NETSTAT(1)                   UNIX Reference Manual                  NETSTAT(1)

NAME
     netstat - show network status

SYNOPSIS
     netstat [-Aan] [-f address_family] [-M core] [-N system]
     netstat [-bdghimnrs] [-f address_family] [-M core] [-N system]
     netstat [-bdn] [-I interface] [-M core] [-N system] [-w wait]
     netstat [-p protocol] [-M core] [-N system]

DESCRIPTION
     The netstat command symbolically displays the contents of various net-
     work-related data structures.  There are a number of output formats, de-
     pending on the options for the information presented.  The first form of
     the command displays a list of active sockets for each protocol.  The
     second form presents the contents of one of the other network data struc-
     tures according to the option selected.  Using the third form, with a
     wait interval specified, netstat will continuously display the informa-
     tion regarding packet traffic on the configured network interfaces.  The
     fourth form displays statistics about the named protocol.

     The options have the following meaning:

     -A    With the default display, show the address of any protocol control
           blocks associated with sockets; used for debugging.

     -a    With the default display, show the state of all sockets; normally
           sockets used by server processes are not shown.

     -b    With the interface display (option -i , as described below), show
           the number of bytes in and out.

     -d    With either interface display (option -i or an interval, as de-
           scribed below), show the number of dropped packets.

     -f address_family
           Limit statistics or address control block reports to those of the
           specified address family. The following address families are recog-
           nized: inet, for AF_INET, ipx, for AF_IPX, atalk, for AF_APPLETALK
           (ddp), and unix, for AF_UNIX.

     -g    Show information related to multicast (group address) routing.  By
           default, show the IP Multicast virtual-interface and routing ta-
           bles.  If the -s option is also present, show multicast routing
           statistics.

     -h    Show the state of the IMP host table (obsolete).

     -I interface
           Show information about the specified interface; used with a wait
           interval as described below.

     -i    Show the state of interfaces which have been auto-configured (in-
           terfaces statically configured into a system, but not located at
           boot time are not shown).  If the -a options is also present, mul-
           ticast addresses currently in use are shown for each Ethernet in-
           terface and for each IP interface address.  Multicast addresses are
           shown on separate lines following the interface address with which
           they are associated.

     -M    Extract values associated with the name list from the specified
           core instead of the default /dev/kmem.

     -m    Show statistics recorded by the memory management routines (the
           network manages a private pool of memory buffers).

     -N    Extract the name list from the specified system instead of the de-
           fault /kernel.

     -n    Show network addresses as numbers (normally netstat interprets ad-
           dresses and attempts to display them symbolically).  This option
           may be used with any of the display formats.

     -p protocol
           Show statistics about protocol, which is either a well-known name
           for a protocol or an alias for it.  Some protocol names and aliases
           are listed in the file /etc/protocols. The special protocol name
           ``bdg'' is used to show bridging statistics.  A null response typi-
           cally means that there are no interesting numbers to report.  The
           program will complain if protocol is unknown or if there is no
           statistics routine for it.

     -s    Show per-protocol statistics.  If this option is repeated, counters
           with a value of zero are suppressed.

     -r    Show the routing tables.  When -s is also present, show routing
           statistics instead.

     -w wait
           Show network interface statistics at intervals of wait seconds.

     The default display, for active sockets, shows the local and remote ad-
     dresses, send and receive queue sizes (in bytes), protocol, and the in-
     ternal state of the protocol.  Address formats are of the form
     ``host.port'' or ``network.port'' if a socket's address specifies a net-
     work but no specific host address.  When known the host and network ad-
     dresses are displayed symbolically according to the data bases /etc/hosts
     and /etc/networks, respectively.  If a symbolic name for an address is
     unknown, or if the -n option is specified, the address is printed numeri-
     cally, according to the address family.  For more information regarding
     the Internet ``dot format,'' refer to inet(3)).  Unspecified, or ``wild-
     card'', addresses and ports appear as ``*''.

     The interface display provides a table of cumulative statistics regarding
     packets transferred, errors, and collisions.  The network addresses of
     the interface and the maximum transmission unit (``mtu'') are also dis-
     played.

     The routing table display indicates the available routes and their sta-
     tus.  Each route consists of a destination host or network and a gateway
     to use in forwarding packets.  The flags field shows a collection of in-
     formation about the route stored as binary choices.  The individual flags
     are discussed in more detail in the route(8) and route(4) manual pages.
     The mapping between letters and flags is:

     1       RTF_PROTO1       Protocol specific routing flag #1
     2       RTF_PROTO2       Protocol specific routing flag #2
     3       RTF_PROTO3       Protocol specific routing flag #3
     B       RTF_BLACKHOLE    Just discard pkts (during updates)
     b       RTF_BROADCAST    The route represents a broadcast address
     C       RTF_CLONING      Generate new routes on use
     c       RTF_PRCLONING    Protocol-specified generate new routes on use
     D       RTF_DYNAMIC      Created dynamically (by redirect)
     G       RTF_GATEWAY      Destination requires forwarding by intermediary
     H       RTF_HOST         Host entry (net otherwise)
     L       RTF_LLINFO       Valid protocol to link address translation
     M       RTF_MODIFIED     Modified dynamically (by redirect)
     R       RTF_REJECT       Host or net unreachable
     S       RTF_STATIC       Manually added
     U       RTF_UP           Route usable
     W       RTF_WASCLONED    Route was generated as a result of cloning
     X       RTF_XRESOLVE     External daemon translates proto to link address

     Direct routes are created for each interface attached to the local host;
     the gateway field for such entries shows the address of the outgoing in-
     terface.  The refcnt field gives the current number of active uses of the
     route.  Connection oriented protocols normally hold on to a single route
     for the duration of a connection while connectionless protocols obtain a
     route while sending to the same destination.  The use field provides a
     count of the number of packets sent using that route.  The interface en-
     try indicates the network interface utilized for the route.

     When netstat is invoked with the -w option and a wait interval argument,
     it displays a running count of statistics related to network interfaces.
     An obsolescent version of this option used a numeric parameter with no
     option, and is currently supported for backward compatibility.  By de-
     fault, this display summarizes information for all interfaces.  Informa-
     tion for a specific interface may be displayed with the -I option.

SEE ALSO
     nfsstat(1),  ps(1),  hosts(5),  networks(5),  protocols(5),  services(5),
      iostat(8),  trpt(8),  vmstat(8)

HISTORY
     The netstat command appeared in 4.2BSD.

BUGS
     The notion of errors is ill-defined.

4.2 Berkeley Distribution       April 18, 1994                               1