netstat - show network status
netstat [ -aAn ] [ -f address_family ] [ system ] [ core ]
netstat [ -n ] [ -s ] [ -m | -i | -r ] [ -f address_family ] [ system ]
[ core ]
netstat [ -n ] [ -I interface ] interval [ system ] [ core ]
This program is available with the Networking software installation
option. Refer to for information on how to install optional software.
netstat displays the contents of various network-related data struc-
tures in various formats, depending on the options you select.
The first form of the command displays a list of active sockets for
each protocol. The second form selects one from among various other
network data structures. The third form displays running statistics of
packet traffic on configured network interfaces; the interval argument
indicates the number of seconds in which to gather statistics between
The default value for the system argument is /vmunix; for core, the
default is /dev/kmem.
-a Show the state of all sockets; normally sockets used by
server processes are not shown.
-A Show the address of any protocol control blocks associ-
ated with sockets; used for debugging.
Limit statistics or address control block reports to
those of the specified address_family, which can be one
inet For the AF_INET address family, or
unix For the AF_UNIX family.
-i Show the state of interfaces that have been auto-config-
ured. Interfaces that are statically configured into a
system, but not located at boot time, are not shown.
-I interface Highlight information about the indicated interface in a
separate column; the default (for the third form of the
command) is the interface with the most traffic since
the system was last rebooted. interface can be any
valid interface listed in the system configuration file,
such as ie0 or le0.
-m Show the statistics recorded by management routines for
the network's private buffer pool.
-n Show network addresses as numbers. netstat normally
displays addresses as symbols. This option may be used
with any of the display formats.
-r Show the routing tables. (When -s is also present, show
routing statistics instead.)
-s Show per-protocol statistics. When used with the -r
option, show routing statistics.
-t Replace queue length information with timer information.
Active Sockets (First Form)
The display for each active socket shows the local and remote address,
the send and receive queue sizes (in bytes), the protocol, and the
internal state of the protocol.
The symbolic format normally used to display socket addresses is
when the name of the host is specified, or:
if a socket address specifies a network but no specific host. Each
hostname and network is shown according to its entry in the /etc/hosts
or the /etc/networks file, as appropriate.
If the network or hostname for an address is not known (or if the -n
option is specified), the numerical network address is shown. Unspeci-
fied, or ``wildcard'', addresses and ports appear as ``*''. (For more
information regarding the Internet naming conventions, refer to
The possible state values for TCP sockets are as follows:
CLOSED Closed: the socket is not being used.
LISTEN Listening for incoming connections.
SYN_SENT Actively trying to establish connection.
SYN_RECEIVED Initial synchronization of the connection
ESTABLISHED Connection has been established.
CLOSE_WAIT Remote shut down: waiting for the socket to
FIN_WAIT_1 Socket closed, shutting down connection.
CLOSING Closed, then remote shutdown: awaiting
LAST_ACK Remote shut down, then closed: awaiting
FIN_WAIT_2 Socket closed, waiting for shutdown from
TIME_WAIT Wait after close for remote shutdown
Network Data Structures (Second Form)
The form of the display depends upon which of the -m, -i, -h or -r,
options you select. (If you specify more than one of these options,
netstat selects one in the order listed here.)
Routing Table Display
The routing table display lists the available routes and the status of
each. Each route consists of a destination host or network, and a
gateway to use in forwarding packets. The flags column shows the sta-
tus of the route (U if ``up''), whether the route is to a gateway (G),
and whether the route was created dynamically by a redirect (D).
Direct routes are created for each interface attached to the local
host; the gateway field for such entries shows the address of the out-
The refcnt column gives the current number of active uses per route.
(Connection-oriented protocols normally hold on to a single route for
the duration of a connection, whereas connectionless protocols obtain a
route while sending to the same destination.)
The use column displays the number of packets sent per route.
The interface entry indicates the network interface utilized for the
Cumulative Traffic Statistics (Third Form)
When the interval argument is given, netstat displays a table of cumu-
lative statistics regarding packets transferred, errors and collisions,
the network addresses for the interface, and the maximum transmission
unit (``mtu''). The first line of data displayed, and every 24th line
thereafter, contains cumulative statistics from the time the system was
last rebooted. Each subsequent line shows incremental statistics for
the interval (specified on the command line) since the previous dis-
hosts(5), networks(5), protocols(5), services(5) iostat(8), trpt(8C),
The notion of errors is ill-defined. Collisions mean something else
for the IMP.
The kernel's tables can change while netstat is examining them, creat-
ing incorrect or partial displays.
6 January 1989 NETSTAT(8C)