netstat(1)netstat(1)Namenetstat - show network status
Syntaxnetstat [ -Aan ] [ -f address_family ] [ system ] [ core ]
netstat [ -himnrs ] [ -f address_family ] [ system ] [ core ]
netstat [ -n ] [ -I interface ] interval [ system ] [ core ]
netstat [ -I interface -s ] [ system ] [ core ]
Description
The command displays the contents of network-related data structures
symbolically. Depending on the options supplied to there are a number
of output formats.
The first form of the command displays a list of active sockets for
each protocol. The second form presents the contents of one of the
other network data structures according to the option selected. The
third form, with an interval specified, continuously displays the
information regarding packet traffic on the configured network inter‐
faces. The fourth form displays the Digital Network Architecture (DNA)
Ethernet Data Link Layer counters for an Ethernet interface, or the DNA
Fiber Distributed Data Interface (FDDI) Data Link Layer counters for an
FDDI interface. It also presents the FDDI adapter's status and charac‐
teristics for the FDDI interface.
If no options are specified, displays the state of all active sockets
from those using any of the protocols listed in
The arguments, system and core allow substitutes for the defaults and
If an interval is specified, display the information regarding packet
traffic on the configured network interfaces continuously, pausing
interval seconds before refreshing the screen.
There are a number of display formats, depending on the information
presented. The default display, for active sockets, shows the local
and remote addresses, send and receive queue sizes (in bytes), proto‐
col, and, optionally, the internal state of the protocol.
Address formats are either of the form host.port or network.port, if a
socket's address specifies a network but no specific host address.
When known, the host and network addresses are displayed symbolically
according to the data bases and respectively. If a symbolic name for
an address is unknown, or if the -n option is specified, the address is
printed in the Internet dot format. Refer to for more information
regarding this format. Unspecified, or wildcard, addresses and ports
appear as an asterisk (*).
The interface display provides a table of cumulative statistics regard‐
ing packets transferred, errors, and collisions. The network address
(currently Internet specific) of the interface and the maximum trans‐
mission unit (mtu) are also displayed.
The routing table display indicates the available routes and their sta‐
tus. Each route consists of a destination host or network and a gate‐
way to use in forwarding packets. The flags field shows the state of
the route (for example, U if up), whether the route is to a gateway
(G), and whether the route was created dynamically by a redirect (D).
Direct routes are created for each interface attached to the local
host. The gateway field for such entries shows the address of the out‐
going interface. The refcnt field gives the current number of active
uses of the route. Connection oriented protocols normally hold on to a
single route for the duration of a connection, while connectionless
protocols obtain a route while sending to the same destination. The
use field provides a count of the number of packets sent using that
route. The interface entry indicates the network interface utilized
for the route.
When is invoked with an interval argument, it displays a running count
of statistics related to network interfaces. This display consists of
a column for the primary interface (the first interface found during
autoconfiguration), and a column summarizing information for all inter‐
faces. The primary interface may be replaced with another interface
with the -I option. The first line of each screen of information con‐
tains a summary since the system was last rebooted. Subsequent lines
of output show values accumulated over the preceding interval.
Options-A Displays the address of any associated protocol
control blocks; used for debugging.
-a Displays the information for all sockets. Normally
sockets used by server processes are not shown.
-f address_family Limits statistics or address control block reports
to those of the specified address family. Recog‐
nized address families are inet, for AF_INET, and
unix, for AF_UNIX.
-h Displays the state of the IMP host table.
-I interface Shows information only about this interface. Used
with an interval displayed below.
-I interface -s Displays the DNA Ethernet Data Link Layer counters
for an Ethernet interface. Displays the DNA FDDI
Data Link Layer counters, adapter's status and
characteristics for an FDDI interface.
-i Displays status information for autoconfigured
interfaces . Interfaces statically configured into
a system, but not located at boot time are not
shown.
-m Displays information for the memory management rou‐
tines The network manages a private share of mem‐
ory.
-n Displays network addresses as numbers. Normally
interprets addresses and attempts to display them
symbolically.
-r Displays the routing tables. When -s is also
present, shows routing statistics instead.
-s Displays per-protocol statistics.
-t Displays time until interface watchdog routine
starts up (used only in conjunction with -i
option).
See Alsoiostat(1), vmstat(1), hosts(5), networks(5), protocols(5), services(5),
trpt(8c)netstat(1)