netstat
42: .Nd show network status
43: .Sh SYNOPSIS
44: .Nm netstat
45: .Op Fl Aan
46: .Op Fl f Ar address_family
47: .Op Fl M Ar core
48: .Op Fl N Ar system
49: .Nm netstat
50: .Op Fl dghimnrs
51: .Op Fl f Ar address_family
52: .Op Fl M Ar core
53: .Op Fl N Ar system
54: .Nm netstat
55: .Op Fl dn
56: .Op Fl I Ar interface
57: .Op Fl M Ar core
58: .Op Fl N Ar system
59: .Op Fl w Ar wait
60: .Nm netstat
61: .Op Fl p Ar protocol
62: .Op Fl M Ar core
63: .Op Fl N Ar system
64: .Sh DESCRIPTION
65: The
66: .Nm netstat
67: command symbolically displays the contents of various network-related
68: data structures.
69: There are a number of output formats,
70: depending on the options for the information presented.
71: The first form of the command displays a list of active sockets for
72: each protocol.
73: The second form presents the contents of one of the other network
74: data structures according to the option selected.
75: Using the third form, with a
76: .Ar wait
77: interval specified,
78: .Nm netstat
79: will continuously display the information regarding packet
80: traffic on the configured network interfaces.
81: The fourth form displays statistics about the named protocol.
82: .Pp
83: The options have the following meaning:
84: .Bl -tag -width flag
85: .It Fl A
86: With the default display,
87: show the address of any protocol control blocks associated with sockets; used
88: for debugging.
89: .It Fl a
90: With the default display,
91: show the state of all sockets; normally sockets used by
92: server processes are not shown.
93: .It Fl d
94: With either interface display (option
95: .Fl i
96: or an interval, as described below),
97: show the number of dropped packets.
98: .It Fl f Ar address_family
99: Limit statistics or address control block reports to those
100: of the specified
101: .Ar address family .
102: The following address families
103: are recognized:
104: .Ar inet ,
105: for
106: .Dv AF_INET ,
1.4 mickey 107: .Ar ipx ,
108: for
109: .Dv AF_IPX ,
1.8 denny 110: .Ar atalk ,
111: for
112: .Dv AF_APPLETALK ,
1.1 deraadt 113: .Ar ns ,
114: for
115: .Dv AF_NS ,
116: .Ar iso ,
117: for
118: .Dv AF_ISO ,
1.7 angelos 119: .Ar encap ,
120: for
121: .Dv AF_ENCAP ,
1.5 kstailey 122: .Ar local ,
123: for
124: .Dv AF_LOCAL ,
1.1 deraadt 125: and
126: .Ar unix ,
127: for
128: .Dv AF_UNIX .
129: .It Fl g
130: Show information related to multicast (group address) routing.
131: By default, show the IP Multicast virtual-interface and routing tables.
132: If the
133: .Fl s
134: option is also present, show multicast routing statistics.
135: .It Fl h
136: Show the state of the
137: .Tn IMP
138: host table (obsolete).
139: .It Fl I Ar interface
140: Show information about the specified interface;
141: used with a
142: .Ar wait
143: interval as described below.
144: .It Fl i
145: Show the state of interfaces which have been auto-configured
146: (interfaces statically configured into a system, but not
147: located at boot time are not shown).
148: If the
149: .Fl a
150: options is also present, multicast addresses currently in use are shown
151: for each Ethernet interface and for each IP interface address.
152: Multicast addresses are shown on separate lines following the interface
153: address with which they are associated.
154: .It Fl M
155: Extract values associated with the name list from the specified core
156: instead of the default
157: .Pa /dev/kmem .
158: .It Fl m
159: Show statistics recorded by the memory management routines
160: (the network manages a private pool of memory buffers).
161: .It Fl N
162: Extract the name list from the specified system instead of the default
1.3 ccappuc 163: .Pa /bsd .
1.1 deraadt 164: .It Fl n
165: Show network addresses as numbers (normally
166: .Nm netstat
167: interprets addresses and attempts to display them
168: symbolically).
169: This option may be used with any of the display formats.
170: .It Fl p Ar protocol
171: Show statistics about
172: .Ar protocol ,
173: which is either a well-known name for a protocol or an alias for it. Some
174: protocol names and aliases are listed in the file
175: .Pa /etc/protocols .
176: A null response typically means that there are no interesting numbers to
177: report.
178: The program will complain if
179: .Ar protocol
180: is unknown or if there is no statistics routine for it.
181: .It Fl s
182: Show per-protocol statistics.
183: If this option is repeated, counters with a value of zero are suppressed.
184: .It Fl r
185: Show the routing tables.
186: When
187: .Fl s
188: is also present, show routing statistics instead.
189: .It Fl w Ar wait
190: Show network interface statistics at intervals of
191: .Ar wait
192: seconds.
193: .El
194: .Pp
195: The default display, for active sockets, shows the local
196: and remote addresses, send and receive queue sizes (in bytes), protocol,
197: and the internal state of the protocol.
198: Address formats are of the form ``host.port'' or ``network.port''
199: if a socket's address specifies a network but no specific host address.
200: When known the host and network addresses are displayed symbolically
201: according to the data bases
202: .Pa /etc/hosts
203: and
204: .Pa /etc/networks ,
205: respectively. If a symbolic name for an address is unknown, or if
206: the
207: .Fl n
208: option is specified, the address is printed numerically, according
209: to the address family.
210: For more information regarding
211: the Internet ``dot format,''
212: refer to
213: .Xr inet 3 ) .
214: Unspecified,
215: or ``wildcard'', addresses and ports appear as ``*''.
1.6 deraadt 216: If a local port number is registered as being in use for RPC by
217: .Xr portmap 8
218: it's RPC service name or RPC service number will be printed in
219: [ ] immediately after the port number.
1.1 deraadt 220: .Pp
221: The interface display provides a table of cumulative
222: statistics regarding packets transferred, errors, and collisions.
223: The network addresses of the interface
224: and the maximum transmission unit (``mtu'') are also displayed.
225: .Pp
226: The routing table display indicates the available routes and
227: their status. Each route consists of a destination host or network
228: and a gateway to use in forwarding packets. The flags field shows
229: a collection of information about the route stored as
230: binary choices. The individual flags are discussed in more
231: detail in the
232: .Xr route 8
233: and
234: .Xr route 4
235: manual pages.
236: The mapping between letters and flags is:
237: .Bl -column XXXX RTF_BLACKHOLE
1.9 ! deraadt 238: 1 RTF_PROTO1 Protocol specific routing flag #1
! 239: 2 RTF_PROTO2 Protocol specific routing flag #2
1.1 deraadt 240: B RTF_BLACKHOLE Just discard pkts (during updates)
241: C RTF_CLONING Generate new routes on use
242: D RTF_DYNAMIC Created dynamically (by redirect)
243: G RTF_GATEWAY Destination requires forwarding by intermediary
244: H RTF_HOST Host entry (net otherwise)
245: L RTF_LLINFO Valid protocol to link address translation.
246: M RTF_MODIFIED Modified dynamically (by redirect)
247: R RTF_REJECT Host or net unreachable
248: S RTF_STATIC Manually added
249: U RTF_UP Route usable
250: X RTF_XRESOLVE External daemon translates proto to link address
251: .El
252: .Pp
253: Direct routes are created for each
254: interface attached to the local host;
255: the gateway field for such entries shows the address of the outgoing interface.
256: The refcnt field gives the
257: current number of active uses of the route. Connection oriented
258: protocols normally hold on to a single route for the duration of
259: a connection while connectionless protocols obtain a route while sending
260: to the same destination.
261: The use field provides a count of the number of packets
262: sent using that route. The mtu entry shows the mtu associated with
263: that route. This mtu value is used as the basis for the TCP maximum
264: segment size. A
265: .Sq -
266: indicates that the mtu for this route has not been set, and a default
267: TCP maximum segment size will be used. The interface entry indicates
268: the network interface utilized for the route.
269: .Pp
270: When
271: .Nm netstat
272: is invoked with the
273: .Fl w
274: option and a
275: .Ar wait
276: interval argument, it displays a running count of statistics related to
277: network interfaces.
278: An obsolescent version of this option used a numeric parameter
279: with no option, and is currently supported for backward compatibility.
280: This display consists of a column for the primary interface (the first
281: interface found during autoconfiguration) and a column summarizing
282: information for all interfaces.
283: The primary interface may be replaced with another interface with the
284: .Fl I
285: option.
286: The first line of each screen of information contains a summary since the
287: system was last rebooted. Subsequent lines of output show values
288: accumulated over the preceding interval.
289: .Sh SEE ALSO
290: .Xr nfsstat 1 ,
291: .Xr ps 1 ,
292: .Xr hosts 5 ,
293: .Xr networks 5 ,
294: .Xr protocols 5 ,
295: .Xr services 5 ,
296: .Xr trpt 8 ,
297: .Xr trsp 8 ,
298: .Xr iostat 8 ,
299: .Xr vmstat 8
300: .Sh HISTORY
301: The
302: .Nm netstat
303: command appeared in
304: .Bx 4.2 .
305: .\" .Sh FILES
306: .\" .Bl -tag -width /dev/kmem -compact
1.3 ccappuc 307: .\" .It Pa /bsd
1.1 deraadt 308: .\" default kernel namelist
309: .\" .It Pa /dev/kmem
310: .\" default memory file
311: .\" .El
312: .Sh BUGS
313: The notion of errors is ill-defined.