1 .\" Copyright (c) 2015 Apple Inc. All rights reserved.
3 .\" @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 .\" This file contains Original Code and/or Modifications of Original Code
6 .\" as defined in and that are subject to the Apple Public Source License
7 .\" Version 2.0 (the 'License'). You may not use this file except in
8 .\" compliance with the License. The rights granted to you under the License
9 .\" may not be used to create, or enable the creation or redistribution of,
10 .\" unlawful or unlicensed copies of an Apple operating system, or to
11 .\" circumvent, violate, or enable the circumvention or violation of, any
12 .\" terms of an Apple operating system software license agreement.
14 .\" Please obtain a copy of the License at
15 .\" http://www.opensource.apple.com/apsl/ and read it before using this file.
17 .\" The Original Code and all software distributed under the License are
18 .\" distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
19 .\" EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
20 .\" INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
21 .\" FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
22 .\" Please see the License for the specific language governing rights and
23 .\" limitations under the License.
25 .\" @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 .\" Copyright (c) 1983, 1990, 1992, 1993
28 .\" The Regents of the University of California. All rights reserved.
30 .\" Redistribution and use in source and binary forms, with or without
31 .\" modification, are permitted provided that the following conditions
33 .\" 1. Redistributions of source code must retain the above copyright
34 .\" notice, this list of conditions and the following disclaimer.
35 .\" 2. Redistributions in binary form must reproduce the above copyright
36 .\" notice, this list of conditions and the following disclaimer in the
37 .\" documentation and/or other materials provided with the distribution.
38 .\" 3. All advertising materials mentioning features or use of this software
39 .\" must display the following acknowledgement:
40 .\" This product includes software developed by the University of
41 .\" California, Berkeley and its contributors.
42 .\" 4. Neither the name of the University nor the names of its contributors
43 .\" may be used to endorse or promote products derived from this software
44 .\" without specific prior written permission.
46 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
47 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
48 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
49 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
50 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
51 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
52 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
53 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
54 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
55 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 .\" @(#)netstat.1 8.8 (Berkeley) 4/18/94
59 .\" $FreeBSD: src/usr.bin/netstat/netstat.1,v 1.22.2.7 2001/08/10 09:07:09 ru Exp $
66 .Nd show network status
70 .Op Fl f Ar address_family | Fl p Ar protocol
74 .Op Fl f Ar address_family
77 .Fl i | I Ar interface
83 .Op Fl f Ar address_family | Fl p Ar protocol
86 .Fl i | I Ar interface Fl s
87 .Op Fl f Ar address_family | Fl p Ar protocol
94 .Op Fl f Ar address_family
98 .\"-----------------------------------------------------------------------------------------
100 .\"-----------------------------------------------------------------------------------------
103 command symbolically displays the contents of various network-related data structures.
104 There are a number of output formats, depending on the options for the information presented.
105 The first form of the command displays a list of active sockets for each protocol.
106 The second form presents the contents of one of the other network data structures according
107 to the option selected. Using the third form, with a
111 will continuously display the information regarding packet traffic on the configured network
112 interfaces. The fourth form displays statistics for the specified protocol or address family. If a
114 interval is specified, the protocol information over the last interval seconds will be displayed.
115 The fifth form displays per-interface statistics for the specified protocol or address family.
116 The sixth form displays
118 statistics. The seventh form displays routing table for the specified address family. The
119 eighth form displays routing statistics.
121 The options have the following meaning:
124 With the default display, show the address of any protocol control blocks associated with
125 sockets and the flow hash; used for debugging.
127 With the default display, show the state of all sockets; normally sockets used by server
128 processes are not shown. With the routing table display (option
130 as described below), show protocol-cloned routes (routes generated by a
132 parent route); normally these routes are not shown.
134 With the interface display (option
136 as described below), show the number of bytes in and out.
138 With the queue statistics (option
140 as described below), show only those for the specified
143 With either interface display (option
145 or an interval, as described below), show the number of dropped packets.
146 .It Fl f Ar address_family
147 Limit statistics or address control block reports to those of the specified
149 The following address families are recognized:
161 Show information related to multicast (group address) membership. If the
163 option is also present, show extended interface group management statistics. If the
165 option is specified, show link-layer memberships; they are suppressed by default.
166 Source lists for each group will also be printed. Specifiying
168 twice will print the control plane timers for each interface and the source list counters
169 for each group. If the
171 is specified, only that interface will be shown. If the
173 is specified, only information for the address family will be displayed.
174 .It Fl I Ar interface
175 Show information about the specified interface; used with a
177 interval as described below.
180 option is present, show per-interface protocol statistics on the
186 or for all protocol families.
188 Show the state of interfaces which have been auto-configured (interfaces statically
189 configured into a system, but not located at boot time are not shown). If the
191 options is also present, multicast addresses currently in use are shown for each
192 Ethernet interface and for each IP interface address. Multicast addresses are shown
193 on separate lines following the interface address with which they are associated.
196 option is present, show per-interface statistics on all interfaces for the specified
200 or for all protocol families.
202 Show the size of the various listen queues. The first count shows the number of
203 unaccepted connections. The second count shows the amount of unaccepted incomplete
204 connections. The third count is the maximum number of queued connections.
206 Print full IPv6 address.
208 Show statistics recorded by the memory management routines (the network stack manages a private pool of memory buffers). More detailed information about the buffers, which includes their cache related statistics, can be obtained by using
215 Show network addresses as numbers (normally
217 interprets addresses and attempts to display them symbolically). This option may be
218 used with any of the display formats.
220 Show statistics about
222 which is either a well-known name for a protocol or an alias for it. Some protocol
223 names and aliases are listed in the file
225 The special protocol name
227 is used to show bridging statistics. A null response typically means that there are
228 no interesting numbers to report. The program will complain if
230 is unknown or if there is no statistics routine for it.
232 Show network interface send queue statistics. By default all queues are displayed, unless
235 This option requires specifying an interface with
237 option. More detailed information about the queues, which includes their queueing algorithm related statistics, can be obtained by using
244 Show the routing tables. Use with
246 to show protocol-cloned routes. When
248 is also present, show routing statistics instead. When
252 assumes more columns are there and the maximum transmission unit
256 Show reachability information. Use with
258 to show link-layer reachability information for a given interface.
260 Show per-protocol statistics. If this option is repeated, counters with a value of
263 Show interface link status and interface state information about the specified interface. This option requires specifying an interface with
267 Increase verbosity level.
269 In certain displays, avoid truncating addresses even if this causes some fields to
272 Show network interface or protocol statistics at intervals of
276 Show extended link-layer reachability information in addition to that shown by
282 .\"-------------------------------------------------------------------------------
284 .\"-------------------------------------------------------------------------------
285 The default display, for active sockets, shows the local and remote addresses,
286 send and receive queue sizes (in bytes), protocol, and the internal state of
287 the protocol. Address formats are of the form
291 if a socket's address specifies a network but no specific host address.
292 If known, the host and network addresses are displayed symbolically
293 according to the databases
297 respectively. If a symbolic name for an address is unknown, or if the
299 option is specified, the address is printed numerically, according to the
300 address family. For more information regarding the Internet
307 addresses and ports appear as
310 Internet domain socket states:
312 CLOSED: The socket is not in use.
314 LISTEN: The socket is listening for incoming connections. Unconnected
315 listening sockets like these are only displayed when using the -a option.
317 SYN_SENT: The socket is actively trying to establish a connection to a
320 SYN_RCVD: The socket has passively received a connection request from a
323 ESTABLISHED: The socket has an established connection between a local
324 application and a remote peer.
326 CLOSE_WAIT: The socket connection has been closed by the remote peer,
327 and the system is waiting for the local application to close its half of
330 LAST_ACK: The socket connection has been closed by the remote peer, the
331 local application has closed its half of the connection, and the system
332 is waiting for the remote peer to acknowledge the close.
334 FIN_WAIT_1: The socket connection has been closed by the local
335 application, the remote peer has not yet acknowledged the close, and the
336 system is waiting for it to close its half of the connection.
338 FIN_WAIT_2: The socket connection has been closed by the local
339 application, the remote peer has acknowledged the close, and the system
340 is waiting for it to close its half of the connection.
342 CLOSING: The socket connection has been closed by the local application
343 and the remote peer simultaneously, and the remote peer has not yet
344 acknowledged the close attempt of the local application.
346 TIME_WAIT: The socket connection has been closed by the local
347 application, the remote peer has closed its half of the connection, and
348 the system is waiting to be sure that the remote peer received the last
352 The interface display provides a table of cumulative statistics regarding
353 packets transferred, errors, and collisions. The network addresses of the
354 interface and the maximum transmission unit
358 The routing table display indicates the available routes and their status.
359 Each route consists of a destination host or network and a gateway to use
360 in forwarding packets. The flags field shows a collection of information
361 about the route stored as binary choices. The individual flags are discussed
362 in more detail in the
366 manual pages. The mapping between letters and flags is:
367 .Bl -column XXXX RTF_BLACKHOLE
368 1 RTF_PROTO1 Protocol specific routing flag #1
369 2 RTF_PROTO2 Protocol specific routing flag #2
370 3 RTF_PROTO3 Protocol specific routing flag #3
371 B RTF_BLACKHOLE Just discard packets (during updates)
372 b RTF_BROADCAST The route represents a broadcast address
373 C RTF_CLONING Generate new routes on use
374 c RTF_PRCLONING Protocol-specified generate new routes on use
375 D RTF_DYNAMIC Created dynamically (by redirect)
376 G RTF_GATEWAY Destination requires forwarding by intermediary
377 H RTF_HOST Host entry (net otherwise)
378 I RTF_IFSCOPE Route is associated with an interface scope
379 i RTF_IFREF Route is holding a reference to the interface
380 L RTF_LLINFO Valid protocol to link address translation
381 M RTF_MODIFIED Modified dynamically (by redirect)
382 m RTF_MULTICAST The route represents a multicast address
383 R RTF_REJECT Host or net unreachable
384 r RTF_ROUTER Host is a default router
385 S RTF_STATIC Manually added
386 U RTF_UP Route usable
387 W RTF_WASCLONED Route was generated as a result of cloning
388 X RTF_XRESOLVE External daemon translates proto to link address
389 Y RTF_PROXY Proxying; cloned routes will not be scoped
392 Direct routes are created for each interface attached to the local host;
393 the gateway field for such entries shows the address of the outgoing
394 interface. The refcnt field gives the current number of active uses of
395 the route. Connection oriented protocols normally hold on to a single
396 route for the duration of a connection while connectionless protocols
397 obtain a route while sending to the same destination. The use field
398 provides a count of the number of packets sent using that route. The
399 interface entry indicates the network interface utilized for the route.
400 A route which is marked with the RTF_IFSCOPE flag is instantiated for
401 the corresponding interface. A cloning route which is marked with the
402 RTF_PROXY flag will not generate new routes that are associated
403 with its interface scope.
411 interval argument, it displays a running count of statistics related to
412 network interfaces or protocols. An obsolete version of this option used a numeric
413 parameter with no option, and is currently supported for backward
414 compatibility. By default, this display summarizes information for all
415 interfaces. Information for a specific interface may be displayed with the
435 IPv6 support was added by WIDE/KAME project.
437 The notion of errors is ill-defined.
projects / apple / network_cmds.git / blob