| 1 | .\" Copyright (c) 1983 Regents of the University of California. |
| 2 | .\" All rights reserved. The Berkeley software License Agreement |
| 3 | .\" specifies the terms and conditions for redistribution. |
| 4 | .\" |
| 5 | .\" @(#)netstat.1 6.1 (Berkeley) %G% |
| 6 | .\" |
| 7 | .TH NETSTAT 1 "" |
| 8 | .UC 5 |
| 9 | .SH NAME |
| 10 | netstat \- show network status |
| 11 | .SH SYNOPSIS |
| 12 | .B netstat |
| 13 | [ |
| 14 | .B \-Aahimnrs |
| 15 | ] [ |
| 16 | .B \-I |
| 17 | .I interface |
| 18 | ] [ |
| 19 | .B \-p |
| 20 | .I protocol |
| 21 | ] [ |
| 22 | .I interval |
| 23 | ] [ |
| 24 | .I system |
| 25 | ] [ |
| 26 | .I core |
| 27 | ] |
| 28 | .SH DESCRIPTION |
| 29 | The |
| 30 | .I netstat |
| 31 | command symbolically displays the contents of various network-related |
| 32 | data structures. The options have the following meaning: |
| 33 | .TP |
| 34 | .B \-A |
| 35 | show the address of any associated protocol control blocks; used |
| 36 | for debugging |
| 37 | .TP |
| 38 | .B \-a |
| 39 | show the state of all sockets; normally sockets used by |
| 40 | server processes are not shown |
| 41 | .TP |
| 42 | .B \-h |
| 43 | show the state of the IMP host table |
| 44 | .TP |
| 45 | .B \-i |
| 46 | show the state of interfaces which have been auto-configured |
| 47 | (interfaces statically configured into a system, but not |
| 48 | located at boot time are not shown) |
| 49 | .TP |
| 50 | .BI \-I " interface" |
| 51 | show information only about this interface |
| 52 | (see also |
| 53 | .I interval |
| 54 | below) |
| 55 | .TP |
| 56 | .B \-m |
| 57 | show statistics recorded by the memory management routines |
| 58 | (the network manages a ``private share'' of memory) |
| 59 | .TP |
| 60 | .B \-n |
| 61 | show network addresses as numbers (normally |
| 62 | .I netstat |
| 63 | interprets addresses and attempts to display them |
| 64 | symbolically) |
| 65 | .TP |
| 66 | .BI \-p " proto" |
| 67 | show the state of sockets utilizing protocol |
| 68 | .IR proto ; |
| 69 | the protocol is specified symbolically, and may be any |
| 70 | protocol listed in the file |
| 71 | .IR /etc/protocols . |
| 72 | .TP |
| 73 | .B \-s |
| 74 | show per-protocol statistics |
| 75 | .TP |
| 76 | .B \-r |
| 77 | show the routing tables |
| 78 | .PP |
| 79 | The arguments, |
| 80 | .I system |
| 81 | and |
| 82 | .I core |
| 83 | allow substitutes for the defaults ``/vmunix'' and ``/dev/kmem''. |
| 84 | .PP |
| 85 | If an |
| 86 | .I interval |
| 87 | is specified, |
| 88 | .I netstat |
| 89 | will continuously display the information regarding packet |
| 90 | traffic on the configured network interfaces, pausing |
| 91 | .I interval |
| 92 | seconds before refreshing the screen. |
| 93 | .PP |
| 94 | There are a number of display formats, depending on the information |
| 95 | presented. The default display, for active sockets, shows the local |
| 96 | and remote addresses, send and receive queue sizes (in bytes), protocol, |
| 97 | and, optionally, the internal state of the protocol. |
| 98 | .PP |
| 99 | Address formats are of the form ``host.port'' or ``network.port'' |
| 100 | if a socket's address specifies a network but no specific host address. |
| 101 | When known the host and network addresses are displayed symbolically |
| 102 | according to the data bases |
| 103 | .I /etc/hosts |
| 104 | and |
| 105 | .IR /etc/networks , |
| 106 | respectively. If a symbolic name for an address is unknown, or if |
| 107 | the |
| 108 | .B \-n |
| 109 | option is specified, the address is printed in the Internet ``dot format''; |
| 110 | refer to |
| 111 | .IR inet (3N) |
| 112 | for more information regarding this format. |
| 113 | Unspecified, |
| 114 | or ``wildcard'', addresses and ports appear as ``*''. |
| 115 | .PP |
| 116 | The interface display provides a table of cumulative |
| 117 | statistics regarding packets transferred, errors, and collisions. |
| 118 | The network address (currently Internet specific) of the interface |
| 119 | and the maximum transmission unit (``mtu'') are also displayed. |
| 120 | .PP |
| 121 | The routing table display indicates the available routes and |
| 122 | their status. Each route consists of a destination host or network |
| 123 | and a gateway to use in forwarding packets. The flags field shows |
| 124 | the state of the route (``U'' if ``up''), and whether the route |
| 125 | is to a gateway (``G''). Direct routes are created for each |
| 126 | interface attached to the local host. The refcnt field gives the |
| 127 | current number of active uses of the route. Connection oriented |
| 128 | protocols normally hold on to a single route for the duration of |
| 129 | a connection while connectionless protocols obtain a route then |
| 130 | discard it. The use field provides a count of the number of packets |
| 131 | sent using that route. The interface entry indicates the network |
| 132 | interface utilized for the route. |
| 133 | .PP |
| 134 | When |
| 135 | .I netstat |
| 136 | is invoked with an |
| 137 | .I interval |
| 138 | argument, it displays a running count of statistics related to |
| 139 | network interfaces. This display consists of a column summarizing |
| 140 | information for all interfaces, and a column for the interface with |
| 141 | the most traffic since the system was last rebooted. The first |
| 142 | line of each screen of information contains a summary since the |
| 143 | system was last rebooted. Subsequent lines of output show values |
| 144 | accumulated over the preceding interval. |
| 145 | .SH SEE ALSO |
| 146 | iostat(1), |
| 147 | vmstat(1), |
| 148 | hosts(5), |
| 149 | networks(5), |
| 150 | protocols(5), |
| 151 | services(5), |
| 152 | trpt(8C) |
| 153 | .SH BUGS |
| 154 | The notion of errors is ill-defined. Collisions mean |
| 155 | something else for the IMP. |