303 lines
7.0 KiB
Plaintext
303 lines
7.0 KiB
Plaintext
.\" Copyright (c) 1983 Regents of the University of California.
|
|
.\" All rights reserved. The Berkeley software License Agreement
|
|
.\" specifies the terms and conditions for redistribution.
|
|
.\"
|
|
.\" @(#)netstat.8c 1.1 92/07/30 SMI; from UCB 6.5 5/8/86
|
|
.TH NETSTAT 8 "31 December 1986"
|
|
.SH NAME
|
|
netstat \- show network status
|
|
.SH SYNOPSIS
|
|
.B netstat
|
|
[
|
|
.B \-Aan
|
|
] [
|
|
.B \-f
|
|
.I address_family
|
|
] [
|
|
.I system
|
|
] [
|
|
.I core
|
|
]
|
|
.br
|
|
.B netstat
|
|
[
|
|
.B \-himnrs
|
|
] [
|
|
.B \-f
|
|
.I address_family
|
|
] [
|
|
.I system
|
|
] [
|
|
.I core
|
|
]
|
|
.br
|
|
.B netstat
|
|
[
|
|
.B \-n
|
|
] [
|
|
.B \-I
|
|
.I interface
|
|
]
|
|
.I interval
|
|
[
|
|
.I system
|
|
] [
|
|
.I core
|
|
]
|
|
.SH DESCRIPTION
|
|
.IX "netstat command" "" "\fLnetstat\fP \(em display network status"
|
|
.IX "network status, display \(em \fLnetstat\fP"
|
|
.IX "status of network" display "" "display \(em \fLnetstat\fP"
|
|
.LP
|
|
The
|
|
.I netstat
|
|
command symbolically displays
|
|
the contents of various network-related data structures.
|
|
There are a number of output formats,
|
|
depending on the options for the information presented.
|
|
The first form of the command displays a list of active sockets for
|
|
each protocol.
|
|
The second form presents the contents of one of the other network
|
|
data structures according to the option selected.
|
|
Using the third form,
|
|
with an
|
|
.I interval
|
|
specified,
|
|
.I netstat
|
|
will continuously display the information regarding packet
|
|
traffic on the configured network interfaces.
|
|
The display formats are controlled by the options listed
|
|
below and are described in the
|
|
.SM DISPLAYS
|
|
section below.
|
|
.LP
|
|
The arguments
|
|
.I system
|
|
and
|
|
.I core
|
|
allow substitutes for the defaults ``/vmunix'' and ``/dev/kmem''.
|
|
.SH OPTIONS
|
|
The options have the following meaning.
|
|
.TP
|
|
.B \-A
|
|
With the default display,
|
|
show the address of any protocol control blocks associated with sockets;
|
|
used for debugging.
|
|
.TP
|
|
.B \-a
|
|
With the default display,
|
|
show the state of all sockets;
|
|
normally sockets used by server processes are not shown.
|
|
.TP
|
|
.BI \-f " address_family"
|
|
Limit statistics or address control block reports to those
|
|
of the specified
|
|
.IR address\ family .
|
|
The following address families
|
|
are recognized:
|
|
.IR inet ,
|
|
for
|
|
.BR AF_INET ,
|
|
'\" \" XNS support not (yet) enabled
|
|
.ig
|
|
.IR ns ,
|
|
for
|
|
.BR AF_NS ,
|
|
..
|
|
'\" \" end of commented out section
|
|
and
|
|
.IR unix ,
|
|
for
|
|
.BR AF_UNIX .
|
|
.TP
|
|
.B \-h
|
|
Show the state of the IMP host table.
|
|
This does not work in an environment where the IMP host tables do not exist.
|
|
.TP
|
|
.B \-i
|
|
Show the state of interfaces that have been auto-configured.
|
|
(Interfaces statically configured into a system,
|
|
but not located at boot time are not shown.)
|
|
.TP
|
|
.BI \-I " interface"
|
|
Show information only about this interface;
|
|
used with an
|
|
.I interval
|
|
as described below.
|
|
.TP
|
|
.B \-m
|
|
Show statistics recorded by the memory management routines.
|
|
(The network manages a private pool of memory buffers.)
|
|
.TP
|
|
.B \-n
|
|
Show network addresses as numbers.
|
|
(Normally
|
|
.I netstat
|
|
interprets addresses and attempts to display them symbolically.)
|
|
This option may be used with any of the display formats.
|
|
.TP
|
|
.B \-s
|
|
Show per-protocol statistics.
|
|
When used with the
|
|
.B \-r
|
|
option,
|
|
the
|
|
.B \-s
|
|
option displays routing statistics.
|
|
.TP
|
|
.B \-r
|
|
Show the routing tables.
|
|
When
|
|
.B \-s
|
|
is also present,
|
|
show routing statistics instead.
|
|
.TP
|
|
.B \-t
|
|
In the interface display,
|
|
replace queue length information with timer information.
|
|
.LP
|
|
In its second form of invocation
|
|
.I netstat
|
|
checks its options in the order
|
|
.BR \-m ,
|
|
.BR \-i ,
|
|
.BR \-h ,
|
|
and
|
|
.BR \-r
|
|
and presents a display for only one of these options.
|
|
.SH DISPLAYS
|
|
The default display,
|
|
for active sockets,
|
|
shows the local and remote addresses,
|
|
send and receive queue sizes (in bytes),
|
|
protocol,
|
|
and the internal state of the protocol.
|
|
Address formats are of the form ``host.port,''
|
|
or ``network.port'' if a socket's address specifies
|
|
a network but no specific host address.
|
|
When known,
|
|
the host and network addresses are displayed symbolically
|
|
according to the data bases
|
|
.I /etc/hosts
|
|
and
|
|
.IR /etc/networks ,
|
|
respectively.
|
|
If a symbolic name for an address is unknown,
|
|
or if the
|
|
.B \-n
|
|
option is specified,
|
|
the address is printed numerically,
|
|
according to the address family.
|
|
For more information regarding the Internet ``dot format,''
|
|
refer to
|
|
.IR inet (3N).
|
|
Unspecified,
|
|
or ``wildcard'',
|
|
addresses and ports appear as ``*''.
|
|
.LP
|
|
The possible state values for TCP sockets are as follows.
|
|
.RS
|
|
'\" Let first paragraph lead the normal distance; then
|
|
'\" close to half the normal lead for the rest of them.
|
|
.TP 15
|
|
.SM CLOSED
|
|
Closed: socket not being used
|
|
.nr Xx \n()Pu/2u
|
|
.PD \n(Xxu
|
|
.TP
|
|
.SM LISTEN
|
|
Listening for incoming connections
|
|
.TP
|
|
.SM SYN_SENT
|
|
Actively trying to establish connection
|
|
.TP
|
|
.SM SYN_RECEIVED
|
|
Initial synchronization of the connection
|
|
.TP
|
|
.SM ESTABLISHED
|
|
Connection has been established
|
|
.TP
|
|
.SM CLOSE_WAIT
|
|
Remote shut down, waiting for socket to close
|
|
.TP
|
|
.SM FIN_WAIT_1
|
|
Socket closed, shutting down connection
|
|
.TP
|
|
.SM CLOSING
|
|
Closed, then remote shutdown, awaiting acknowledgement
|
|
.TP
|
|
.SM LAST_ACK
|
|
Remote shut down, then closed, awaiting acknowledgement
|
|
.TP
|
|
.SM FIN_WAIT_2
|
|
Socket closed, waiting for shutdown from remote
|
|
.TP
|
|
.SM TIME_WAIT
|
|
Wait after close for remote shutdown retransmission
|
|
.PD
|
|
.RE
|
|
.LP
|
|
The interface display provides a table of cumulative
|
|
statistics regarding packets transferred, errors, and collisions.
|
|
The network addresses of the interface
|
|
and the maximum transmission unit (``mtu'') are also displayed.
|
|
.LP
|
|
The routing table display indicates the available routes and their status.
|
|
Each route consists of a destination host or network
|
|
and a gateway to use in forwarding packets.
|
|
The
|
|
.I flags
|
|
field shows
|
|
the state of the route (``U'' if ``up''),
|
|
whether the route is to a gateway (``G''),
|
|
and whether the route was created dynamically by a redirect (``D'').
|
|
Direct routes are created for each interface attached to the local host;
|
|
the gateway field for such entries shows the address of the outgoing interface.
|
|
The
|
|
.I refcnt
|
|
field gives the current number of active uses of the route.
|
|
Connection-oriented protocols normally hold on to a single route
|
|
for the duration of a connection
|
|
whereas connectionless protocols obtain a route while sending
|
|
to the same destination.
|
|
The
|
|
.I use
|
|
field provides a count of the number of packets
|
|
sent using that route.
|
|
The
|
|
.I interface
|
|
entry indicates the network
|
|
interface utilized for the route.
|
|
.LP
|
|
When
|
|
.I netstat
|
|
is invoked with an
|
|
.I interval
|
|
argument,
|
|
it displays a running count of statistics related to network interfaces.
|
|
This display consists of a column summarizing
|
|
information for all interfaces, and a column for the interface with
|
|
the most traffic since the system was last rebooted.
|
|
The most heavily travelled interface may be replaced
|
|
with another interface with the
|
|
.B \-I
|
|
option.
|
|
Every 24th line of the display contains a summary since the
|
|
system was last rebooted.
|
|
Subsequent lines of output show values accumulated over the preceding interval.
|
|
.SH "SEE ALSO"
|
|
iostat(8),
|
|
vmstat(8),
|
|
hosts(5),
|
|
networks(5),
|
|
protocols(5),
|
|
services(5),
|
|
trpt(8C)
|
|
.SH BUGS
|
|
The notion of errors is ill-defined.
|
|
Collisions mean something else for the IMP.
|
|
.LP
|
|
The kernel's tables can change while
|
|
.I netstat
|
|
is examining them, creating incorrect or partial displays.
|