Switch to SpeakEasy.net DSL

The Modular Manual Browser

Home Page
Manual: (SunOS-4.1.3)
Apropos / Subsearch:
optional field

NETSTAT(8C)                                                        NETSTAT(8C)

       netstat - show network status

       netstat [ -aAn ] [ -f address_family ] [ system ] [ core ]

       netstat [ -n ] [ -s ] [ -m | -i | -r ] [ -f address_family ] [ system ]
       [ core ]

       netstat [ -n ] [ -I interface ] interval [ system ] [ core ]

       This program is available with  the  Networking  software  installation
       option.  Refer to for information on how to install optional software.

       netstat  displays  the  contents of various network-related data struc-
       tures in various formats, depending on the options you select.

       The first form of the command displays a list  of  active  sockets  for
       each  protocol.   The  second form selects one from among various other
       network data structures.  The third form displays running statistics of
       packet  traffic on configured network interfaces; the interval argument
       indicates the number of seconds in which to gather  statistics  between

       The  default  value  for  the system argument is /vmunix; for core, the
       default is /dev/kmem.

       -a             Show the state of all sockets; normally sockets used  by
                      server processes are not shown.

       -A             Show  the address of any protocol control blocks associ-
                      ated with sockets; used for debugging.

       -f address_family
                      Limit statistics or address  control  block  reports  to
                      those  of the specified address_family, which can be one

                             inet    For the AF_INET address family, or
                             unix    For the AF_UNIX family.

       -i             Show the state of interfaces that have been auto-config-
                      ured.   Interfaces that are statically configured into a
                      system, but not located at boot time, are not shown.

       -I interface   Highlight information about the indicated interface in a
                      separate  column; the default (for the third form of the
                      command) is the interface with the  most  traffic  since
                      the  system  was  last  rebooted.   interface can be any
                      valid interface listed in the system configuration file,
                      such as ie0 or le0.

       -m             Show  the statistics recorded by management routines for
                      the network's private buffer pool.

       -n             Show network addresses  as  numbers.   netstat  normally
                      displays  addresses as symbols.  This option may be used
                      with any of the display formats.

       -r             Show the routing tables.  (When -s is also present, show
                      routing statistics instead.)

       -s             Show  per-protocol  statistics.   When  used with the -r
                      option, show routing statistics.

       -t             Replace queue length information with timer information.

   Active Sockets (First Form)
       The display for each active socket shows the local and remote  address,
       the  send  and  receive  queue  sizes (in bytes), the protocol, and the
       internal state of the protocol.

       The symbolic format  normally  used  to  display  socket  addresses  is


       when the name of the host is specified, or:


       if  a  socket  address  specifies a network but no specific host.  Each
       hostname and network is shown according to its entry in the  /etc/hosts
       or the /etc/networks file, as appropriate.

       If  the  network  or hostname for an address is not known (or if the -n
       option is specified), the numerical network address is shown.  Unspeci-
       fied,  or ``wildcard'', addresses and ports appear as ``*''.  (For more
       information  regarding  the  Internet  naming  conventions,  refer   to

   TCP Sockets
       The possible state values for TCP sockets are as follows:

              CLOSED              Closed: the socket is not being used.
              LISTEN              Listening for incoming connections.
              SYN_SENT            Actively trying to establish connection.
              SYN_RECEIVED        Initial  synchronization  of  the connection
                                  under way.
              ESTABLISHED         Connection has been established.
              CLOSE_WAIT          Remote shut down: waiting for the socket  to
              FIN_WAIT_1          Socket closed, shutting down connection.
              CLOSING             Closed,   then   remote  shutdown:  awaiting
              LAST_ACK            Remote  shut  down,  then  closed:  awaiting
              FIN_WAIT_2          Socket  closed,  waiting  for  shutdown from
              TIME_WAIT           Wait  after  close   for   remote   shutdown

   Network Data Structures (Second Form)
       The  form  of  the  display depends upon which of the -m, -i, -h or -r,
       options you select.  (If you specify more than one  of  these  options,
       netstat selects one in the order listed here.)

   Routing Table Display
       The  routing table display lists the available routes and the status of
       each.  Each route consists of a destination  host  or  network,  and  a
       gateway  to use in forwarding packets.  The flags column shows the sta-
       tus of the route (U if ``up''), whether the route is to a gateway  (G),
       and whether the route was created dynamically by a redirect (D).

       Direct  routes  are  created  for  each interface attached to the local
       host; the gateway field for such entries shows the address of the  out-
       going interface.

       The  refcnt  column  gives the current number of active uses per route.
       (Connection-oriented protocols normally hold on to a single  route  for
       the duration of a connection, whereas connectionless protocols obtain a
       route while sending to the same destination.)

       The use column displays the number of packets sent per route.

       The interface entry indicates the network interface  utilized  for  the

   Cumulative Traffic Statistics (Third Form)
       When  the interval argument is given, netstat displays a table of cumu-
       lative statistics regarding packets transferred, errors and collisions,
       the  network  addresses for the interface, and the maximum transmission
       unit (``mtu'').  The first line of data displayed, and every 24th  line
       thereafter, contains cumulative statistics from the time the system was
       last rebooted.  Each subsequent line shows incremental  statistics  for
       the  interval  (specified  on the command line) since the previous dis-

       hosts(5), networks(5), protocols(5), services(5)  iostat(8),  trpt(8C),

       The  notion  of  errors is ill-defined.  Collisions mean something else
       for the IMP.

       The kernel's tables can change while netstat is examining them,  creat-
       ing incorrect or partial displays.

                                6 January 1989                     NETSTAT(8C)