netstat.tproj/netstat.1

   1 .\" Copyright (c) 1983, 1990, 1992, 1993
   2 .\"     The Regents of the University of California.  All rights reserved.
   3 .\"
   4 .\" Redistribution and use in source and binary forms, with or without
   5 .\" modification, are permitted provided that the following conditions
   6 .\" are met:
   7 .\" 1. Redistributions of source code must retain the above copyright
   8 .\"    notice, this list of conditions and the following disclaimer.
   9 .\" 2. Redistributions in binary form must reproduce the above copyright
  10 .\"    notice, this list of conditions and the following disclaimer in the
  11 .\"    documentation and/or other materials provided with the distribution.
  12 .\" 3. All advertising materials mentioning features or use of this software
  13 .\"    must display the following acknowledgement:
  14 .\"     This product includes software developed by the University of
  15 .\"     California, Berkeley and its contributors.
  16 .\" 4. Neither the name of the University nor the names of its contributors
  17 .\"    may be used to endorse or promote products derived from this software
  18 .\"    without specific prior written permission.
  19 .\"
  20 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  21 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  22 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  23 .\" ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  24 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  25 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  26 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  27 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  28 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  29 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  30 .\" SUCH DAMAGE.
  31 .\"
  32 .\"     @(#)netstat.1   8.8 (Berkeley) 4/18/94
  33 .\" $FreeBSD: src/usr.bin/netstat/netstat.1,v 1.22.2.7 2001/08/10 09:07:09 ru Exp $
  34 .\"
  35 .Dd June 15, 2001
  36 .Dt NETSTAT 1
  37 .Os Darwin
  38 .Sh NAME
  39 .Nm netstat
  40 .Nd show network status
  41 .Sh SYNOPSIS
  42 .Nm
  43 .Op Fl AaLlnW
  44 .Op Fl f Ar address_family | Fl p Ar protocol
  45 .Op Fl M Ar core
  46 .Op Fl N Ar system
  47 .Nm
  48 .Op Fl gilns
  49 .Op Fl f Ar address_family
  50 .Op Fl M Ar core
  51 .Op Fl N Ar system
  52 .Nm
  53 .Fl i | I Ar interface
  54 .Op Fl w Ar wait
  55 .Op Fl abdgt
  56 .Op Fl M Ar core
  57 .Op Fl N Ar system
  58 .Nm
  59 .Fl s Op Fl s
  60 .Op Fl f Ar address_family | Fl p Ar protocol
  61 .Op Fl M Ar core
  62 .Op Fl N Ar system
  63 .Nm
  64 .Fl i | I Ar interface Fl s
  65 .Op Fl f Ar address_family | Fl p Ar protocol
  66 .Op Fl M Ar core
  67 .Op Fl N Ar system
  68 .Nm
  69 .Fl m
  70 .Op Fl M Ar core
  71 .Op Fl N Ar system
  72 .Nm
  73 .Fl r
  74 .Op Fl Aaln
  75 .Op Fl f Ar address_family
  76 .Op Fl M Ar core
  77 .Op Fl N Ar system
  78 .Nm
  79 .Fl rs
  80 .Op Fl s
  81 .Op Fl M Ar core
  82 .Op Fl N Ar system
  83 .\"-----------------------------------------------------------------------------------------
  84 .Sh DESCRIPTION
  85 .\"-----------------------------------------------------------------------------------------
  86 The
  87 .Nm
  88 command symbolically displays the contents of various network-related data structures.
  89 There are a number of output formats, depending on the options for the information presented.
  90 The first form of the command displays a list of active sockets for each protocol.
  91 The second form presents the contents of one of the other network data structures according
  92 to the option selected. Using the third form, with a
  93 .Ar wait
  94 interval specified,
  95 .Nm
  96 will continuously display the information regarding packet traffic on the configured network
  97 interfaces.  The fourth form displays statistics for the specified protocol or address family.
  98 The fifth form displays per-interface statistics for the specified protocol or address family.
  99 The sixth form displays
 100 .Xr mbuf 9
 101 statistics.  The seventh form displays routing table for the specified address family.  The
 102 eighth form displays routing statistics.
 103 .Pp
 104 The options have the following meaning:
 105 .Bl -tag -width flag
 106 .It Fl A
 107 With the default display, show the address of any protocol control blocks associated with
 108 sockets; used for debugging.
 109 .It Fl a
 110 With the default display, show the state of all sockets; normally sockets used by server
 111 processes are not shown. With the routing table display (option
 112 .Fl r ,
 113 as described below), show protocol-cloned routes (routes generated by a
 114 .Dv RTF_PRCLONING
 115 parent route); normally these routes are not shown.
 116 .It Fl b
 117 With the interface display (option
 118 .Fl i ,
 119 as described below), show the number of bytes in and out.
 120 .It Fl d
 121 With either interface display (option
 122 .Fl i
 123 or an interval, as described below), show the number of dropped packets.
 124 .It Fl f Ar address_family
 125 Limit statistics or address control block reports to those of the specified
 126 .Ar address family  .
 127 The following address families are recognized:
 128 .Ar inet  ,
 129 for
 130 .Dv AF_INET  ,
 131 .Ar inet6  ,
 132 for
 133 .Dv AF_INET6
 134 and
 135 .Ar unix  ,
 136 for
 137 .Dv AF_UNIX  .
 138 .It Fl g
 139 Show information related to multicast (group address) routing.  By default, show the
 140 IP Multicast virtual-interface and routing tables. If the
 141 .Fl s
 142 option is also present, show multicast routing statistics.
 143 .It Fl I Ar interface
 144 Show information about the specified interface; used with a
 145 .Ar wait
 146 interval as described below.
 147 If the
 148 .Fl s
 149 option is present, show per-interface protocol statistics on the
 150 .Ar interface
 151 for the specified
 152 .Ar address_family
 153 or
 154 .Ar protocol ,
 155 or for all protocol families.
 156 .It Fl i
 157 Show the state of interfaces which have been auto-configured (interfaces statically
 158 configured into a system, but not located at boot time are not shown).  If the
 159 .Fl a
 160 options is also present, multicast addresses currently in use are shown for each
 161 Ethernet interface and for each IP interface address.  Multicast addresses are shown
 162 on separate lines following the interface address with which they are associated.
 163 If the
 164 .Fl s
 165 option is present, show per-interface statistics on all interfaces for the specified
 166 .Ar address_family
 167 or
 168 .Ar protocol ,
 169 or for all protocol families.
 170 .It Fl L
 171 Show the size of the various listen queues.  The first count shows the number of
 172 unaccepted connections.  The second count shows the amount of unaccepted incomplete
 173 connections.  The third count is the maximum number of queued connections.
 174 .It Fl l
 175 Print full IPv6 address.
 176 .It Fl M
 177 Extract values associated with the name list from the specified core instead of the
 178 default
 179 .Pa /dev/kmem .
 180 .It Fl m
 181 Show statistics recorded by the memory management routines (the network manages a
 182 private pool of memory buffers).
 183 .It Fl N
 184 Extract the name list from the specified system instead of the default
 185 .Pa /kernel .
 186 .It Fl n
 187 Show network addresses as numbers (normally
 188 .Nm
 189 interprets addresses and attempts to display them symbolically).  This option may be
 190 used with any of the display formats.
 191 .It Fl p Ar protocol
 192 Show statistics about
 193 .Ar protocol ,
 194 which is either a well-known name for a protocol or an alias for it.  Some protocol
 195 names and aliases are listed in the file
 196 .Pa /etc/protocols .
 197 The special protocol name
 198 .Dq bdg
 199 is used to show bridging statistics.  A null response typically means that there are
 200 no interesting numbers to report.  The program will complain if
 201 .Ar protocol
 202 is unknown or if there is no statistics routine for it.
 203 .It Fl r
 204 Show the routing tables.  Use with
 205 .Fl a
 206 to show protocol-cloned routes.  When
 207 .Fl s
 208 is also present, show routing statistics instead.  When
 209 .Fl l
 210 is also present,
 211 .Nm
 212 assumes more columns are there and the maximum transmission unit
 213 .Pq Dq mtu
 214 are also displayed.
 215 .It Fl s
 216 Show per-protocol statistics.  If this option is repeated, counters with a value of
 217 zero are suppressed.
 218 .It Fl W
 219 In certain displays, avoid truncating addresses even if this causes some fields to
 220 overflow.
 221 .It Fl w Ar wait
 222 Show network interface statistics at intervals of
 223 .Ar wait
 224 seconds.
 225 .El
 226 .Pp
 227 .\"-------------------------------------------------------------------------------
 228 .Sh OUTPUT
 229 .\"-------------------------------------------------------------------------------
 230 The default display, for active sockets, shows the local and remote addresses,
 231 send and receive queue sizes (in bytes), protocol, and the internal state of
 232 the protocol.  Address formats are of the form
 233 .Dq host.port
 234 or
 235 .Dq network.port
 236 if a socket's address specifies a network but no specific host address.
 237 If known, the host and network addresses are displayed symbolically
 238 according to the databases
 239 .Pa /etc/hosts
 240 and
 241 .Pa /etc/networks ,
 242 respectively.  If a symbolic name for an address is unknown, or if the
 243 .Fl n
 244 option is specified, the address is printed numerically, according to the
 245 address family.  For more information regarding the Internet
 246 .Dq dot format ,
 247 refer to
 248 .Xr inet 3 ) .
 249 Unspecified,
 250 or
 251 .Dq wildcard ,
 252 addresses and ports appear as
 253 .Dq * .
 254 .Pp
 255 Internet domain socket states:
 256 .Bl -column X LISTEN
 257 CLOSED:  The socket is not in use.
 258 .Pp
 259 LISTEN:  The socket is listening for incoming connections.  Unconnected
 260 listening sockets like these are only displayed when using the -a option.
 261 .Pp
 262 SYN_SENT:  The socket is actively trying to establish a connection to a
 263 remote peer.
 264 .Pp
 265 SYN_RCVD:  The socket has passively received a connection request from a
 266 remote peer.
 267 .Pp
 268 ESTABLISHED:  The socket has an established connection between a local
 269 application and a remote peer.
 270 .Pp
 271 CLOSE_WAIT:  The socket connection has been closed by the remote peer,
 272 and the system is waiting for the local application to close its half of
 273 the connection.
 274 .Pp
 275 LAST_ACK:  The socket connection has been closed by the remote peer, the
 276 local application has closed its half of the connection, and the system
 277 is waiting for the remote peer to acknowledge the close.
 278 .Pp
 279 FIN_WAIT_1:  The socket connection has been closed by the local
 280 application, the remote peer has not yet acknowledged the close, and the
 281 system is waiting for it to close its half of the connection.
 282 .Pp
 283 FIN_WAIT_2:  The socket connection has been closed by the local
 284 application, the remote peer has acknowledged the close, and the system
 285 is waiting for it to close its half of the connection.
 286 .Pp
 287 CLOSING:  The socket connection has been closed by the local application
 288 and the remote peer simultaneously, and the remote peer has not yet
 289 acknowledged the close attempt of the local application.
 290 .Pp
 291 TIME_WAIT:  The socket connection has been closed by the local
 292 application, the remote peer has closed its half of the connection, and
 293 the system is waiting to be sure that the remote peer received the last
 294 acknowledgement.
 295 .El
 296 .Pp
 297 The interface display provides a table of cumulative statistics regarding
 298 packets transferred, errors, and collisions.  The network addresses of the
 299 interface and the maximum transmission unit
 300 .Pq Dq mtu
 301 are also displayed.
 302 .Pp
 303 The routing table display indicates the available routes and their status.
 304 Each route consists of a destination host or network and a gateway to use
 305 in forwarding packets.  The flags field shows a collection of information
 306 about the route stored as binary choices.  The individual flags are discussed
 307 in more detail in the
 308 .Xr route 8
 309 and
 310 .Xr route 4
 311 manual pages.  The mapping between letters and flags is:
 312 .Bl -column XXXX RTF_BLACKHOLE
 313 1       RTF_PROTO1      Protocol specific routing flag #1
 314 2       RTF_PROTO2      Protocol specific routing flag #2
 315 3       RTF_PROTO3      Protocol specific routing flag #3
 316 B       RTF_BLACKHOLE   Just discard packets (during updates)
 317 b       RTF_BROADCAST   The route represents a broadcast address
 318 C       RTF_CLONING     Generate new routes on use
 319 c       RTF_PRCLONING   Protocol-specified generate new routes on use
 320 D       RTF_DYNAMIC     Created dynamically (by redirect)
 321 G       RTF_GATEWAY     Destination requires forwarding by intermediary
 322 H       RTF_HOST        Host entry (net otherwise)
 323 L       RTF_LLINFO      Valid protocol to link address translation
 324 M       RTF_MODIFIED    Modified dynamically (by redirect)
 325 R       RTF_REJECT      Host or net unreachable
 326 S       RTF_STATIC      Manually added
 327 U       RTF_UP          Route usable
 328 W       RTF_WASCLONED   Route was generated as a result of cloning
 329 X       RTF_XRESOLVE    External daemon translates proto to link address
 330 .El
 331 .Pp
 332 Direct routes are created for each interface attached to the local host;
 333 the gateway field for such entries shows the address of the outgoing
 334 interface.  The refcnt field gives the current number of active uses of
 335 the route.  Connection oriented protocols normally hold on to a single
 336 route for the duration of a connection while connectionless protocols
 337 obtain a route while sending to the same destination.  The use field
 338 provides a count of the number of packets sent using that route.  The
 339 interface entry indicates the network interface utilized for the route.
 340 .Pp
 341 When
 342 .Nm netstat
 343 is invoked with the
 344 .Fl w
 345 option and a
 346 .Ar wait
 347 interval argument, it displays a running count of statistics related to
 348 network interfaces.  An obsolete version of this option used a numeric
 349 parameter with no option, and is currently supported for backward
 350 compatibility.  By default, this display summarizes information for all
 351 interfaces.  Information for a specific interface may be displayed with the
 352 .Fl I
 353 option.
 354 .Sh SEE ALSO
 355 .Xr fstat 1 ,
 356 .Xr nfsstat 1 ,
 357 .Xr ps 1 ,
 358 .Xr sockstat 1 ,
 359 .Xr inet 4 ,
 360 .Xr unix 4 ,
 361 .Xr hosts 5 ,
 362 .Xr networks 5 ,
 363 .Xr protocols 5 ,
 364 .Xr services 5 ,
 365 .Xr iostat 8 ,
 366 .Xr trpt 8 ,
 367 .Xr vmstat 8
 368 .Sh HISTORY
 369 The
 370 .Nm netstat
 371 command appeared in
 372 .Bx 4.2 .
 373 .Pp
 374 IPv6 support was added by WIDE/KAME project.
 375 .Sh FILES
 376 .Bl -tag -width /dev/kmem -compact
 377 .It Pa /kernel
 378 default kernel namelist
 379 .It Pa /dev/kmem
 380 default memory file
 381 .El
 382 .Sh BUGS
 383 The notion of errors is ill-defined.