netstat(TC) 19 June 1992 netstat(TC) Name netstat - show network status Syntax netstat [-Aaimnrs] [-faddress_family] [-I interface] [-p protocol_name] [interval] [system] [corefile] Description The netstat command symbolically displays the contents of various network-related data structures. The options have the following mean- ings: -A show the address of any associated protocol control blocks; used for debugging -a show the state of all sockets; normally sockets used by server pro- cesses are not shown -i show the state of interfaces which have been auto-configured (inter- faces statically configured into a system, but not located at boot time, are not shown) -m show network memory usage -n show network addresses as numbers (normally netstat interprets addresses and attempts to display them symbolically) -s show per-protocol statistics -r show the routing tables -f limit statistics and control block displays to address_family. The only address_family currently supported is inet -I show interface state for interface only. -p limit statistics and control block displays to protocol-name, for example, tcp. The defaults for the arguments system and corefile are /unix and /dev/kmem, respectively. If an interval is specified, netstat will continuously display the infor- mation regarding packet traffic on the configured network interfaces, pausing interval seconds before refreshing the screen. There are a number of display formats, depending on the information presented. The default display, for active sockets, shows the local and remote addresses, send and receive queue sizes (in bytes), protocol, and, optionally, the internal state of the protocol. Address formats are of the form host.port ornetwork.port if a socket's address specifies a network but no specific host address. When known, the host and network addresses are displayed symbolically according to the databases /etc/hosts and /etc/networks, respectively. If a symbolic name for an address is unknown, or if the -n option is specified, the address is printed in the Internet ``dot format''; refer to rhosts(SFF) for more information regarding this format. Unspecified, or ``wild- card,'' addresses and ports appear as ``*''. The interface display provides a table of cumulative statistics regarding packets transferred, errors, and collisions. The network address (currently Internet specific) of the interface and the maximum transmis- sion unit (``mtu'') are also displayed. The routing table display indicates the available routes and their status. Each route consists of a destination host or network and a gate- way to use in forwarding packets. The flags field shows the state of the route (``U'' if ``up''), and whether the route is to a gateway (``G''). Direct routes are created for each interface attached to the local host. The refcnt field gives the current number of active uses of the route. Connection-oriented protocols normally hold on to a single route for the duration of a connection, while connectionless protocols obtain a route then discard it. The use field provides a count of the number of packets sent using that route. The interface entry indicates the network inter- face utilized for the route. When netstat is invoked with an interval argument, it displays a running count of statistics related to network interfaces. This display consists of a column summarizing information for the loopback interface only, and a column summarizing information for all interfaces. The first line of each screen of information contains a summary since the system was last rebooted. Subsequent lines of output show values accumulated over the preceding interval. Notes Interface statistics are dependent on the link driver. If it does not attach itself to the ifstats structure in the kernel, the message No Statistics Available will be printed for that interface. See also hosts(SFF), networks(SFF), protocols(SFF), services(SFF).