netstat(1M) netstat(1M)
NAME
netstat - show network status
SYNOPSIS
netstat [-aAn] [-u|-f addrfamily] Format 1
netstat [-n] [-N] [-s] [-i|-p|-r|-R|-G] [-u|-f addrfamily] Format 2
netstat [-I interface] [interval] [ntimes] Format 3
netstat -z -f addrfamily Format 4
DESCRIPTION
netstat displays the contents of various network-related data struc-
tures in various formats, depending on the options you select.
The first form of the command displays a list of active sockets for
each protocol. The second form selects one from among various other
network data structures. The third form displays running statistics of
packet traffic on configured network interfaces; the interval argument
indicates the number of seconds in which to gather statistics between
displays and ntimes repeats this n times.
OPTIONS
-a Show the state of all sockets; normally sockets used by server
processes are not shown.
-A Show the address of any protocol control blocks associated with
sockets; used for debugging.
-i Show the state of interfaces that have been auto-configured.
Interfaces that are statically configured into a system, but not
located at boot time, are not shown.
-p Show IP providers.
-n Show network addresses as numbers. netstat normally displays
addresses as symbols. This option may be used with any of the
display formats.
-N When used with the -r option, show subnet masks associated with
each route entry, otherwise this flag is ignored.
-r Show the routing tables. When used with the -s option, show rout-
ing statistics instead.
-R Show ARP table.
-G Show information related to multicast (group address) routing. By
default, show the IP Multicast routing tables.
Page 1 Reliant UNIX 5.44 Printed 11/98
netstat(1M) netstat(1M)
-s Show per-protocol statistics. When used with the -r option, show
routing statistics.
-f addrfamily
Limit statistics or address control block reports to those of the
specified addrfamily, which can be one of:
inet For the AFINET address family, or
unix For the AFUNIX family.
-u Same as -f unix.
-I interface
Highlight information about the indicated interface in a separate
column. If an interface is not specified, the two interfaces that
were used most frequently since the system was last started are
used. interface can be any valid interface listed in the system
configuration file, such as shown by netstat -i.
-z Reset statistics.
DISPLAYS
Active Sockets (Format 1)
The display for each active socket shows the local and remote address,
the send and receive queue sizes (in bytes), the protocol, and the
internal state of the protocol.
The symbolic format normally used to display socket addresses is
either:
hostname.port
when the name of the host is specified, or:
network.port
if a socket address specifies a network but no specific host. Each
hostname and network is shown according to its entry in the /etc/hosts
or the /etc/networks file, as appropriate.
If the network or hostname for an address is not known (or if the -n
option is specified), the numerical network address is shown. Unspeci-
fied, or "wildcard", addresses and ports appear as "*". For more
information regarding the Internet naming conventions, refer to
inet(7).
Page 2 Reliant UNIX 5.44 Printed 11/98
netstat(1M) netstat(1M)
TCP Sockets
The possible state values for TCP sockets are as follows:
CLOSED Closed. The socket is not being used.
LISTEN Listening for incoming connections.
SYNSENT Actively trying to establish connection.
SYNRECEIVED Initial synchronization of the connection under way.
ESTABLISHED Connection has been established.
CLOSEWAIT Remote shutdown; waiting for the socket to close.
FINWAIT1 Socket closed; shutting down connection.
CLOSING Closed, then remote shutdown; awaiting acknowl-
edgement.
LASTACK Remote shutdown, then closed; awaiting acknowl-
edgement.
FINWAIT2 Socket closed; waiting for shutdown from remote.
TIMEWAIT Wait after close for remote shutdown retransmission.
Network Data Structures (Format 2)
The form of the display depends upon which of the options you select.
If you specify more than one of these options, netstat selects one in
the order listed here.
Routing Table Display
The routing table display lists the available routes and the status of
each. Each route consists of a destination host or network, a subnet
mask (if the -N flag is used) and a gateway to use in forwarding pack-
ets. The flags column shows the status of the route (U if "up"),
whether the route is to a gateway (G), whether the route leads to a
machine (H), whether subnet masks are used (N), whether the route was
added manually with the route(1M) command (s) and whether the route
was created dynamically by an ICMP message (D).
Direct routes are created for each interface attached to the local
host; the gateway field for such entries shows the address of the out-
going interface.
The refcnt column gives the current number of active uses per route.
Connection-oriented protocols normally hold on to a single route for
the duration of a connection, whereas connectionless protocols obtain
a route while sending to the same destination.
Page 3 Reliant UNIX 5.44 Printed 11/98
netstat(1M) netstat(1M)
The use column displays the number of packets sent per route.
The interface entry indicates the network interface utilized for the
route.
ARP Table Display
The ARP table display lists the available ARP table entries. Each
entry consists of a flag field, an Internet Address and its associated
physical address. The flag field shows the status of the entry (U - in
use, C - completed entry, S - static entry, P - entry has been pub-
lished and T - trailer encapsulations may be sent).
Traffic Statistics (Format 3)
When the argument interval is specified, netstat displays a table with
statistics containing information on the packets that were received
and sent, as well as information on errors including collisions. Cumu-
lative statistics on the system's activities since it was last started
are output for each page. Each subsequent line displays incremental
statistical information on the interval interval (specified on the
command line) since the last display.
NOTES
The kernel's tables can change while netstat is examining them, creat-
ing incorrect or partial displays.
SEE ALSO
arp(1M), route(1M), trpt(1M), vmstat(1M), hosts(4), networks(4),
protocols(4), services(4).
Page 4 Reliant UNIX 5.44 Printed 11/98