| blob | 02af4818b12633f2cd5a6b227e5f0fc59c64886f |
1 .\" $NetBSD: netstat.1,v 1.53 2009/09/13 02:53:17 elad Exp $
2 .\"
3 .\" Copyright (c) 1983, 1990, 1992, 1993
4 .\" The Regents of the University of California. All rights reserved.
5 .\"
6 .\" Redistribution and use in source and binary forms, with or without
7 .\" modification, are permitted provided that the following conditions
8 .\" are met:
9 .\" 1. Redistributions of source code must retain the above copyright
10 .\" notice, this list of conditions and the following disclaimer.
11 .\" 2. Redistributions in binary form must reproduce the above copyright
12 .\" notice, this list of conditions and the following disclaimer in the
13 .\" documentation and/or other materials provided with the distribution.
14 .\" 3. Neither the name of the University nor the names of its contributors
15 .\" may be used to endorse or promote products derived from this software
16 .\" without specific prior written permission.
17 .\"
18 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
19 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
22 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 .\" SUCH DAMAGE.
29 .\"
30 .\" @(#)netstat.1 8.8 (Berkeley) 4/18/94
31 .\"
32 .Dd September 12, 2009
33 .Dt NETSTAT 1
34 .Os
35 .Sh NAME
36 .Nm netstat
37 .Nd show network status
38 .Sh SYNOPSIS
39 .Nm
40 .Op Fl Aan
41 .Op Fl f Ar address_family
42 .Op Fl M Ar core
43 .Op Fl N Ar system
44 .Nm
45 .Op Fl bdgiLmnqrSsv
46 .Op Fl f Ar address_family
47 .Op Fl M Ar core
48 .Op Fl N Ar system
49 .Nm
50 .Op Fl dn
51 .Op Fl I Ar interface
52 .Op Fl M Ar core
53 .Op Fl N Ar system
54 .Op Fl w Ar wait
55 .Nm
56 .Op Fl M Ar core
57 .Op Fl N Ar system
58 .Op Fl p Ar protocol
59 .Nm
60 .Op Fl M Ar core
61 .Op Fl N Ar system
62 .Op Fl p Ar protocol
63 .Fl P Ar pcbaddr
64 .Nm
65 .Op Fl i
66 .Op Fl I Ar Interface
67 .Op Fl p Ar protocol
68 .Nm
69 .Op Fl is
70 .Op Fl f Ar address_family
71 .Op Fl I Ar Interface
72 .Nm
73 .Op Fl s
74 .Op Fl I Ar Interface
75 .Fl B
76 .Sh DESCRIPTION
77 The
78 .Nm
79 command symbolically displays the contents of various network-related
80 data structures.
81 There are a number of output formats,
82 depending on the options for the information presented.
83 The first form of the command displays a list of active sockets for
84 each protocol.
85 The second form presents the contents of one of the other network
86 data structures according to the option selected.
87 Using the third form, with a
88 .Ar wait
89 interval specified,
90 .Nm
91 will continuously display the information regarding packet
92 traffic on the configured network interfaces.
93 The fourth form displays statistics about the named protocol.
94 The fifth and sixth forms display per interface statistics for
95 the specified protocol or address family.
96 .Pp
97 The options have the following meaning:
98 .Bl -tag -width flag
99 .It Fl A
100 With the default display,
101 show the address of any protocol control blocks associated with sockets; used
102 for debugging.
103 .It Fl a
104 With the default display,
105 show the state of all sockets; normally sockets used by
106 server processes are not shown.
107 .It Fl B
108 With the default display,
109 show the current
110 .Xr bpf 4
111 peers.
112 To show only the peers listening to a specific interface,
113 use the
114 .Fl I
115 option.
116 If the
117 .Fl s
118 option is present, show the current
119 .Xr bpf 4
120 statistics.
121 .It Fl b
122 With the interface display (option
123 .Fl i ) ,
124 show bytes in and out, instead of packets in and out.
125 .It Fl d
126 With either interface display (option
127 .Fl i
128 or an interval, as described below),
129 show the number of dropped packets.
130 .It Fl f Ar address_family
131 Limit statistics or address control block reports to those
132 of the specified
133 .Ar address_family .
134 The following address families
135 are recognized:
136 .Ar inet ,
137 for
138 .Dv AF_INET ;
139 .Ar inet6 ,
140 for
141 .Dv AF_INET6 ;
142 .Ar arp ,
143 for
144 .Dv AF_ARP ;
145 .Ar ns ,
146 for
147 .Dv AF_NS ;
148 .Ar iso ,
149 for
150 .Dv AF_ISO ;
151 .Ar atalk ,
152 for
153 .Dv AF_APPLETALK ;
154 and
155 .Ar local
156 or
157 .Ar unix ,
158 for
159 .Dv AF_LOCAL .
160 .It Fl g
161 Show information related to multicast (group address) routing.
162 By default, show the IP Multicast virtual-interface and routing tables.
163 If the
164 .Fl s
165 option is also present, show multicast routing statistics.
166 .It Fl I Ar interface
167 Show information about the specified interface;
168 used with a
169 .Ar wait
170 interval as described below.
171 If the
172 .Fl f Ar address_family
173 option (with the
174 .Fl s
175 option) or the
176 .Fl p Ar protocol
177 option is present, show per-interface statistics on the
178 .Ar interface
179 for the specified
180 .Ar address_family
181 or
182 .Ar protocol ,
183 respectively.
184 .It Fl i
185 Show the state of interfaces which have been auto-configured
186 (interfaces statically configured into a system, but not
187 located at boot time are not shown).
188 If the
189 .Fl a
190 options is also present, multicast addresses currently in use are shown
191 for each Ethernet interface and for each IP interface address.
192 Multicast addresses are shown on separate lines following the interface
193 address with which they are associated.
194 If the
195 .Fl f Ar address_family
196 option (with the
197 .Fl s
198 option) or the
199 .Fl p Ar protocol
200 option is present, show per-interface statistics on all interfaces
201 for the specified
202 .Ar address_family
203 or
204 .Ar protocol ,
205 respectively.
206 .It Fl L
207 Don't show link-level routes (e.g., IPv4 ARP or IPv6 neighbour cache).
208 .It Fl M
209 Extract values associated with the name list from the specified core
210 instead of the default
211 .Pa /dev/kmem .
212 .It Fl m
213 Show statistics recorded by the memory management routines
214 (the network manages a private pool of memory buffers).
215 .It Fl N
216 Extract the name list from the specified system instead of the default
217 .Pa /netbsd .
218 .It Fl n
219 Show network addresses and ports as numbers (normally
220 .Nm
221 interprets addresses and ports and attempts to display them
222 symbolically).
223 This option may be used with any of the display formats.
224 .It Fl P Ar pcbaddr
225 Dump the contents of the protocol control block (PCB) located at kernel
226 virtual address
227 .Ar pcbaddr .
228 This address may be obtained using the
229 .Fl A
230 flag.
231 The default protocol is TCP, but may be overridden using the
232 .Fl p
233 flag.
234 .It Fl p Ar protocol
235 Show statistics about
236 .Ar protocol ,
237 which is either a well-known name for a protocol or an alias for it.
238 Some protocol names and aliases are listed in the file
239 .Pa /etc/protocols .
240 A null response typically means that there are no interesting numbers to
241 report.
242 The program will complain if
243 .Ar protocol
244 is unknown or if there is no statistics routine for it.
245 .It Fl q
246 Show software interrupt queue setting/statistics for all protocols.
247 .It Fl r
248 Show the routing tables.
249 When
250 .Fl s
251 is also present, show routing statistics instead.
252 .It Fl S
253 Show network addresses as numbers (as with
254 .Fl n ,
255 but show ports symbolically).
256 .It Fl s
257 Show per-protocol statistics.
258 If this option is repeated, counters with a value of zero are suppressed.
259 .It Fl v
260 Show extra (verbose) detail for the routing tables
261 .Pq Fl r ,
262 or avoid truncation of long addresses.
263 .It Fl w Ar wait
264 Show network interface statistics at intervals of
265 .Ar wait
266 seconds.
267 .It Fl X
268 Force use of
269 .Xr sysctl 3
270 when retrieving information.
271 Some features of
272 .Nm
273 may not be (fully) supported when using
274 .Xr sysctl 3 .
275 This flag forces the use of the latter regardless, and emits a message if a
276 not yet fully supported feature is used in conjunction with it.
277 This flag might be removed at any time; do not rely on its presence.
278 .El
279 .Pp
280 The default display, for active sockets, shows the local
281 and remote addresses, send and receive queue sizes (in bytes), protocol,
282 and the internal state of the protocol.
283 Address formats are of the form ``host.port'' or ``network.port''
284 if a socket's address specifies a network but no specific host address.
285 When known the host and network addresses are displayed symbolically
286 according to the data bases
287 .Pa /etc/hosts
288 and
289 .Pa /etc/networks ,
290 respectively.
291 If a symbolic name for an address is unknown, or if
292 the
293 .Fl n
294 option is specified, the address is printed numerically, according
295 to the address family.
296 For more information regarding
297 the Internet ``dot format,''
298 refer to
299 .Xr inet 3 ) .
300 Unspecified,
301 or ``wildcard'', addresses and ports appear as ``*''.
302 You can use the
303 .Xr fstat 1
304 command to find out which process or processes hold references to a socket.
305 .Pp
306 The interface display provides a table of cumulative
307 statistics regarding packets transferred, errors, and collisions.
308 The network addresses of the interface
309 and the maximum transmission unit (``mtu'') are also displayed.
310 .Pp
311 The routing table display indicates the available routes and
312 their status.
313 Each route consists of a destination host or network
314 and a gateway to use in forwarding packets.
315 The flags field shows
316 a collection of information about the route stored as
317 binary choices.
318 The individual flags are discussed in more
319 detail in the
320 .Xr route 8
321 and
322 .Xr route 4
323 manual pages.
324 The mapping between letters and flags is:
325 .Bl -column XXXX RTF_BLACKHOLE
326 .It 1 RTF_PROTO1 Protocol specific routing flag #1
327 .It 2 RTF_PROTO2 Protocol specific routing flag #2
328 .It B RTF_BLACKHOLE Just discard pkts (during updates)
329 .It C RTF_CLONING Generate new routes on use
330 .It c RTF_CLONED Cloned routes (generated from RTF_CLONING)
331 .It D RTF_DYNAMIC Created dynamically (by redirect)
332 .It G RTF_GATEWAY Destination requires forwarding by intermediary
333 .It H RTF_HOST Host entry (net otherwise)
334 .It L RTF_LLINFO Valid protocol to link address translation.
335 .It M RTF_MODIFIED Modified dynamically (by redirect)
336 .It R RTF_REJECT Host or net unreachable
337 .It S RTF_STATIC Manually added
338 .It U RTF_UP Route usable
339 .It X RTF_XRESOLVE External daemon translates proto to link address
340 .El
341 .Pp
342 Direct routes are created for each
343 interface attached to the local host;
344 the gateway field for such entries shows the address of the outgoing interface.
345 The refcnt field gives the
346 current number of active uses of the route.
347 Connection oriented
348 protocols normally hold on to a single route for the duration of
349 a connection while connectionless protocols obtain a route while sending
350 to the same destination.
351 The use field provides a count of the number of packets
352 sent using that route.
353 The mtu entry shows the mtu associated with
354 that route.
355 This mtu value is used as the basis for the TCP maximum
356 segment size.
357 The 'L' flag appended to the mtu value indicates that
358 the value is locked, and that path mtu discovery is turned off for
359 that route.
360 A
361 .Sq -
362 indicates that the mtu for this route has not been set, and a default
363 TCP maximum segment size will be used.
364 The interface entry indicates
365 the network interface used for the route.
366 .Pp
367 When
368 .Nm
369 is invoked with the
370 .Fl w
371 option and a
372 .Ar wait
373 interval argument, it displays a running count of statistics related to
374 network interfaces.
375 An obsolescent version of this option used a numeric parameter
376 with no option, and is currently supported for backward compatibility.
377 This display consists of a column for the primary interface (the first
378 interface found during autoconfiguration) and a column summarizing
379 information for all interfaces.
380 The primary interface may be replaced with another interface with the
381 .Fl I
382 option.
383 The first line of each screen of information contains a summary since the
384 system was last rebooted.
385 Subsequent lines of output show values
386 accumulated over the preceding interval.
387 .Pp
388 The first character of the flags column in the
389 .Fl B
390 option shows the status of the
391 .Xr bpf 4
392 descriptor which has three different values:
393 Idle ('I'), Waiting ('W') and Timed Out ('T').
394 The second character indicates whether the promisc flag is set.
395 The third character indicates the status of the immediate mode.
396 The fourth character indicates whether the peer will have the ability
397 to see the packets sent.
398 And the fifth character shows the header complete flag status.
399 .Sh SEE ALSO
400 .Xr fstat 1 ,
401 .Xr nfsstat 1 ,
402 .Xr ps 1 ,
403 .Xr sockstat 1 ,
404 .Xr vmstat 1 ,
405 .Xr inet 3 ,
406 .Xr bpf 4 ,
407 .Xr hosts 5 ,
408 .Xr networks 5 ,
409 .Xr protocols 5 ,
410 .Xr services 5 ,
411 .Xr iostat 8 ,
412 .Xr trpt 8
413 .Sh HISTORY
414 The
415 .Nm
416 command appeared in
417 .Bx 4.2 .
418 IPv6 support was added by WIDE/KAME project.
419 .\" .Sh FILES
420 .\" .Bl -tag -width /dev/kmem -compact
421 .\" .It Pa /netbsd
422 .\" default kernel namelist
423 .\" .It Pa /dev/kmem
424 .\" default memory file
425 .\" .El
426 .Sh BUGS
427 The notion of errors is ill-defined.