1 .\" Copyright (c) 1983, 1990, 1992, 1993
2 .\" The Regents of the University of California. All rights reserved.
4 .\" Redistribution and use in source and binary forms, with or without
5 .\" modification, are permitted provided that the following conditions
7 .\" 1. Redistributions of source code must retain the above copyright
8 .\" notice, this list of conditions and the following disclaimer.
9 .\" 2. Redistributions in binary form must reproduce the above copyright
10 .\" notice, this list of conditions and the following disclaimer in the
11 .\" documentation and/or other materials provided with the distribution.
12 .\" 4. Neither the name of the University nor the names of its contributors
13 .\" may be used to endorse or promote products derived from this software
14 .\" without specific prior written permission.
16 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
17 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
18 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
19 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
20 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
21 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
22 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
23 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
24 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
25 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 .\" @(#)netstat.1 8.8 (Berkeley) 4/18/94
36 .Nd show network status and statistics
39 .Bl -tag -width "netstat"
42 .Op Fl f Ar protocol_family | Fl p Ar protocol
45 .It Nm Fl i | I Ar interface
47 .Op Fl f Ar address_family
58 .Op Fl f Ar protocol_family | Fl p Ar protocol
61 .It Nm Fl i | I Ar interface Fl s
63 .Op Fl f Ar protocol_family | Fl p Ar protocol
75 .Op Fl f Ar address_family
84 .Op Fl f Ar address_family
89 .Op Fl f Ar address_family
98 command symbolically displays the contents of various network-related
100 There are a number of output formats,
101 depending on the options for the information presented.
102 .Bl -tag -width indent
107 .Op Fl f Ar protocol_family | Fl p Ar protocol
112 Display a list of active sockets
113 (protocol control blocks)
114 for each network protocol.
116 The default display for active sockets shows the local
117 and remote addresses, send and receive queue sizes (in bytes), protocol,
118 and the internal state of the protocol.
119 Address formats are of the form
123 if a socket's address specifies a network but no specific host address.
124 When known, the host and network addresses are displayed symbolically
125 according to the databases
130 If a symbolic name for an address is unknown, or if
133 option is specified, the address is printed numerically, according
134 to the address family.
135 For more information regarding
143 addresses and ports appear as
145 .Bl -tag -width indent
149 .Sx GENERAL OPTIONS .
153 .Sx GENERAL OPTIONS .
155 Show the address of a protocol control block (PCB)
156 associated with a socket; used for debugging.
158 Show the state of all sockets;
159 normally sockets used by server processes are not shown.
161 Show the size of the various listen queues.
162 The first count shows the number of unaccepted connections,
163 the second count shows the amount of unaccepted incomplete connections,
164 and the third count is the maximum number of queued connections.
166 Do not resolve numeric addresses and port numbers to names.
168 .Sx GENERAL OPTIONS .
170 Display the flowid and flowtype for each socket.
171 flowid is a 32 bit hardware specific identifier for each flow.
172 flowtype defines which protocol fields are hashed to produce the id.
173 A complete listing is available in
178 Show network addresses as numbers (as with
180 but show ports symbolically.
182 Display diagnostic information from the TCP control block.
183 Fields include the number of packets requiring retransmission,
184 received out-of-order, and those advertising a zero-sized window.
186 Avoid truncating addresses even if this causes some fields to overflow.
188 Display socket buffer and TCP timer statistics for each
195 to output all the information recorded about data
196 stored in the socket buffers.
198 .Bl -column ".Li R-MBUF"
199 .It Li R-MBUF Ta Number of mbufs in the receive queue.
200 .It Li S-MBUF Ta Number of mbufs in the send queue.
201 .It Li R-CLUS Ta Number of clusters, of any type, in the receive
203 .It Li S-CLUS Ta Number of clusters, of any type, in the send queue.
204 .It Li R-HIWA Ta Receive buffer high water mark, in bytes.
205 .It Li S-HIWA Ta Send buffer high water mark, in bytes.
206 .It Li R-LOWA Ta Receive buffer low water mark, in bytes.
207 .It Li S-LOWA Ta Send buffer low water mark, in bytes.
208 .It Li R-BCNT Ta Receive buffer byte count.
209 .It Li S-BCNT Ta Send buffer byte count.
210 .It Li R-BMAX Ta Maximum bytes that can be used in the receive buffer.
211 .It Li S-BMAX Ta Maximum bytes that can be used in the send buffer.
213 .It Fl f Ar protocol_family
215 .Ar protocol_family .
217 .Sx GENERAL OPTIONS .
222 .Sx GENERAL OPTIONS .
224 Use an alternative core.
226 .Sx GENERAL OPTIONS .
228 Use an alternative kernel image.
230 .Sx GENERAL OPTIONS .
235 .Fl i | I Ar interface
237 .Op Fl f Ar address_family
242 Show the state of all network interfaces or a single
244 which have been auto-configured
245 (interfaces statically configured into a system, but not
246 located at boot time are not shown).
249 after an interface name indicates that the interface is
259 it provides a table of cumulative
260 statistics regarding packets transferred, errors, and collisions.
261 The network addresses of the interface
262 and the maximum transmission unit
265 .Bl -tag -width indent
269 .Sx GENERAL OPTIONS .
273 .Sx GENERAL OPTIONS .
275 Multicast addresses currently in use are shown
276 for each Ethernet interface and for each IP interface address.
277 Multicast addresses are shown on separate lines following the interface
278 address with which they are associated.
280 Show the number of bytes in and out.
282 Show the number of dropped packets.
284 Print all counters in human readable form.
286 Do not resolve numeric addresses and port numbers to names.
288 .Sx GENERAL OPTIONS .
290 Avoid truncating interface names even if this causes some fields to overflow.
291 .Sx GENERAL OPTIONS .
292 .It Fl f Ar protocol_family
294 .Ar protocol_family .
296 .Sx GENERAL OPTIONS .
302 .Op Fl I Ar interface
311 seconds, display the information regarding packet traffic on all
312 configured network interfaces or a single
321 interval argument, it displays a running count of statistics related to
323 An obsolescent version of this option used a numeric parameter
324 with no option, and is currently supported for backward compatibility.
325 By default, this display summarizes information for all interfaces.
326 Information for a specific interface may be displayed with the
329 .Bl -tag -width indent
330 .It Fl I Ar interface
331 Only show information regarding
336 .Sx GENERAL OPTIONS .
340 .Sx GENERAL OPTIONS .
342 Show the number of dropped packets.
344 Use an alternative core.
346 .Sx GENERAL OPTIONS .
348 Use an alternative kernel image.
350 .Sx GENERAL OPTIONS .
361 .Op Fl f Ar protocol_family | Fl p Ar protocol
366 Display system-wide statistics for each network protocol.
367 .Bl -tag -width indent
371 .Sx GENERAL OPTIONS .
375 .Sx GENERAL OPTIONS .
379 is repeated, counters with a value of zero are suppressed.
381 Reset statistic counters after displaying them.
382 .It Fl f Ar protocol_family
384 .Ar protocol_family .
386 .Sx GENERAL OPTIONS .
391 .Sx GENERAL OPTIONS .
393 Use an alternative core.
395 .Sx GENERAL OPTIONS .
397 Use an alternative kernel image
399 .Sx GENERAL OPTIONS .
404 .Fl i | I Ar interface Fl s
406 .Op Fl f Ar protocol_family | Fl p Ar protocol
411 Display per-interface statistics for each network protocol.
412 .Bl -tag -width indent
416 .Sx GENERAL OPTIONS .
420 .Sx GENERAL OPTIONS .
424 is repeated, counters with a value of zero are suppressed.
425 .It Fl f Ar protocol_family
427 .Ar protocol_family .
429 .Sx GENERAL OPTIONS .
434 .Sx GENERAL OPTIONS .
436 Use an alternative core
438 .Sx GENERAL OPTIONS .
440 Use an alternative kernel image
442 .Sx GENERAL OPTIONS .
452 Show statistics recorded by the memory management routines
454 The network manages a private pool of memory buffers.
455 .Bl -tag -width indent
457 Use an alternative core
459 .Sx GENERAL OPTIONS .
461 Use an alternative kernel image
463 .Sx GENERAL OPTIONS .
470 .Op Fl I Ar interface
473 Show statistics about
476 This includes information like
477 how many packets have been matched, dropped and received by the
478 bpf device, also information about current buffer sizes and device
487 option represent the underlying parameters of the bpf peer.
489 represented as a single lower case letter.
490 The mapping between the letters and flags in order of appearance are:
492 .It Li p Ta Set if listening promiscuously
493 .It Li i Ta Dv BIOCIMMEDIATE No has been set on the device
494 .It Li f Ta Dv BIOCGHDRCMPLT No status: source link addresses are being
496 .It Li s Ta Dv BIOCGSEESENT No status: see packets originating locally and
497 remotely on the interface.
498 .It Li a Ta Packet reception generates a signal
499 .It Li l Ta Dv BIOCLOCK No status: descriptor has been locked
502 For more information about these flags, please refer to
504 .Bl -tag -width indent
506 Reset statistic counters after displaying them.
514 .Op Fl f Ar address_family
519 Display the contents of routing tables.
523 is invoked with the routing table option
525 it lists the available routes and their status.
526 Each route consists of a destination host or network, and a gateway to use
527 in forwarding packets.
528 The flags field shows a collection of information about the route stored
530 The individual flags are discussed in more detail in the
535 The mapping between letters and flags is:
536 .Bl -column ".Li W" ".Dv RTF_WASCLONED"
537 .It Li 1 Ta Dv RTF_PROTO1 Ta "Protocol specific routing flag #1"
538 .It Li 2 Ta Dv RTF_PROTO2 Ta "Protocol specific routing flag #2"
539 .It Li 3 Ta Dv RTF_PROTO3 Ta "Protocol specific routing flag #3"
540 .It Li B Ta Dv RTF_BLACKHOLE Ta "Just discard pkts (during updates)"
541 .It Li b Ta Dv RTF_BROADCAST Ta "The route represents a broadcast address"
542 .It Li D Ta Dv RTF_DYNAMIC Ta "Created dynamically (by redirect)"
543 .It Li G Ta Dv RTF_GATEWAY Ta "Destination requires forwarding by intermediary"
544 .It Li H Ta Dv RTF_HOST Ta "Host entry (net otherwise)"
545 .It Li L Ta Dv RTF_LLINFO Ta "Valid protocol to link address translation"
546 .It Li M Ta Dv RTF_MODIFIED Ta "Modified dynamically (by redirect)"
547 .It Li R Ta Dv RTF_REJECT Ta "Host or net unreachable"
548 .It Li S Ta Dv RTF_STATIC Ta "Manually added"
549 .It Li U Ta Dv RTF_UP Ta "Route usable"
550 .It Li X Ta Dv RTF_XRESOLVE Ta "External daemon translates proto to link address"
553 Direct routes are created for each
554 interface attached to the local host;
555 the gateway field for such entries shows the address of the outgoing interface.
556 The refcnt field gives the
557 current number of active uses of the route.
559 protocols normally hold on to a single route for the duration of
560 a connection while connectionless protocols obtain a route while sending
561 to the same destination.
562 The use field provides a count of the number of packets
563 sent using that route.
564 The interface entry indicates the network interface utilized for the route.
565 .Bl -tag -width indent
569 .Sx GENERAL OPTIONS .
573 .Sx GENERAL OPTIONS .
575 Show the contents of the internal Patricia tree
576 structures; used for debugging.
578 Do not resolve numeric addresses and port numbers to names.
580 .Sx GENERAL OPTIONS .
582 Show the path MTU for each route, and print interface names with a
585 Display the routing table with the number
592 the default routing table is displayed.
594 Display the routing table for a particular
597 Use an alternative core
599 .Sx GENERAL OPTIONS .
601 Use an alternative kernel image
603 .Sx GENERAL OPTIONS .
614 Display routing statistics.
615 .Bl -tag -width indent
619 is repeated, counters with a value of zero are suppressed.
621 Use an alternative core
623 .Sx GENERAL OPTIONS .
625 Use an alternative kernel image
627 .Sx GENERAL OPTIONS .
634 .Op Fl f Ar address_family
639 Display the contents of the multicast virtual interface tables,
640 and multicast forwarding caches.
641 Entries in these tables will appear only when the kernel is
642 actively forwarding multicast sessions.
643 This option is applicable only to the
648 .Bl -tag -width indent
652 .Sx GENERAL OPTIONS .
656 .Sx GENERAL OPTIONS .
658 Avoid truncating addresses even if this causes some fields to overflow.
659 .It Fl f Ar protocol_family
661 .Ar protocol_family .
663 .Sx GENERAL OPTIONS .
665 Use an alternative core
667 .Sx GENERAL OPTIONS .
669 Use an alternative kernel image
671 .Sx GENERAL OPTIONS .
678 .Op Fl f Ar address_family
683 Show multicast routing statistics.
684 .Bl -tag -width indent
688 .Sx GENERAL OPTIONS .
692 .Sx GENERAL OPTIONS .
696 is repeated, counters with a value of zero are suppressed.
697 .It Fl f Ar protocol_family
699 .Ar protocol_family .
701 .Sx GENERAL OPTIONS .
703 Use an alternative core
705 .Sx GENERAL OPTIONS .
707 Use an alternative kernel image
709 .Sx GENERAL OPTIONS .
720 The flags field shows available ISR handlers:
721 .Bl -column ".Li W" ".Dv NETISR_SNP_FLAGS_DRAINEDCPU"
722 .It Li C Ta Dv NETISR_SNP_FLAGS_M2CPUID Ta "Able to map mbuf to cpu id"
723 .It Li D Ta Dv NETISR_SNP_FLAGS_DRAINEDCPU Ta "Has queue drain handler"
724 .It Li F Ta Dv NETISR_SNP_FLAGS_M2FLOW Ta "Able to map mbuf to flow id"
729 Some options have the general meaning:
741 .It Fl f Ar address_family , Fl p Ar protocol
742 Limit display to those records
747 The following address families and protocols are recognized:
749 .Bl -tag -width ".Cm netgraph , ng Pq Dv AF_NETGRAPH" -compact
752 .It Cm inet Pq Dv AF_INET
753 .Cm divert , icmp , igmp , ip , ipsec , pim, sctp , tcp , udp
754 .It Cm inet6 Pq Dv AF_INET6
755 .Cm icmp6 , ip6 , ipsec6 , rip6 , tcp , udp
756 .It Cm pfkey Pq Dv PF_KEY
758 .It Cm netgraph , ng Pq Dv AF_NETGRAPH
760 .It Cm unix Pq Dv AF_UNIX
761 .It Cm link Pq Dv AF_LINK
764 The program will complain if
766 is unknown or if there is no statistics routine for it.
768 Extract values associated with the name list from the specified core
769 instead of the default
772 Extract the name list from the specified system instead of the default,
773 which is the kernel image the system has booted from.
775 Show network addresses and ports as numbers.
778 attempts to resolve addresses and ports,
779 and display them symbolically.
806 IPv6 support was added by WIDE/KAME project.
808 The notion of errors is ill-defined.