netstat(1)

NAME

netstat — show network status

SYNOPSIS

netstat [-an] [-f address-family] [system [core]]

netstat [-Mnrsv] [-f address-family] [-p protocol] [system [core]]

netstat [-gin] [-I interface] [interval] [system [core]]

DESCRIPTION

netstat displays statistics for network interfaces and protocols, as well as the contents of various network-related data structures. The output format varies according to the options selected. Some options are ignored when used in combination with other options.

Generally, the netstat command takes one of the three forms shown above:

The first form of the command displays a list of active sockets for each protocol.
The second form displays the contents of one of the other network data structures according to the option selected.
The third form displays configuration information for each network interface. It also displays network traffic data on configured network interfaces, optionally updated at each interval, measured in seconds.

Options are interpreted as follows:

-a: Show the state of all sockets, including passive sockets used by server processes. When netstat is used without any options only active sockets are shown. This option does not show the state of X.25 programmatic access sockets. The option is ignored if the -g, -i, -I, -M, -p, -r, -s or interval option is specified.
-f address-family: Show statistics or address control block for only the specified address-family. The following address families are recognized: inet for AF_INET, and unix for AF_UNIX. This option applies to the -a and -s options.
-g: Show multicast information for network interfaces. Only the address family AF_INET is recognized by this option. This option may be combined with the -i option to display both kinds of information. The option is ignored if the -p option is specified.
-i: Show the state of network interfaces. Only the interfaces that have been configured with an IP address or the plumb option using the ifconfig command are shown. The output includes both the primary and logical interfaces. (See ifconfig(1M)). The counts for Ipkts and Opkts fields are for IP packets only. This option is ignored if the -p option is specified.
-I interface: Show information about the specified interface only. This option applies to the -g and -i options.
-M: Show the multicast routing tables. When -s is used with the -M option, netstat displays multicast routing statistics instead. This option is ignored if the -p option is specified.
-n: Show network addresses as numbers. Normally, netstat interprets addresses and attempts to display them symbolically. This option applies to the -a, -i, -r and -v options.
-p protocol: Show statistics for the specified protocol. The following protocols are recognized: tcp, udp, ip, icmp, and igmp.
-r: Show the routing tables. When -v is used with the -r option, netstat also displays the network masks in the route entries. When -s is used with the -r option, netstat displays routing statistics instead. This option is ignored if the -g, -i, -I, -p or interval option is specified.
-s: Show statistics for all protocols. When this option is used with the -M option, netstat displays multicast routing statistics instead. This option is ignored if the -g, -i, -I, -p or interval option is specified.
-v: Show additional routing information. When -v is used with the -r option, netstat also displays the network masks in the route entries. This option only applies to the -r option.

The arguments system and core allow substitutes for the defaults, /stand/vmunix and /dev/kmem.

If no options is specified, netstat displays the status of only active sockets. The display of active and passive sockets status shows the local and remote addresses, send and receive queue sizes (in bytes), protocol, and the internal state of the protocol. Address formats are of the form host.port, or network.port if the host portion of a socket address is zero. When known, the host and network addresses are displayed symbolically by using gethostbyname() and getnetbyname(), respectively (see gethostent(3N) and getnetent(3N)). If a symbolic name for an address is unknown, the address is displayed numerically according to the address family. For more information regarding the Internet ``dot format'', refer to inet(3N). Unspecified or ``wildcard'' addresses and ports appear as an asterisk (*).

The interface display provides a table of cumulative statistics regarding packets transferred, both inbound and outbound. The network addresses of the interface and the maximum transmission unit (MTU) are also displayed. When the interval argument is specified, netstat displays a running count of statistics related to network interfaces. This display consists of a column for the first interface found during auto-configuration and a column summarizing information for all interfaces. To display a running count of statistics for a specific interface, use the -I option. The first line of each screen of information contains a summary since the system was last rebooted. Subsequent lines of output show values accumulated over the preceding interval.

The routing table display indicates the available routes and their status. Each route consists of a destination host or network, a netmask and a gateway to use in forwarding packets. The Flags field shows whether the route is up (U), whether the route is to a gateway (G), or whether the route is a host or network route (with or without H).

The Netmask field shows the mask to be applied to the destination IP address of an IP packet to be forwarded. The result will be compared with the destination address in the route entry. If they are the same, then the route is one of the candidates for routing this IP packet. If there are several candidate routes, then the route with the longest Netmask field (contiguous 1's starting from the leftmost bit position) will be chosen. (see routing(7).)

The Gateway field shows the address of the immediate gateway for reaching the destination. It can be the address of the outgoing interface if the destination is on a directly connected network.

The Use field shows a count of the number of packets sent using this route.

The Interface field identifies which network interface is used for the route.

The Pmtu field displays the path maximum transmission unit (PMTU). If the route is created with a static PMTU value (see route(1M)), the corresponding PMTU value permanently overrides the interface MTU. Otherwise, the Pmtu value is the same as the MTU of the network interface used for the route.

DEPENDENCIES

X.25:

-a option does not list X.25 programmatic access information.

AUTHOR

netstat was developed by HP and the University of California, Berkeley.

netstat(1)

Technical documentation

» Table of Contents

» Index