Manual Pages
Table of Contents
netstat - show network status
netstat [ -an ]
netstat -mnrs
netstat -i | -I interface [ -dn ]
netstat -w interval [ -i | -I interface ] [ -dn ]
netstat [ -p protocol ]
The netstat command symbolically displays the contents of
various network-related data structures. There are a number
of output formats, depending on the options for the information
presented. The first form of the command displays a
list of active sockets for each protocol.
The second form presents the contents of one of the other
network data structures according to the option selected.
The third form will display cumulative statistics for all
interfaces or, with an interface specified using the -I
option, cumulative statistics for that interface. It will
also display the sum of the cumulative statistics for all
configured network interfaces.
The fourth form continuously displays information regarding
packet traffic on the interface that was configured first,
or with an interface specified using the -I option, packet
traffic for that interface. It will also display the sum of
the cumulative traffic information for all configured network
interfaces.
The fifth form displays statistics about the protocol specified
by protocol.
- -a
- Show the state of all sockets; normally
sockets used by server processes are not
shown.
- -d
- With either interface display (option -i or
an interval, as described below), show the
number of dropped packets.
- -I interface
- Show information only about this interface.
When used in the third form with an interval
specified as described below, information
about the indicated interface is highlighted
in a separated column. (The default interface
highlighted is the first interface configured
into the system.)
- -i
- Show the state of interfaces that have been
configured.
- - m
- Show statistics recorded by the memory
management routines for the network's private
pool of buffers.
- -n
- Show network addresses as numbers. netstat
normally interprets addresses and attempts to
display them symbolically. This option may
be used with any of the display formats that
display network addresses.
- -p protocol
- Show statistics about protocol , which is
one of tcp, udp, ip, or icmp. A null
response typically means that there are no
interesting numbers to report. The program
will complain if protocol is unknown or if
there is no statistics routine for it.
- - s
- Show per-protocol statistics. If this
option is repeated, counters with a value of
zero are suppressed.
- -r
- Show the routing tables. When - s is also
present, show routing statistics instead.
- -w wait
- Show network interface statistics at intervals
of wait seconds.
The default display, for TCP sockets, shows the local and
remote addresses, send window and send queue size (in
bytes), receive window and receive queue sizes (in bytes),
and the state of the connection. For UDP sockets, it shows
the local and remote addresses, and the send and receive
queue size (in bytes). Address formats are of the form
``host.port'' or ``network.port'' if a socket's address
specifies a network but no specific host address. If known,
the host and network addresses are displayed symbolically
according to the databases /etc/hosts and /etc/networks,
respectively. If a symbolic name for an address is not
known, or if the -n option is specified, the address is
printed numerically, according to the address family.
Unspecified, or ``wildcard'', addresses and ports appear as
``*''.
The interface display specified by the -i or -I options provides
a table of cumulative statistics regarding packets
transferred, errors, and collisions. The network addresses
of the interface and the maximum transmission unit (``mtu'')
are also displayed. If the interface is currently down,
then a ``*'' is appended to the interface name.
When an interval is specified, a summary of the interface
information, consisting of packets transferred, errors, and
collisions, is displayed.
The routing table display indicates the available routes and
their status. Each route consists of a destination host or
network and a gateway to use in forwarding packets. The
flags field shows a collection of information about the
route stored as binary choices; the flags are:
2 Protocol-specific routing flag #2 (for ARP
entries, means that the entry is "published").
- C
- Use of this route will cause a new route to be
generated and used.
- D
- The route was created dynamically by a redirect.
- G
- The route is to a gateway.
- H
- The route is to a host (otherwise, it's to a net).
- L
- The route includes valid protocol to link address
translation.
- M
- The route was modified dynamically by a redirect.
- R
- The route has timed out.
- S
- The route was manually added with a route command
(see na_route(1)).
- U
- The route is usable (``up'').
Direct routes are created for each interface attached to the
local host; the gateway field for such entries shows the
address of the outgoing interface. The refcnt field gives
the current number of active uses of the route. Connection
oriented protocols normally hold on to a single route for
the duration of a connection while connectionless protocols
obtain a route whenever they transmit to a destination. The
use field provides a count of the number of packets sent
using that route. The interface entry indicates the network
interface utilized for the route.
When netstat is invoked with the -w option and an interval
argument, it displays a running count of statistics related
to network interfaces. An obsolescent version of this
option used a numeric parameter with no option, and is
currently supported for backward compatibility. This
display consists of a column for the primary interface and a
column summarizing information for all interfaces. The
default primary interface is the first interface configured
into the system. The primary interface may be replaced with
another interface with the -I option. The first line of
each screen of information contains a summary since the system
was last rebooted. Subsequent lines of output show
values accumulated over the preceding interval.
Each filer in a cluster maintains its own socket, routing,
and interface tables. If a filer is not in partner mode,
the netstat command displays the information in the tables
on the live filer. If a filer is in partner mode, it executes
the netstat command on behalf of the failed filer,
which displays the information in the tables on the failed
filer.
However, in takeover mode, counters displayed by the netstat
command represent the combined statistics of the live filer
and the failed filer. For example, from the statistics, you
cannot determine how many packets were received on behalf of
the live filer and how many packets were received on behalf
of the failed filer.
In takeover mode, network interface names used by the failed
filer are mapped to network interfaces on the live filer.
When you enter the netstat command in partner mode, the network
interface names displayed are the network interface
names on the failed filer.
If you enter the netstat command in partner mode, you might
see a plus sign (+) appended to some network interface names
in the output. The plus sign indicates that the network
interfaces are used as shared interfaces.
ATM adapter statistics are displayed through the
ForeIP/SPANS
interfaces and/or ELAN interfaces on the adapter. In takeover
mode, ELAN interface names are those on the live filer,
and in partner mode ELAN interface names are those on the
failed filer.
Statistics displayed by the netstat command are cumulative.
That is, a giveback operation does not zero out the statistics.
After giving back the virtual filer's resources, the
live filer does not subtract the statistics about operations
it performed on behalf of the failed filer in takeover mode.
- /etc/hosts
- host name database
- /etc/networks
- network name database
na_ifconfig(1), na_nfsstat(1), na_partner(1), na_sysstat(1),
na_hosts(5), na_networks(5)
Table of Contents