| blob | 6cea799470f5c61da9954787a6fc1999857d3b26 |
1 .\" $NetBSD: netstat.1,v 1.72 2015/03/23 18:33:17 roy Exp $
2 .\"
3 .\" Copyright (c) 1983, 1990, 1992, 1993
4 .\" The Regents of the University of California. All rights reserved.
5 .\"
6 .\" Redistribution and use in source and binary forms, with or without
7 .\" modification, are permitted provided that the following conditions
8 .\" are met:
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
11 .\" 2. Redistributions in binary form must reproduce the above copyright
12 .\" notice, this list of conditions and the following disclaimer in the
13 .\" documentation and/or other materials provided with the distribution.
14 .\" 3. Neither the name of the University nor the names of its contributors
15 .\" may be used to endorse or promote products derived from this software
16 .\" without specific prior written permission.
17 .\"
18 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
19 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
22 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 .\" SUCH DAMAGE.
29 .\"
30 .\" @(#)netstat.1 8.8 (Berkeley) 4/18/94
31 .\"
32 .Dd March 19, 2015
33 .Dt NETSTAT 1
34 .Os
35 .Sh NAME
36 .Nm netstat
37 .Nd show network status
38 .Sh SYNOPSIS
39 .ds address_family Fl f Ar address_family Ns Op , Ns Ar family ...
40 .Nm
41 .Op Fl Aan
42 .Op \*[address_family]
43 .Op Fl M Ar core
44 .Op Fl N Ar system
45 .Nm
46 .Op Fl bdghiLlmnqrSsTtv
47 .Op \*[address_family]
48 .Op Fl M Ar core
49 .Op Fl N Ar system
50 .Nm
51 .Op Fl dn
52 .Op Fl I Ar interface
53 .Op Fl M Ar core
54 .Op Fl N Ar system
55 .Op Fl w Ar wait
56 .Nm
57 .Op Fl M Ar core
58 .Op Fl N Ar system
59 .Op Fl p Ar protocol
60 .Nm
61 .Op Fl M Ar core
62 .Op Fl N Ar system
63 .Op Fl p Ar protocol
64 .Fl P Ar pcbaddr
65 .Nm
66 .Op Fl i
67 .Op Fl I Ar Interface
68 .Op Fl p Ar protocol
69 .Nm
70 .Op Fl is
71 .Op \*[address_family]
72 .Op Fl I Ar Interface
73 .Nm
74 .Op Fl s
75 .Op Fl I Ar Interface
76 .Fl B
77 .Sh DESCRIPTION
78 The
79 .Nm
80 command symbolically displays the contents of various network-related
81 data structures.
82 There are a number of output formats,
83 depending on the options for the information presented.
84 The first form of the command displays a list of active sockets for
85 each protocol.
86 The second form presents the contents of one of the other network
87 data structures according to the option selected.
88 Using the third form, with a
89 .Ar wait
90 interval specified,
91 .Nm
92 will continuously display the information regarding packet
93 traffic on the configured network interfaces.
94 The fourth form displays statistics about the named protocol.
95 The fifth and sixth forms display per interface statistics for
96 the specified protocol or address family.
97 .Pp
98 The options have the following meaning:
99 .Bl -tag -width flag
100 .It Fl A
101 With the default display,
102 show the address of any protocol control blocks associated with sockets; used
103 for debugging.
104 .It Fl a
105 With the default display,
106 show the state of all sockets; normally sockets used by
107 server processes are not shown.
108 .It Fl B
109 With the default display,
110 show the current
111 .Xr bpf 4
112 peers.
113 To show only the peers listening to a specific interface,
114 use the
115 .Fl I
116 option.
117 If the
118 .Fl s
119 option is present, show the current
120 .Xr bpf 4
121 statistics.
122 .It Fl b
123 With the interface display (option
124 .Fl i ) ,
125 show bytes in and out, instead of packets in and out.
126 .It Fl d
127 With either interface display (option
128 .Fl i
129 or an interval, as described below),
130 show the number of dropped packets.
131 .It \*[address_family]
132 Limit statistics or address control block reports to those
133 of the specified
134 .Ar address_families .
135 The following address families
136 are recognized:
137 .Ar inet ,
138 for
139 .Dv AF_INET ;
140 .Ar inet6 ,
141 for
142 .Dv AF_INET6 ;
143 .Ar arp ,
144 for
145 .Dv AF_ARP ;
146 .Ar ns ,
147 for
148 .Dv AF_NS ;
149 .Ar atalk ,
150 for
151 .Dv AF_APPLETALK ;
152 .Ar mpls ,
153 for
154 .Dv AF_MPLS ;
155 and
156 .Ar local
157 or
158 .Ar unix ,
159 for
160 .Dv AF_LOCAL .
161 .It Fl g
162 Show information related to multicast (group address) routing.
163 By default, show the IP Multicast virtual-interface and routing tables.
164 If the
165 .Fl s
166 option is also present, show multicast routing statistics.
167 .It Fl h
168 When used with
169 .Fl b
170 in combination with either
171 .Fl i
172 or
173 .Fl I ,
174 output "human-readable" byte counts.
175 .It Fl I Ar interface
176 Show information about the specified interface;
177 used with a
178 .Ar wait
179 interval as described below.
180 If the
181 .Fl f Ar address_family
182 option (with the
183 .Fl s
184 option) or the
185 .Fl p Ar protocol
186 option is present, show per-interface statistics on the
187 .Ar interface
188 for the specified
189 .Ar address_family
190 or
191 .Ar protocol ,
192 respectively.
193 .It Fl i
194 Show the state of interfaces which have been auto-configured
195 (interfaces statically configured into a system, but not
196 located at boot time are not shown).
197 If the
198 .Fl a
199 options is also present, multicast addresses currently in use are shown
200 for each Ethernet interface and for each IP interface address.
201 Multicast addresses are shown on separate lines following the interface
202 address with which they are associated.
203 If the
204 .Fl f Ar address_family
205 option (with the
206 .Fl s
207 option) or the
208 .Fl p Ar protocol
209 option is present, show per-interface statistics on all interfaces
210 for the specified
211 .Ar address_family
212 or
213 .Ar protocol ,
214 respectively.
215 .It Fl L
216 Don't show link-level routes (e.g., IPv4 ARP or IPv6 neighbour cache).
217 .It Fl l
218 With the
219 .Fl g
220 option, display wider fields for the IPv6 multicast routing table
221 .Qq Origin
222 and
223 .Qq Group
224 columns.
225 .It Fl M Ar core
226 Use
227 .Xr kvm 3
228 instead of
229 .Xr sysctl 3
230 to retrieve information and
231 extract values associated with the name list from the specified core.
232 If the
233 .Fl M
234 option is not given but the
235 .Fl N
236 option is given, the default
237 .Pa /dev/mem
238 is used.
239 .It Fl m
240 Show statistics recorded by the mbuf memory management routines
241 (the network manages a private pool of memory buffers).
242 .It Fl N Ar system
243 Use
244 .Xr kvm 3
245 instead of
246 .Xr sysctl 3
247 to retrieve information and extract the name list from the specified system.
248 For the default behavior when only
249 .Fl M
250 option is given, see the description about when
251 .Fa execfile
252 is
253 .Dv NULL
254 in
255 .Xr kvm_openfiles 3 .
256 .It Fl n
257 Show network addresses and ports as numbers (normally
258 .Nm
259 interprets addresses and ports and attempts to display them
260 symbolically).
261 This option may be used with any of the display formats.
262 .It Fl P Ar pcbaddr
263 Dump the contents of the protocol control block (PCB) located at kernel
264 virtual address
265 .Ar pcbaddr .
266 This address may be obtained using the
267 .Fl A
268 flag.
269 The default protocol is TCP, but may be overridden using the
270 .Fl p
271 flag.
272 .It Fl p Ar protocol
273 Show statistics about
274 .Ar protocol ,
275 which is either a well-known name for a protocol or an alias for it.
276 Some protocol names and aliases are listed in the file
277 .Pa /etc/protocols .
278 A null response typically means that there are no interesting numbers to
279 report.
280 The program will complain if
281 .Ar protocol
282 is unknown or if there is no statistics routine for it.
283 .It Fl q
284 Show software interrupt queue setting/statistics for all protocols.
285 .It Fl r
286 Show the routing tables.
287 When
288 .Fl s
289 is also present, show routing statistics instead.
290 .It Fl S
291 Show network addresses as numbers (as with
292 .Fl n ,
293 but show ports symbolically).
294 .It Fl s
295 Show per-protocol statistics.
296 If this option is repeated, counters with a value of zero are suppressed.
297 .It Fl T
298 Show MPLS Tags for the routing tables.
299 If multiple tags exists, they will
300 be comma separated, first tag being the BoS one.
301 .It Fl t
302 With the
303 .Fl i
304 option, display the current value of the watchdog timer function.
305 .It Fl v
306 Show extra (verbose) detail for the routing tables
307 .Pq Fl r ,
308 or avoid truncation of long addresses.
309 .It Fl w Ar wait
310 Show network interface statistics at intervals of
311 .Ar wait
312 seconds.
313 .It Fl X
314 Force use of
315 .Xr sysctl 3
316 when retrieving information.
317 Some features of
318 .Nm
319 may not be (fully) supported when using
320 .Xr sysctl 3 .
321 This flag forces the use of the latter regardless, and emits a message if a
322 not yet fully supported feature is used in conjunction with it.
323 This flag might be removed at any time; do not rely on its presence.
324 .El
325 .Pp
326 The default display, for active sockets, shows the local
327 and remote addresses, send and receive queue sizes (in bytes), protocol,
328 and the internal state of the protocol.
329 Address formats are of the form ``host.port'' or ``network.port''
330 if a socket's address specifies a network but no specific host address.
331 When known the host and network addresses are displayed symbolically
332 according to the data bases
333 .Pa /etc/hosts
334 and
335 .Pa /etc/networks ,
336 respectively.
337 If a symbolic name for an address is unknown, or if
338 the
339 .Fl n
340 option is specified, the address is printed numerically, according
341 to the address family.
342 For more information regarding
343 the Internet ``dot format,''
344 refer to
345 .Xr inet 3 ) .
346 Unspecified,
347 or ``wildcard'', addresses and ports appear as ``*''.
348 You can use the
349 .Xr fstat 1
350 command to find out which process or processes hold references to a socket.
351 .Pp
352 The interface display provides a table of cumulative
353 statistics regarding packets transferred, errors, and collisions.
354 The network addresses of the interface
355 and the maximum transmission unit (``mtu'') are also displayed.
356 .Pp
357 The routing table display indicates the available routes and
358 their status.
359 Each route consists of a destination host or network
360 and a gateway to use in forwarding packets.
361 The flags field shows
362 a collection of information about the route stored as
363 binary choices.
364 The individual flags are discussed in more
365 detail in the
366 .Xr route 8
367 and
368 .Xr route 4
369 manual pages.
370 The mapping between letters and flags is:
371 .Bl -column XXXX RTF_BLACKHOLE
372 .It 1 RTF_PROTO1 Protocol specific routing flag #1
373 .It 2 RTF_PROTO2 Protocol specific routing flag #2
374 .It B RTF_BLACKHOLE Just discard pkts (during updates)
375 .It b RTF_BROADCAST Route represents a broadcast address
376 .It C RTF_CLONING Generate new routes on use
377 .It c RTF_CLONED Cloned routes (generated from RTF_CLONING)
378 .It D RTF_DYNAMIC Created dynamically (by redirect)
379 .It G RTF_GATEWAY Destination requires forwarding by intermediary
380 .It H RTF_HOST Host entry (net otherwise)
381 .It L RTF_LLINFO Valid protocol to link address translation.
382 .It l RTF_LOCAL Route represents a local address
383 .It M RTF_MODIFIED Modified dynamically (by redirect)
384 .It p RTF_ANNOUNCE Link level proxy
385 .It R RTF_REJECT Host or net unreachable
386 .It S RTF_STATIC Manually added
387 .It U RTF_UP Route usable
388 .It X RTF_XRESOLVE External daemon translates proto to link address
389 .El
390 .Pp
391 Direct routes are created for each
392 interface attached to the local host;
393 the gateway field for such entries shows the address of the outgoing interface.
394 The refcnt field gives the
395 current number of active uses of the route.
396 Connection oriented
397 protocols normally hold on to a single route for the duration of
398 a connection while connectionless protocols obtain a route while sending
399 to the same destination.
400 The use field provides a count of the number of packets
401 sent using that route.
402 The mtu entry shows the mtu associated with
403 that route.
404 This mtu value is used as the basis for the TCP maximum
405 segment size.
406 The 'L' flag appended to the mtu value indicates that
407 the value is locked, and that path mtu discovery is turned off for
408 that route.
409 A
410 .Sq -
411 indicates that the mtu for this route has not been set, and a default
412 TCP maximum segment size will be used.
413 The interface entry indicates
414 the network interface used for the route.
415 .Pp
416 When
417 .Nm
418 is invoked with the
419 .Fl w
420 option and a
421 .Ar wait
422 interval argument, it displays a running count of statistics related to
423 network interfaces.
424 An obsolescent version of this option used a numeric parameter
425 with no option, and is currently supported for backward compatibility.
426 This display consists of a column for the primary interface (the first
427 interface found during autoconfiguration) and a column summarizing
428 information for all interfaces.
429 The primary interface may be replaced with another interface with the
430 .Fl I
431 option.
432 The first line of each screen of information contains a summary since the
433 system was last rebooted.
434 Subsequent lines of output show values
435 accumulated over the preceding interval.
436 .Pp
437 The first character of the flags column in the
438 .Fl B
439 option shows the status of the
440 .Xr bpf 4
441 descriptor which has three different values:
442 Idle ('I'), Waiting ('W') and Timed Out ('T').
443 The second character indicates whether the promisc flag is set.
444 The third character indicates the status of the immediate mode.
445 The fourth character indicates whether the peer will have the ability
446 to see the packets sent.
447 And the fifth character shows the header complete flag status.
448 .Sh SEE ALSO
449 .Xr fstat 1 ,
450 .Xr nfsstat 1 ,
451 .Xr ps 1 ,
452 .Xr sockstat 1 ,
453 .Xr vmstat 1 ,
454 .Xr inet 3 ,
455 .Xr bpf 4 ,
456 .Xr hosts 5 ,
457 .Xr networks 5 ,
458 .Xr protocols 5 ,
459 .Xr services 5 ,
460 .Xr iostat 8 ,
461 .Xr trpt 8
462 .Sh HISTORY
463 The
464 .Nm
465 command appeared in
466 .Bx 4.2 .
467 IPv6 support was added by WIDE/KAME project.
468 .\" .Sh FILES
469 .\" .Bl -tag -width /dev/mem -compact
470 .\" .It Pa /netbsd
471 .\" default kernel namelist
472 .\" .It Pa /dev/mem
473 .\" default memory file
474 .\" .El
475 .Sh BUGS
476 The notion of errors is ill-defined.