'\"macro stdmacro
.if n .pH g1a.netstat @(#)netstat	40.9 of 1/31/90
.\" Copyright 1989 AT&T
.\" @(#)netstat.1M 1.3 89/07/14 SMI; from UCB 6.5 5/8/86
.\" Copyright (c) 1983 Regents of the University of California.
.\" All rights reserved.  The Berkeley software License Agreement
.\" specifies the terms and conditions for redistribution.
.\"
'\" macro stdmacro
.\" Copyright (c) 1988 Sun Microsystems, Inc. - All Rights Reserved.
.\"
.\"
.nr X
.if \nX=0 .ds x} netstat 1M "TCP/IP" "\&"
.if \nX=1 .ds x} netstat 1M "TCP/IP"
.if \nX=2 .ds x} netstat 1M "" "\&"
.if \nX=3 .ds x} netstat "" "" "\&"
.TH \*(x}
.SH NAME
\f4netstat\fP \- show network status
.SH SYNOPSIS
\f4netstat\f1
[
\f4\-aAn\f1
] [
\f4\-f\f1
.I addr_family
] [
\f4system\f1
] [
\f4core\f1
]
.PP
\f4netstat\f1
[
\f4\-n\f1
] [
\f4\-s\f1
] [
\f4\-i\f1 |
\f4\-r\f1
] [
\f4\-f\f1
.I addr_family
] [
\f4system\f1
] [
\f4core\f1
]
.PP
\f4netstat\f1
[
\f4\-n\f1
] [
\f4\-I\f1
.I interface
]
.I interval
[
\f4system\f1
] [
\f4core\f1
]
.SH DESCRIPTION
.PP
\f4netstat\f1
displays the contents of various network-related data structures
in various formats, depending on the options you select.
.PP
The first form of the command displays a list of active sockets for
each protocol.
The second form selects one from among various
other network data structures.
The third form displays running
statistics of packet traffic on configured network interfaces;
the
.I interval
argument indicates the number of seconds in which to gather
statistics between displays.
.PP
The default value for the
\f4system\f1
argument is
\f4/unix\f1;
for
.IR core ,
the default is
\f4/dev/kmem\f1.
.PP
The following options are available:
.TP
\f4\-a\f1
Show the state of all sockets; normally
sockets used by server processes are not shown.
.TP
\f4\-A\f1
Show the address of any protocol control
blocks associated with sockets; used for debugging.
.TP
\f4\-i\f1
Show the state of interfaces that have been auto-configured.
Interfaces that are statically configured into a system, but
not located at boot time, are not shown.
.TP
\f4\-n\f1
Show network addresses as numbers.
\f4netstat\f1
normally displays addresses as
symbols.
This option may be used with any of the display formats.
.TP
\f4\-r\f1
Show the routing tables.
When used with the
\f4\-s\f1
option, show routing statistics instead.
.TP
\f4\-s\f1
Show per-protocol statistics.
When used with the
\f4\-r\f1
option, show routing statistics.
.TP
\f4\-f\f2 addr_family\f1
Limit statistics or address control block reports to those of the
specified
.IR addr_family ,
which can be one of:
.RS
.RS
.TP 8
\f4inet\f1
.PD 0
For the
.SM
AF_INET
address family, or
.TP
\f4unix\f1
For the
.SM AF_UNIX
family.
.PD
.RE
.RE
.TP
\f4\-I\f2 interface\f1
Highlight information about the indicated
.IR interface
in a separate column; the default (for the third form of the
command) is the interface with the most traffic since the
system was last rebooted.
.I interface
can be any valid interface listed in the system configuration file,
such as
\f4emd1\f1
or
\f4lo0\f1.
.SH DISPLAYS
.SS "Active Sockets (First Form)"
.PP
The display for each active socket shows the local and remote address,
the send and receive queue sizes (in bytes),
the protocol, and the internal state of the protocol.
.PP
The symbolic format normally used to
display socket addresses is either:
.IP
\f2hostname\f4.\f2port\f1
.PP
when the name of the host is specified, or:
.IP
\f2network\f4.\f2port\f1
.PP
if a socket address specifies a network but no specific host.
Each
\f4hostname\f1
and
.I network
is shown according to its entry in the
\f4/etc/hosts\f1
or the
\f4/etc/networks\f1
file, as appropriate.
.PP
If the network or hostname for an address is not known (or if the
\f4\-n\f1
option is specified), the numerical network address is shown.
Unspecified, or \(lqwildcard\(rq, addresses and ports appear
as \(lq*\(rq.
For more information regarding the Internet naming conventions,
refer to
\f4inet\f1(7).
.SS "\f2\s-1TCP\s0 Sockets"
.PP
The possible state values for
.SM TCP
sockets are as follows:
.RS
.TP 18
\f4CLOSED\fP
Closed.
The socket is not being used.
.PD 0
.TP
\f4LISTEN\fP
Listening for incoming connections.
.TP
\f4SYN_SENT\fP
Actively trying to establish connection.
.TP
\f4SYN_RECEIVED\fP
Initial synchronization of the connection under way.
.TP
\f4ESTABLISHED\fP
Connection has been established.
.TP
\f4CLOSE_WAIT\fP
Remote shut down; waiting for the socket to close.
.TP
\f4FIN_WAIT_1\fP
Socket closed; shutting down connection.
.TP
\f4CLOSING\fP
Closed, then remote shutdown; awaiting acknowl\%edgement.
.TP
\f4LAST_ACK\fP
Remote shut down, then closed; awaiting acknowl\%edgement.
.TP
\f4FIN_WAIT_2\fP
Socket closed; waiting for shutdown from remote.
.TP
\f4TIME_WAIT\fP
Wait after close for remote shutdown retransmission.
.PD
.RE
.SS "Network Data Structures (Second Form)"
.PP
The form of the display depends upon which of the
\f4\-i\f1
or
\f4\-r\f1
options you select.
If you specify more than one of these options,
\f4netstat\f1
selects one in the order listed here.
.SS "\f2Routing Table Display"
.PP
The routing table display lists the available routes and the status
of each.
Each route consists of a destination host or network,
and a gateway to use in forwarding packets.
The
.I flags
column shows the status of the route
\f1(\f4U\f1
if \(lqup\(rq),
whether the route is to a gateway
\f1(\f4G\f1),
and whether the route was created dynamically by a redirect
\f1(\f4D\f1).
.PP
Direct routes are created for each
interface attached to the local host;
the gateway field for such entries shows the address of the outgoing
interface.
.PP
The
\f4refcnt\f1
column gives the current number of active uses per route.
Connection-oriented protocols normally hold on to a single route
for the duration of a connection,
whereas connectionless protocols obtain a route while
sending to the same destination.
.PP
The
\f4use\f1
column displays the number of packets sent per route.
.PP
The
.I interface
entry indicates the network interface utilized for the route.
.SS "Cumulative Traffic Statistics (Third Form)"
.PP
When the
.I interval
argument is given,
\f4netstat\f1
displays a table of
cumulative statistics regarding packets transferred, errors and
collisions, the network addresses for the interface, and the maximum
transmission unit (\(lqmtu\(rq).
The first line of data displayed, and every 24th line thereafter,
contains cumulative statistics from the time the system was last
rebooted.
Each subsequent line shows incremental statistics for the
.I interval
(specified on the command line) since the previous display.
.SH "SEE ALSO"
\f4iostat\fP(1M),
\f4trpt\fP(1M),
\f4vmstat\fP(1M),
\f4hosts\fP(4),
\f4networks\fP(4),
\f4protocols\fP(4),\p
.br
\f4services\fP(4).
.SH NOTES
.PP
The notion of errors is ill-defined.
.PP
The kernel's tables can change while
\f4netstat\f1
is examining them, creating incorrect or partial displays.
