Network Computing

NEWS BLOGS FORUMS NEWSLETTERS RESEARCH EVENTS DIGITAL LIBRARY CAREERS

IMMERSE YOURSELF:

netstat(1M) Maintenance Commands netstat(1M) NAME netstat - show network status SYNOPSIS netstat [ -anv ] [ system ] [ core ] netstat [ -s | -g | -m | -p | -f address_family ] [ -P protocol ] [ -n ] [ system ] [ core ] netstat -i | -I interface [ interval ] [ system ] [ core ] netstat -r [ -anv ] [ system ] [ core ] netstat -M [ -ns ] [ system ] ] core ] DESCRIPTION netstat displays the contents of various network-related data structures in various formats, depending on the options you select. The first form of the command displays a list of active sockets for each protocol. The second form selects one from among various other network data structures. The third form displays the routing table and the fourth form the multicast routing table. OPTIONS -a Show the state of all sockets and all routing table entries; normally sockets used by server processes are not shown and only interface, host, network and default routes are shown. -f address_family Limit statistics or address control block reports to those of the specified address_family, which can be one of: inet For the AF_INET address family unix For the AF_UNIX address family. -g Show the multicast group memberships for all interfaces. -i Show the state of the interfaces that are used for TCP/IP traffic. (See ifconfig(1M)). -m Show the STREAMS statistics. -n Show network addresses as numbers. netstat normally displays addresses as symbols. This option may be used with any of the display formats. -p Show the address resolution (ARP) tables. -r Show the routing tables. -s Show per-protocol statistics. When used with the -M option, show multicast routing statistics instead. -v Verbose. Show additional information for the sockets and the routing table. -I interface Show the state of a particular interface. interface can be any valid interface such as ie0 or le0. -M Show the multicast routing tables. When used with the -s option, show multicast routing statistics instead. -P protocol Limit display of statistics or state of all sockets to those applicable to proto- col. DISPLAYS Active Sockets (First Form) The display for each active socket shows the local and remote address, the send and receive queue sizes (in bytes), the send and receive windows (in bytes), and the internal state of the protocol. The symbolic format normally used to display socket addresses is either: hostname.port when the name of the host is specified, or: network.port if a socket address specifies a network but no specific host. The numeric host address or network number associated with the socket is used to look up the corresponding symbolic hostname or network name in the hosts or networks database. If the network or hostname for an address is not known (or if the -n option is specified), the numerical network address is shown. Unspecified, or "wildcard", addresses and ports appear as "*". For more information regarding the Internet naming conventions, refer to inet(7P). TCP Sockets The possible state values for TCP sockets are as follows: CLOSED Closed. The socket is not being used. LISTEN Listening for incoming connections. SYN_SENT Actively trying to establish con- nection. SYN_RECEIVED Initial synchronization of the con- nection under way. ESTABLISHED Connection has been established. CLOSE_WAIT Remote shut down; waiting for the socket to close. FIN_WAIT_1 Socket closed; shutting down con- nection. CLOSING Closed, then remote shutdown; awaiting acknowledgement. LAST_ACK Remote shut down, then closed; awaiting acknowledgement. FIN_WAIT_2 Socket closed; waiting for shutdown from remote. TIME_WAIT Wait after close for remote shut- down retransmission. Network Data Structures (Second Form) The form of the display depends upon which of the -i, -g, -m, -p or -s options you select. If you specify more than one of these options, netstat displays the information for each one of them. Routing Table (Third Form) The routing table display lists the available routes and the status of each. Each route consists of a destination host or network, and a gateway to use in forwarding packets. The flags column shows the status of the route (U if "up"), whether the route is to a gateway (G), and whether the route was created dynamically by a redirect (D). If the -a option is specified there will be routing entries with flags for combined routing and address resolution entries (A), broad- cast addresses (B), and the local addresses for the host (L). Interface routes are created for each interface attached to the local host; the gateway field for such entries shows the address of the outgoing interface. The refcnt column gives the current number of routes that share the same link layer address. The use column displays the number of packets sent using an combined routing and address resolution (A) or a broadcast (B) route. For a local (L) route this count is the number of packets received, and for all other routes it is the number of times the routing entry has been used to create a new combined route and address resolution entry. The interface entry indicates the network interface utilized for the route. Multicast Routing Tables (Fourth Form) The multicast routing table consists of the virtual inter- face table and the actual routing table. SEE ALSO ifconfig(1M), iostat(1M), vmstat(1M), hosts(4), networks(4), protocols(4), services(4) NOTES The kernel's tables can change while netstat is examining them, creating incorrect or partial displays. SunOS 5.5 Last change: 7 Dec 1993