1 .\" Copyright (c) 1983, 1990, 1992, 1993
2 .\" The Regents of the University of California. All rights reserved.
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, are permitted provided that the following conditions
7 .\" 1. Redistributions of source code must retain the above copyright
8 .\" notice, this list of conditions and the following disclaimer.
9 .\" 2. Redistributions in binary form must reproduce the above copyright
10 .\" notice, this list of conditions and the following disclaimer in the
11 .\" documentation and/or other materials provided with the distribution.
12 .\" 3. Neither the name of the University nor the names of its contributors
13 .\" may be used to endorse or promote products derived from this software
14 .\" without specific prior written permission.
16 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
17 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
20 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 .\" @(#)netstat.1 8.8 (Berkeley) 4/18/94
31 .Dd September 13, 2020
36 .Nd show network status and statistics
39 .Bl -tag -width "netstat"
43 .Op Fl f Ar protocol_family | Fl p Ar protocol
46 .It Nm Fl i | I Ar interface
49 .Op Fl f Ar address_family
62 .Op Fl f Ar protocol_family | Fl p Ar protocol
65 .It Nm Fl i | I Ar interface Fl s
68 .Op Fl f Ar protocol_family | Fl p Ar protocol
83 .Op Fl f Ar address_family
92 .Op Fl f Ar address_family
96 .Op Fl f Ar address_family
106 command symbolically displays the contents of various network-related
108 There are a number of output formats,
109 depending on the options for the information presented.
110 .Bl -tag -width indent
115 .Op Fl f Ar protocol_family | Fl p Ar protocol
120 Display a list of active sockets
121 (protocol control blocks)
122 for each network protocol.
124 The default display for active sockets shows the local
125 and remote addresses, send and receive queue sizes (in bytes), protocol,
126 and the internal state of the protocol.
127 Address formats are of the form
131 if a socket's address specifies a network but no specific host address.
132 When known, the host and network addresses are displayed symbolically
133 according to the databases
138 If a symbolic name for an address is unknown, or if
141 option is specified, the address is printed numerically, according
142 to the address family.
143 For more information regarding
151 addresses and ports appear as
153 .Bl -tag -width indent
157 in a selection of different human and machine readable formats.
160 for details on command line arguments.
164 .Sx GENERAL OPTIONS .
168 .Sx GENERAL OPTIONS .
170 Show the address of a protocol control block (PCB)
171 associated with a socket; used for debugging.
173 Show the state of all sockets;
174 normally sockets used by server processes are not shown.
176 Show the congestion control of TCP sockets.
178 Show the size of the various listen queues.
179 The first count shows the number of unaccepted connections,
180 the second count shows the amount of unaccepted incomplete connections,
181 and the third count is the maximum number of queued connections.
183 Do not resolve numeric addresses and port numbers to names.
185 .Sx GENERAL OPTIONS .
187 Display the log ID for each socket.
189 Display the flowid and flowtype for each socket.
190 flowid is a 32 bit hardware specific identifier for each flow.
191 flowtype defines which protocol fields are hashed to produce the id.
192 A complete listing is available in
197 Show network addresses as numbers (as with
199 but show ports symbolically.
201 Display diagnostic information from the TCP control block.
202 Fields include the number of packets requiring retransmission,
203 received out-of-order, and those advertising a zero-sized window.
205 Avoid truncating addresses even if this causes some fields to overflow.
207 Display socket buffer and TCP timer statistics for each
214 to output all the information recorded about data
215 stored in the socket buffers.
217 .Bl -column ".Li R-MBUF"
218 .It Li R-MBUF Ta Number of mbufs in the receive queue.
219 .It Li S-MBUF Ta Number of mbufs in the send queue.
220 .It Li R-CLUS Ta Number of clusters, of any type, in the receive
222 .It Li S-CLUS Ta Number of clusters, of any type, in the send queue.
223 .It Li R-HIWA Ta Receive buffer high water mark, in bytes.
224 .It Li S-HIWA Ta Send buffer high water mark, in bytes.
225 .It Li R-LOWA Ta Receive buffer low water mark, in bytes.
226 .It Li S-LOWA Ta Send buffer low water mark, in bytes.
227 .It Li R-BCNT Ta Receive buffer byte count.
228 .It Li S-BCNT Ta Send buffer byte count.
229 .It Li R-BMAX Ta Maximum bytes that can be used in the receive buffer.
230 .It Li S-BMAX Ta Maximum bytes that can be used in the send buffer.
231 .It Li rexmt Ta Time, in seconds, to fire Retransmit Timer, or 0 if not armed.
232 .It Li persist Ta Time, in seconds, to fire Retransmit Persistence, or 0 if not armed.
233 .It Li keep Ta Time, in seconds, to fire Keep Alive, or 0 if not armed.
234 .It Li 2msl Ta Time, in seconds, to fire 2*msl TIME_WAIT Timer, or 0 if not armed.
235 .It Li delack Ta Time, in seconds, to fire Delayed ACK Timer, or 0 if not armed.
236 .It Li rcvtime Ta Time, in seconds, since last packet received.
238 .It Fl f Ar protocol_family
240 .Ar protocol_family .
242 .Sx GENERAL OPTIONS .
247 .Sx GENERAL OPTIONS .
249 Use an alternative core.
251 .Sx GENERAL OPTIONS .
253 Use an alternative kernel image.
255 .Sx GENERAL OPTIONS .
260 .Fl i | I Ar interface
262 .Op Fl f Ar address_family
267 Show the state of all network interfaces or a single
269 which have been auto-configured
270 (interfaces statically configured into a system, but not
271 located at boot time are not shown).
274 after an interface name indicates that the interface is
284 it provides a table of cumulative
285 statistics regarding packets transferred, errors, and collisions.
286 The network addresses of the interface
287 and the maximum transmission unit
290 .Bl -tag -width indent
294 .Sx GENERAL OPTIONS .
298 .Sx GENERAL OPTIONS .
300 Multicast addresses currently in use are shown
301 for each Ethernet interface and for each IP interface address.
302 Multicast addresses are shown on separate lines following the interface
303 address with which they are associated.
305 Show the number of bytes in and out.
307 Show the number of dropped packets.
309 Print all counters in human readable form.
311 Do not resolve numeric addresses and port numbers to names.
313 .Sx GENERAL OPTIONS .
315 Avoid truncating interface names even if this causes some fields to overflow.
316 .Sx GENERAL OPTIONS .
317 .It Fl f Ar protocol_family
319 .Ar protocol_family .
321 .Sx GENERAL OPTIONS .
327 .Op Fl I Ar interface
336 seconds, display the information regarding packet traffic on all
337 configured network interfaces or a single
346 interval argument, it displays a running count of statistics related to
348 An obsolescent version of this option used a numeric parameter
349 with no option, and is currently supported for backward compatibility.
350 By default, this display summarizes information for all interfaces.
351 Information for a specific interface may be displayed with the
354 .Bl -tag -width indent
355 .It Fl I Ar interface
356 Only show information regarding
361 .Sx GENERAL OPTIONS .
365 .Sx GENERAL OPTIONS .
367 Show the number of dropped packets.
369 Use an alternative core.
371 .Sx GENERAL OPTIONS .
373 Use an alternative kernel image.
375 .Sx GENERAL OPTIONS .
386 .Op Fl f Ar protocol_family | Fl p Ar protocol
391 Display system-wide statistics for each network protocol.
392 .Bl -tag -width indent
396 .Sx GENERAL OPTIONS .
400 .Sx GENERAL OPTIONS .
404 is repeated, counters with a value of zero are suppressed.
406 Reset statistic counters after displaying them.
407 .It Fl f Ar protocol_family
409 .Ar protocol_family .
411 .Sx GENERAL OPTIONS .
416 .Sx GENERAL OPTIONS .
418 Use an alternative core.
420 .Sx GENERAL OPTIONS .
422 Use an alternative kernel image
424 .Sx GENERAL OPTIONS .
429 .Fl i | I Ar interface Fl s
431 .Op Fl f Ar protocol_family | Fl p Ar protocol
436 Display per-interface statistics for each network protocol.
437 .Bl -tag -width indent
441 .Sx GENERAL OPTIONS .
445 .Sx GENERAL OPTIONS .
449 is repeated, counters with a value of zero are suppressed.
450 .It Fl f Ar protocol_family
452 .Ar protocol_family .
454 .Sx GENERAL OPTIONS .
459 .Sx GENERAL OPTIONS .
461 Use an alternative core
463 .Sx GENERAL OPTIONS .
465 Use an alternative kernel image
467 .Sx GENERAL OPTIONS .
477 Show statistics recorded by the memory management routines
479 The network manages a private pool of memory buffers.
480 .Bl -tag -width indent
482 Use an alternative core
484 .Sx GENERAL OPTIONS .
486 Use an alternative kernel image
488 .Sx GENERAL OPTIONS .
495 .Op Fl I Ar interface
498 Show statistics about
501 This includes information like
502 how many packets have been matched, dropped and received by the
503 bpf device, also information about current buffer sizes and device
512 option represent the underlying parameters of the bpf peer.
514 represented as a single lower case letter.
515 The mapping between the letters and flags in order of appearance are:
517 .It Li p Ta Set if listening promiscuously
518 .It Li i Ta Dv BIOCIMMEDIATE No has been set on the device
519 .It Li f Ta Dv BIOCGHDRCMPLT No status: source link addresses are being
521 .It Li s Ta Dv BIOCGSEESENT No status: see packets originating locally and
522 remotely on the interface.
523 .It Li a Ta Packet reception generates a signal
524 .It Li l Ta Dv BIOCLOCK No status: descriptor has been locked
527 For more information about these flags, please refer to
529 .Bl -tag -width indent
531 Reset statistic counters after displaying them.
539 .Op Fl f Ar address_family
544 Display the contents of routing tables.
548 is invoked with the routing table option
550 it lists the available routes and their status.
551 Each route consists of a destination host or network, and a gateway to use
552 in forwarding packets.
553 The flags field shows a collection of information about the route stored
555 The individual flags are discussed in more detail in the
560 The mapping between letters and flags is:
561 .Bl -column ".Li W" ".Dv RTF_WASCLONED"
562 .It Li 1 Ta Dv RTF_PROTO1 Ta "Protocol specific routing flag #1"
563 .It Li 2 Ta Dv RTF_PROTO2 Ta "Protocol specific routing flag #2"
564 .It Li 3 Ta Dv RTF_PROTO3 Ta "Protocol specific routing flag #3"
565 .It Li B Ta Dv RTF_BLACKHOLE Ta "Just discard pkts (during updates)"
566 .It Li b Ta Dv RTF_BROADCAST Ta "The route represents a broadcast address"
567 .It Li D Ta Dv RTF_DYNAMIC Ta "Created dynamically (by redirect)"
568 .It Li G Ta Dv RTF_GATEWAY Ta "Destination requires forwarding by intermediary"
569 .It Li H Ta Dv RTF_HOST Ta "Host entry (net otherwise)"
570 .It Li L Ta Dv RTF_LLINFO Ta "Valid protocol to link address translation"
571 .It Li M Ta Dv RTF_MODIFIED Ta "Modified dynamically (by redirect)"
572 .It Li R Ta Dv RTF_REJECT Ta "Host or net unreachable"
573 .It Li S Ta Dv RTF_STATIC Ta "Manually added"
574 .It Li U Ta Dv RTF_UP Ta "Route usable"
575 .It Li X Ta Dv RTF_XRESOLVE Ta "External daemon translates proto to link address"
578 Direct routes are created for each
579 interface attached to the local host;
580 the gateway field for such entries shows the address of the outgoing interface.
581 The refcnt field gives the
582 current number of active uses of the route.
584 protocols normally hold on to a single route for the duration of
585 a connection while connectionless protocols obtain a route while sending
586 to the same destination.
587 The use field provides a count of the number of packets
588 sent using that route.
589 The interface entry indicates the network interface utilized for the route.
590 .Bl -tag -width indent
594 .Sx GENERAL OPTIONS .
598 .Sx GENERAL OPTIONS .
600 Do not resolve numeric addresses and port numbers to names.
602 .Sx GENERAL OPTIONS .
604 Show the path MTU for each route, and print interface names with a
607 Display the routing table with the number
614 the default routing table is displayed.
616 Display the routing table for a particular
619 Use an alternative core
621 .Sx GENERAL OPTIONS .
623 Use an alternative kernel image
625 .Sx GENERAL OPTIONS .
636 Display routing statistics.
637 .Bl -tag -width indent
641 is repeated, counters with a value of zero are suppressed.
643 Use an alternative core
645 .Sx GENERAL OPTIONS .
647 Use an alternative kernel image
649 .Sx GENERAL OPTIONS .
656 .Op Fl f Ar address_family
661 Display the contents of the multicast virtual interface tables,
662 and multicast forwarding caches.
663 Entries in these tables will appear only when the kernel is
664 actively forwarding multicast sessions.
665 This option is applicable only to the
670 .Bl -tag -width indent
674 .Sx GENERAL OPTIONS .
678 .Sx GENERAL OPTIONS .
680 Avoid truncating addresses even if this causes some fields to overflow.
681 .It Fl f Ar protocol_family
683 .Ar protocol_family .
685 .Sx GENERAL OPTIONS .
687 Use an alternative core
689 .Sx GENERAL OPTIONS .
691 Use an alternative kernel image
693 .Sx GENERAL OPTIONS .
700 .Op Fl f Ar address_family
705 Show multicast routing statistics.
706 .Bl -tag -width indent
710 .Sx GENERAL OPTIONS .
714 .Sx GENERAL OPTIONS .
718 is repeated, counters with a value of zero are suppressed.
719 .It Fl f Ar protocol_family
721 .Ar protocol_family .
723 .Sx GENERAL OPTIONS .
725 Use an alternative core
727 .Sx GENERAL OPTIONS .
729 Use an alternative kernel image
731 .Sx GENERAL OPTIONS .
742 The flags field shows available ISR handlers:
743 .Bl -column ".Li W" ".Dv NETISR_SNP_FLAGS_DRAINEDCPU"
744 .It Li C Ta Dv NETISR_SNP_FLAGS_M2CPUID Ta "Able to map mbuf to cpu id"
745 .It Li D Ta Dv NETISR_SNP_FLAGS_DRAINEDCPU Ta "Has queue drain handler"
746 .It Li F Ta Dv NETISR_SNP_FLAGS_M2FLOW Ta "Able to map mbuf to flow id"
750 Some options have the general meaning:
762 .It Fl f Ar address_family , Fl p Ar protocol
763 Limit display to those records
768 The following address families and protocols are recognized:
770 .Bl -tag -width ".Cm netgraph , ng Pq Dv AF_NETGRAPH" -compact
773 .It Cm inet Pq Dv AF_INET
774 .Cm divert , icmp , igmp , ip , ipsec , pim, sctp , tcp , udp
775 .It Cm inet6 Pq Dv AF_INET6
776 .Cm icmp6 , ip6 , ipsec6 , rip6 , sctp , tcp , udp
777 .It Cm pfkey Pq Dv PF_KEY
779 .It Cm netgraph , ng Pq Dv AF_NETGRAPH
781 .It Cm unix Pq Dv AF_UNIX
782 .It Cm link Pq Dv AF_LINK
785 The program will complain if
787 is unknown or if there is no statistics routine for it.
789 Extract values associated with the name list from the specified core
790 instead of the default
793 Extract the name list from the specified system instead of the default,
794 which is the kernel image the system has booted from.
796 Show network addresses and ports as numbers.
799 attempts to resolve addresses and ports,
800 and display them symbolically.
803 Show packet traffic information (packets, bytes, errors, packet drops, etc) for
804 interface re0 updated every 2 seconds and exit after 5 outputs:
805 .Bd -literal -offset indent
806 $ netstat -w 2 -q 5 -I re0
809 Show statistics for ICMP on any interface:
810 .Bd -literal -offset indent
815 .Bd -literal -offset indent
819 Same as above, but without resolving numeric addresses and port numbers to
821 .Bd -literal -offset indent
831 .Xr xo_parse_args 3 ,
851 IPv6 support was added by WIDE/KAME project.
853 The notion of errors is ill-defined.
projects / FreeBSD / FreeBSD.git / blob