1 .\" Copyright (c) 2015 Apple Inc. All rights reserved.
3 .\" @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 .\" This file contains Original Code and/or Modifications of Original Code
6 .\" as defined in and that are subject to the Apple Public Source License
7 .\" Version 2.0 (the 'License'). You may not use this file except in
8 .\" compliance with the License. The rights granted to you under the License
9 .\" may not be used to create, or enable the creation or redistribution of,
10 .\" unlawful or unlicensed copies of an Apple operating system, or to
11 .\" circumvent, violate, or enable the circumvention or violation of, any
12 .\" terms of an Apple operating system software license agreement.
14 .\" Please obtain a copy of the License at
15 .\" http://www.opensource.apple.com/apsl/ and read it before using this file.
17 .\" The Original Code and all software distributed under the License are
18 .\" distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
19 .\" EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
20 .\" INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
21 .\" FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
22 .\" Please see the License for the specific language governing rights and
23 .\" limitations under the License.
25 .\" @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 .\" Copyright (c) 1983, 1990, 1992, 1993
28 .\" The Regents of the University of California. All rights reserved.
30 .\" Redistribution and use in source and binary forms, with or without
31 .\" modification, are permitted provided that the following conditions
33 .\" 1. Redistributions of source code must retain the above copyright
34 .\" notice, this list of conditions and the following disclaimer.
35 .\" 2. Redistributions in binary form must reproduce the above copyright
36 .\" notice, this list of conditions and the following disclaimer in the
37 .\" documentation and/or other materials provided with the distribution.
38 .\" 3. All advertising materials mentioning features or use of this software
39 .\" must display the following acknowledgement:
40 .\" This product includes software developed by the University of
41 .\" California, Berkeley and its contributors.
42 .\" 4. Neither the name of the University nor the names of its contributors
43 .\" may be used to endorse or promote products derived from this software
44 .\" without specific prior written permission.
46 .\" THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
47 .\" ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
48 .\" IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
49 .\" ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
50 .\" FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
51 .\" DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
52 .\" OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
53 .\" HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
54 .\" LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
55 .\" OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 .\" @(#)netstat.1 8.8 (Berkeley) 4/18/94
59 .\" $FreeBSD: src/usr.bin/netstat/netstat.1,v 1.22.2.7 2001/08/10 09:07:09 ru Exp $
66 .Nd show network status
70 .Op Fl f Ar address_family | Fl p Ar protocol
74 .Op Fl f Ar address_family
77 .Fl i | I Ar interface
83 .Op Fl f Ar address_family | Fl p Ar protocol
86 .Fl i | I Ar interface Fl s
87 .Op Fl f Ar address_family | Fl p Ar protocol
94 .Op Fl f Ar address_family
98 .\"-----------------------------------------------------------------------------------------
100 .\"-----------------------------------------------------------------------------------------
103 command symbolically displays the contents of various network-related data structures.
104 There are a number of output formats, depending on the options for the information presented.
105 The first form of the command displays a list of active sockets for each protocol.
106 The second form presents the contents of one of the other network data structures according
107 to the option selected. Using the third form, with a
111 will continuously display the information regarding packet traffic on the configured network
112 interfaces. The fourth form displays statistics for the specified protocol or address family. If a
114 interval is specified, the protocol information over the last interval seconds will be displayed.
115 The fifth form displays per-interface statistics for the specified protocol or address family.
116 The sixth form displays
118 statistics. The seventh form displays routing table for the specified address family. The
119 eighth form displays routing statistics.
121 The options have the following meaning:
124 With the default display, show the address of any protocol control blocks associated with
125 sockets and the flow hash; used for debugging.
127 With the default display, show the state of all sockets; normally sockets used by server
128 processes are not shown. With the routing table display (option
130 as described below), show protocol-cloned routes (routes generated by a
132 parent route); normally these routes are not shown.
134 With the interface display (option
136 as described below), show the number of bytes in and out.
138 With the queue statistics (option
140 as described below), show only those for the specified
143 With either interface display (option
145 or an interval, as described below), show the number of dropped packets.
146 .It Fl f Ar address_family
147 Limit statistics or address control block reports to those of the specified
149 The following address families are recognized:
161 Show information related to multicast (group address) membership. If the
163 option is also present, show extended interface group management statistics. If the
165 option is specified, show link-layer memberships; they are suppressed by default.
166 Source lists for each group will also be printed. Specifiying
168 twice will print the control plane timers for each interface and the source list counters
169 for each group. If the
171 is specified, only that interface will be shown. If the
173 is specified, only information for the address family will be displayed.
174 .It Fl I Ar interface
175 Show information about the specified interface; used with a
177 interval as described below.
180 option is present, show per-interface protocol statistics on the
186 or for all protocol families.
188 Show the state of interfaces which have been auto-configured (interfaces statically
189 configured into a system, but not located at boot time are not shown). If the
191 options is also present, multicast addresses currently in use are shown for each
192 Ethernet interface and for each IP interface address. Multicast addresses are shown
193 on separate lines following the interface address with which they are associated.
196 option is present, show per-interface statistics on all interfaces for the specified
200 or for all protocol families.
202 Show the size of the various listen queues. The first count shows the number of
203 unaccepted connections. The second count shows the amount of unaccepted incomplete
204 connections. The third count is the maximum number of queued connections.
206 Print full IPv6 address.
208 Show statistics recorded by the memory management routines (the network stack manages a private pool of memory buffers). More detailed information about the buffers, which includes their cache related statistics, can be obtained by using
215 Show network addresses as numbers (normally
217 interprets addresses and attempts to display them symbolically). This option may be
218 used with any of the display formats.
220 Show statistics about
222 which is either a well-known name for a protocol or an alias for it. Some protocol
223 names and aliases are listed in the file
225 The special protocol name
227 is used to show bridging statistics. A null response typically means that there are
228 no interesting numbers to report. The program will complain if
230 is unknown or if there is no statistics routine for it.
232 Show network interface send queue statistics. By default all queues are displayed, unless
235 This option requires specifying an interface with
237 option. More detailed information about the queues, which includes their queueing algorithm related statistics, can be obtained by using
244 Show the routing tables. Use with
246 to show protocol-cloned routes. When
248 is also present, show routing statistics instead. When
252 assumes more columns are there and the maximum transmission unit.
253 More detailed information about the route metrics are displayed with
255 for TCP round trip times
260 flags to display only entries with non-zero RTT values.
264 Show reachability information. Use with
266 to show link-layer reachability information for a given interface.
268 Show per-protocol statistics. If this option is repeated, counters with a value of
269 zero are suppressed. For security reasons, root privileges are required to read TCP statistics and in the absence of such privileges all TCP counters will be reported as zero.
271 Show interface link status and interface state information about the specified interface. This option requires specifying an interface with
275 Increase verbosity level.
277 In certain displays, avoid truncating addresses even if this causes some fields to
280 Show network interface or protocol statistics at intervals of
284 Show extended link-layer reachability information in addition to that shown by
290 .\"-------------------------------------------------------------------------------
292 .\"-------------------------------------------------------------------------------
293 The default display, for active sockets, shows the local and remote addresses,
294 send and receive queue sizes (in bytes), protocol, and the internal state of
295 the protocol. Address formats are of the form
299 if a socket's address specifies a network but no specific host address.
300 If known, the host and network addresses are displayed symbolically
301 according to the databases
305 respectively. If a symbolic name for an address is unknown, or if the
307 option is specified, the address is printed numerically, according to the
308 address family. For more information regarding the Internet
315 addresses and ports appear as
318 Internet domain socket states:
320 CLOSED: The socket is not in use.
322 LISTEN: The socket is listening for incoming connections. Unconnected
323 listening sockets like these are only displayed when using the -a option.
325 SYN_SENT: The socket is actively trying to establish a connection to a
328 SYN_RCVD: The socket has passively received a connection request from a
331 ESTABLISHED: The socket has an established connection between a local
332 application and a remote peer.
334 CLOSE_WAIT: The socket connection has been closed by the remote peer,
335 and the system is waiting for the local application to close its half of
338 LAST_ACK: The socket connection has been closed by the remote peer, the
339 local application has closed its half of the connection, and the system
340 is waiting for the remote peer to acknowledge the close.
342 FIN_WAIT_1: The socket connection has been closed by the local
343 application, the remote peer has not yet acknowledged the close, and the
344 system is waiting for it to close its half of the connection.
346 FIN_WAIT_2: The socket connection has been closed by the local
347 application, the remote peer has acknowledged the close, and the system
348 is waiting for it to close its half of the connection.
350 CLOSING: The socket connection has been closed by the local application
351 and the remote peer simultaneously, and the remote peer has not yet
352 acknowledged the close attempt of the local application.
354 TIME_WAIT: The socket connection has been closed by the local
355 application, the remote peer has closed its half of the connection, and
356 the system is waiting to be sure that the remote peer received the last
360 The interface display provides a table of cumulative statistics regarding
361 packets transferred, errors, and collisions. The network addresses of the
362 interface and the maximum transmission unit
366 The routing table display indicates the available routes and their status.
367 Each route consists of a destination host or network and a gateway to use
368 in forwarding packets. The flags field shows a collection of information
369 about the route stored as binary choices. The individual flags are discussed
370 in more detail in the
374 manual pages. The mapping between letters and flags is:
375 .Bl -column XXXX RTF_BLACKHOLE
376 1 RTF_PROTO1 Protocol specific routing flag #1
377 2 RTF_PROTO2 Protocol specific routing flag #2
378 3 RTF_PROTO3 Protocol specific routing flag #3
379 B RTF_BLACKHOLE Just discard packets (during updates)
380 b RTF_BROADCAST The route represents a broadcast address
381 C RTF_CLONING Generate new routes on use
382 c RTF_PRCLONING Protocol-specified generate new routes on use
383 D RTF_DYNAMIC Created dynamically (by redirect)
384 G RTF_GATEWAY Destination requires forwarding by intermediary
385 H RTF_HOST Host entry (net otherwise)
386 I RTF_IFSCOPE Route is associated with an interface scope
387 i RTF_IFREF Route is holding a reference to the interface
388 L RTF_LLINFO Valid protocol to link address translation
389 M RTF_MODIFIED Modified dynamically (by redirect)
390 m RTF_MULTICAST The route represents a multicast address
391 R RTF_REJECT Host or net unreachable
392 r RTF_ROUTER Host is a default router
393 S RTF_STATIC Manually added
394 U RTF_UP Route usable
395 W RTF_WASCLONED Route was generated as a result of cloning
396 X RTF_XRESOLVE External daemon translates proto to link address
397 Y RTF_PROXY Proxying; cloned routes will not be scoped
400 Direct routes are created for each interface attached to the local host;
401 the gateway field for such entries shows the address of the outgoing
402 interface. The refcnt field gives the current number of active uses of
403 the route. Connection oriented protocols normally hold on to a single
404 route for the duration of a connection while connectionless protocols
405 obtain a route while sending to the same destination. The use field
406 provides a count of the number of packets sent using that route. The
407 interface entry indicates the network interface utilized for the route.
408 A route which is marked with the RTF_IFSCOPE flag is instantiated for
409 the corresponding interface. A cloning route which is marked with the
410 RTF_PROXY flag will not generate new routes that are associated
411 with its interface scope.
419 interval argument, it displays a running count of statistics related to
420 network interfaces or protocols. An obsolete version of this option used a numeric
421 parameter with no option, and is currently supported for backward
422 compatibility. By default, this display summarizes information for all
423 interfaces. Information for a specific interface may be displayed with the
443 IPv6 support was added by WIDE/KAME project.
445 The notion of errors is ill-defined.
git.ckatri.com / apple_cmds.git / blob