netstat - show network status

     netstat [ -anv ]

     netstat [ -g | -m | -p | -s | -f address_family ]
          [ -n ] [ -P protocol ]

     netstat {[ -i ] [ -I interface ]} [ interval ]

     netstat -r [ -anv ]

     netstat -M [ -ns ]


     netstat displays the  contents  of  various  network-related
     data structures in various formats, depending on the options
     you select.

     The first form of the command  displays  a  list  of  active
     sockets for each protocol.  The second form selects one from
     among various other network data structures.  The third form
     shows  the state of the interfaces. The fourth form displays
     the routing table and the fifth form the  multicast  routing

     -a                Show the state  of  all  sockets  and  all
                      routing  table  entries;  normally  sockets
                      used by server processes are not shown  and
                      only  interface,  host, network and default
                      routes are shown.

     -f address_family
                      Limit statistics or address  control  block
                      reports   to   those   of   the   specified
                      address_family, which can be one of:
                      inet      For the AF_INET address family
                      unix      For the AF_UNIX address family.

     -g                Show the multicast group  memberships  for
                      all interfaces.

     -i                Show the state of the interfaces that  are
                      used     for     TCP/IP    traffic.    (See

     -m                Show the STREAMS statistics.
     -n               Show network addresses as numbers.  netstat
                      normally  displays  addresses  as  symbols.
                      This option may be used  with  any  of  the
                      display formats.

     -p                Show the address resolution (ARP) tables.

     -r                Show the routing tables.

     -s                Show per-protocol statistics.   When  used
                      with  the -M option, show multicast routing
                      statistics instead.

     -v                Verbose. Show additional  information  for
                      the sockets and the routing table.

     -I interface      Show the state of a particular  interface.
                      interface  can  be any valid interface such
                      as ie0 or le0.

     -M                Show the multicast routing  tables.   When
                      used  with  the   -s option, show multicast
                      routing statistics instead.

     -P protocol       Limit display of statistics  or  state  of
                      all  sockets  to those applicable to proto-

     interval         If interval is specified, netstat  displays
                      interface  information over the last inter-
                      val seconds, repeating forever.

  Active Sockets (First Form)
     The display for each  active  socket  shows  the  local  and
     remote address, the send and receive queue sizes (in bytes),
     the send and receive windows (in bytes),  and  the  internal
     state of the protocol.

     The  symbolic  format  normally  used  to   display   socket
     addresses is either:


     when the name of the host is specified, or:


     if a socket address specifies  a  network  but  no  specific

     The numeric host address or network number  associated  with
     the  socket  is  used  to look up the corresponding symbolic
     hostname or network name in the hosts or networks database.

     If the network or hostname for an address is not  known  (or
     if  the  -n  option  is  specified),  the  numerical network
     address is shown.  Unspecified, or "wildcard", addresses and
     ports  appear  as  "*".   For more information regarding the
     Internet naming conventions, refer to inet(7P).

  TCP Sockets
     The possible state values for TCP sockets are as follows:

          CLOSED              Closed.  The socket  is  not  being
          LISTEN              Listening for incoming connections.
          SYN_SENT            Actively trying to  establish  con-
          SYN_RECEIVED        Initial synchronization of the con-
                              nection under way.
          ESTABLISHED         Connection has been established.
          CLOSE_WAIT          Remote shut down; waiting  for  the
                              socket to close.
          FIN_WAIT_1          Socket closed; shutting  down  con-
          CLOSING             Closed,   then   remote   shutdown;
                              awaiting acknowledgement.
          LAST_ACK            Remote  shut  down,  then   closed;
                              awaiting acknowledgement.
          FIN_WAIT_2          Socket closed; waiting for shutdown
                              from remote.
          TIME_WAIT           Wait after close for  remote  shut-
                              down retransmission.

  Network Data Structures (Second Form)
     The form of the display depends upon which of the -g, -m, -p
     or  - s options you select.  If you specify more than one of
     these options, netstat displays the information for each one
     of them.

  Interface Status (Third Form)
     The interface  status  display  lists  information  for  all
     current  interfaces, one interface per line. If an interface
     is specified using the -I option,  it  displays  information
     for only the specified interface.

     The list  consists  of  the  interface  name,  mtu  (maximum
     transmission  unit,  or maximum packet size), the network to
     which the interface is attached, addresses for  each  inter-
     face   and  counter  associated  with  the  interface.   The
     counters show the number of  input  packets,  input  errors,
     output  packets, output errors, and collisions respectively.
     For Point-to-Point interfaces, the  Net/Dest  field  is  the
     name or address on the other side of the link.

     If the -n option is specified,  the  list  displays  the  IP
     address instead of the interface name.

     If an optional interval is specified,  the  output  will  be
     continuously displayed in interval seconds until interrupted
     by the user.

     The input interface is specified using the  - I  option.  In
     this  case,  the  list  only displays traffic information in
     columns; the specified interface is first, the  total  count
     is second.  This column list has the format of:

         input   le0      output         input  (Total)   output
     packets errs packets errs colls packets errs packets errs colls
     227681  0    65947   1    502   261331  0    99597   1     502
     10      0    0       0    0     10      0    0       0     0
     8       0    0       0    0     8       0    0       0     0
     10      0    2       0    0     10      0    2       0     0

     If the input interface is not specified, the first interface
     of address family inet will be displayed.

  Routing Table (Fourth Form)
     The routing table display lists the available routes and the
     status  of  each.  Each route consists of a destination host
     or network, and a gateway to use in forwarding packets.  The
     flags  column  shows  the  status  of the route (U if "up"),
     whether the route is to a gateway (G), and whether the route
     was created dynamically by a redirect (D).  If the -a option
     is specified there will be routing entries  with  flags  for
     combined  routing and address resolution entries (A), broad-
     cast addresses (B), and the local  addresses  for  the  host

     Interface routes are created for each interface attached  to
     the local host; the gateway field for such entries shows the
     address of the outgoing interface.

     The refcnt column gives the current number  of  routes  that
     share the same link layer address.

     The use column displays the number of packets sent using  an
     combined  routing  and address resolution (A) or a broadcast
     (B) route.  For a local (L) route this count is  the  number
     of  packets  received,  and  for  all other routes it is the
     number of times the routing entry has been used to create  a
     new combined route and address resolution entry.

     The interface entry indicates the network interface utilized
     for the route.

  Multicast Routing Tables (Fifth Form)
     The multicast routing table consists of the  virtual  inter-
     face table and the actual routing table.

     ifconfig(1M), iostat(1M), vmstat(1M), hosts(4), networks(4),
     protocols(4), services(4), inet(7P)

     The kernel's tables can change while  netstat  is  examining
     them, creating incorrect or partial displays.

Man(1) output converted with man2html