netstat(1) General Commands Manual netstat(1)
NAME
netstat - show network status
SYNOPSIS
address-family] [system]
address-family] [system [core]]
address-family] protocol] [system]
address-family] protocol] [system [core]]
interface] [interval] [system]
interface] [interval] [system [core]]
DESCRIPTION
displays statistics for network interfaces and protocols, as well as the contents of various network-related data structures. The output
format varies according to the options selected. Some options are ignored or invalid when used in combination with other options.
Generally, the command takes one of the three forms shown above:
o The first form of the command displays a list of active sockets for each protocol.
o The second form displays the contents of one of the other network data structures according to the option selected.
o The third form displays configuration information for each network interface. It also displays network traffic data on config-
ured network interfaces, optionally updated at each interval, measured in seconds.
Options are interpreted as follows:
Show the state of all sockets, including passive sockets
used by server processes. When is used without any options only active sockets are shown. This option does not
show the state of X.25 programmatic access sockets. The option is ignored if the or interval option is specified.
Show statistics or address control block for only the specified
address-family. The following address families are recognized: for for and for This option with applies to the
and options. This option with or applies to the and options.
Show multicast information for network interfaces.
Only the address family is recognized by this option. This option may be combined with the option to display both
kinds of information. The option is ignored if the option is specified.
Show the state of network interfaces.
Only the interfaces that have been configured with an IP address or the option using the command are shown. The
output includes both the primary and logical interfaces. (See ifconfig(1M)). The counts for Ipkts and Opkts
fields are for IP packets only. This option is ignored if the option is specified. By default, when the option
is not specified, shows the state of interfaces configured with either IPv4 or IPv6 addresses. An exception is
when the user has not configured any IPv6 address on any interface, does not display the state of the IPv6 loop-
back interface.
Show information about the specified interface only.
This option applies to the and options.
Show the multicast routing tables.
When is used with the option, displays multicast routing statistics instead. This option is ignored if the option
is specified.
Show network addresses as numbers.
Normally, interprets addresses and attempts to display them symbolically. This option applies to the and options.
Show statistics for the specified protocol.
The following protocols are recognized: and
Show the routing tables.
When is used with the option, also displays the network masks in the route entries. This option is ignored if the
or interval option is specified and is invalid if the option is specified.
Show statistics for all protocols.
When this option is used with the option, displays multicast routing statistics instead. This option is ignored
if the or interval option is specified and is invalid if the option is specified.
Show additional routing information.
When is used with the option, also displays the network masks in the route entries.
With SCTP, because there may be multiple addresses involved in a SCTP socket endpoint, the command displays all
local and remote addresses of a SCTP socket.
Note: SCTP is available only if the optional SCTP bundle is installed.
Show the output in wide format. This option displays
all the fields in the output with their maximum resolution in a single line. Thus, the output can be worked upon
with text-processing tools. This option works only with the option and will be ignored when used with any other
option.
The system argument allows substitution for the default value On PA-RISC systems only, the core argument allows substitution for the
default value
If no options are specified, displays the status of only active sockets. The display of active and passive sockets status shows the local
and remote addresses, send and receive queue sizes (in bytes), protocol, and the internal state of the protocol.
The send and receive queue size displayed is usually zero. These fields are displayed only for backward compatibility purposes.
Address formats are in two forms: or if the host portion of a socket address is zero. When known, the host and network addresses are dis-
played symbolically by using and respectively (see gethostent(3N) and getnetent(3N)) for IPv4, and for IPv6 (see getaddrinfo(3N)). If a
symbolic name for an address is unknown, the address is displayed numerically according to the address family. For more information
regarding the Internet "dot format" for IPv4 addresses, refer to inet(3N). For more information regarding the Internet "colon format" for
IPv6 addresses, refer to inet6(3N). Unspecified or "wildcard" addresses and ports appear as an asterisk
The interface display provides a table of cumulative statistics regarding packets transferred, both inbound and outbound. The network
addresses of the interface and the maximum transmission unit (MTU) are also displayed. When the interval argument is specified, displays a
running count of statistics related to network interfaces. This display consists of a column for the first interface found during auto-
configuration and a column summarizing information for all interfaces. To display a running count of statistics for a specific interface,
use the option. The first line of each screen of information contains a summary since the system was last rebooted. Subsequent lines of
output show values accumulated over the preceding interval.
The routing table display indicates the available routes and their status. Each route consists of a destination host or network, a netmask
and a gateway to use in forwarding packets. The field shows whether the route is up whether the route is to a gateway or whether the route
is a host or network route (with or without
The field shows the mask to be applied to the destination IP address of an IP packet to be forwarded. The result will be compared with the
destination address in the route entry. If they are the same, then the route is one of the candidates for routing this IP packet. If
there are several candidate routes, then the route with the longest field (contiguous 1's starting from the left-most bit position) will be
chosen. (see routing(7).)
The field shows the address of the immediate gateway for reaching the destination. It can be the address of the outgoing interface if the
destination is on a directly connected network.
The field identifies which network interface is used for the route.
The field displays the path maximum transmission unit (PMTU). If the route is created with a static PMTU value (see route(1M)), the corre-
sponding PMTU value permanently overrides the interface MTU. Otherwise, the PMTU value is the same as the MTU of the network interface
used for the route.
The field is for IPv6 only. Its format is similar to the CIDR notation in IPv4. The prefix is an integer between 0 and 128 inclusive. It
specifies how many of the leftmost contiguous bits of the address comprise the prefix. A host route has a prefix of 128. A default route
has a prefix of 0 (see route(1M)). The prefix is also used in selecting a route to forward an IPv6 packet.
DEPENDENCIES
X.25
option does not list X.25 programmatic access information.
AUTHOR
was developed by HP and the University of California, Berkeley.
SEE ALSO
ifconfig(1M), nwmgr(1M), route(1M), inet(3N), inet6(3N), gethostent(3N), getnetent(3N), getaddrinfo(3N), hosts(4), networks(4), proto-
cols(4), services(4), route(7P), sctp(7), routing(7).
netstat(1)