NETSTAT(1)
NAME
netstat − show network status
USAGE
netstat [ −Aahimnrs ] [ interval ]
DESCRIPTION
The netstat command symbolically displays the contents of various network-related data structures.
If you specify an interval, netstat continuously displays the information regarding packet traffic on the configured network interfaces, pausing interval seconds before refreshing the screen.
A number of display formats are available, depending on the information presented. The default display, for active sockets, shows the local and remote addresses, send and receive queue sizes (in bytes), protocol, and, optionally, the internal state of the protocol.
Address formats are of the form “host.port” or “network.port” if a socket’s address specifies a network but no specific host address. When they are known, the host and network addresses are displayed symbolically according to the /etc/hosts and /etc/networks databases, respectively. If a symbolic name for an address is unknown, or if you use the −n option, netstat prints the address in the Internet “dot format”. See inet(3N) for more information regarding this format. Unspecified, or “wildcard”, addresses and ports appear as an asterisk (∗).
The interface display provides a table of cumulative statistics regarding packets transferred, errors, and collisions. The network address (currently Internet specific) of the interface and the maximum transmission unit (“mtu”) are also displayed.
The routing table display indicates the available routes and the status of each. Each route consists of a destination host or network and a gateway to use in forwarding packets. The “flags” field shows the state of the route (“U” if “up”), and whether the route is to a gateway (“G”). The “refcnt” field gives the current number of active uses of the route. Connection-oriented protocols normally hold on to a single route for the duration of a connection, while protocols without connections obtain a route and then discard it. The “use” field provides a count of the number of packets sent using that route. The “interface” entry indicates which network interface is used for the route.
When you invoke netstat with an interval argument, it displays a running count of statistics related to network interfaces. This display consists of a column summarizing information for all interfaces, and a column for the interface with the most traffic since the system was last rebooted. The first line of each screen of information contains a summary of events since the system was last rebooted. Subsequent lines of output show values accumulated over the preceding interval.
OPTIONS
−A Show the address of any associated protocol control blocks (used for debugging).
−a Show the state of all sockets (normally, sockets used by server processes are not shown).
−h Show the state of the IMP host table.
−i Show the state of interfaces that have been initialized (interfaces statically configured into a system, but not initialized at boot time are not shown).
−m Show statistics recorded by the memory management routines (the network manages a “private share” of memory).
−n Show network addresses as numbers (normally, netstat interprets addresses and attempts to display them symbolically).
−s Show per-protocol statistics.
−r Show the routing tables.