Penguin
Recent Changes
Annotated edit history of netstat(8) version 2, including all changes. View license author blame.
Rev Author # Line
1 perry 1 NETSTAT
2 !!!NETSTAT
3 NAME
4 SYNOPSIS
5 DESCRIPTION
6 OPTIONS
7 OUTPUT
8 NOTES
9 FILES
10 SEE ALSO
11 BUGS
12 AUTHORS
13 ----
14 !!NAME
15
16
17 netstat - Print network connections, routing tables, interface statistics, masquerade connections, and multicast memberships
18 !!SYNOPSIS
19
20
21 __netstat__ [[''address_family_options'']
22 [[__--tcp__|__-t__] [[__--udp__|__-u__]
23 [[__--raw__|__-w__] [[__--listening__|__-l__]
24 [[__--all__|__-a__] [[__--numeric__|__-n__]
25 [[__--numeric-hosts__] [[__--numeric-ports__]
26 [[__--numeric-users__] [[__--symbolic__|__-N__]
27 [[__--extend__|__-e__[[__--extend__|__-e]__]
28 [[__--timers__|__-o__] [[__--program__|__-p__]
29 [[__--verbose__|__-v__]
30 [[__--continuous__|__-c]__
31
32
33 __netstat__ {__--route__|__-r__}
34 [[''address_family_options'']
35 [[__--extend__|__-e__[[__--extend__|__-e]__]
36 [[__--verbose__|__-v__] [[__--numeric__|__-n__]
37 [[__--numeric-hosts__] [[__--numeric-ports__]
38 [[__--numeric-users__]
39 [[__--continuous__|__-c]__
40
41
42 __netstat__ {__--interfaces__|__-i__}
43 [[__--all__|__-a__]
44 [[__--extend__|__-e__[[__--extend__|__-e]__]
45 [[__--verbose__|__-v__] [[__--program__|__-p__]
46 [[__--numeric__|__-n__] [[__--numeric-hosts__]
47 [[__--numeric-ports__] [[__--numeric-users__]
48 [[__--continuous__|__-c]__
49
50
51 __netstat__ {__--groups__|__-g__}
52 [[__--numeric__|__-n__] [[__--numeric-hosts__]
53 [[__--numeric-ports__] [[__--numeric-users__]
54 [[__--continuous__|__-c]__
55
56
57 __netstat__ {__--masquerade__|__-M__}
58 [[__--extend__|__-e__] [[__--numeric__|__-n__]
59 [[__--numeric-hosts__] [[__--numeric-ports__]
60 [[__--numeric-users__]
61 [[__--continuous__|__-c]__
62
63
64 __netstat__ {__--statistics__|__-s__}
65 [[__--tcp__|__-t__] [[__--udp__|__-u__]
66 [[__--raw__|__-w__]
67
68
69 __netstat__ {__--version__|__-V__}
70
71
72 __netstat__ {__--help__|__-h__}
73
74
75 ''address_family_options'':
76
77
78 [[__--protocol=__{__inet__,__unix__,__ipx__,__ax25__,__netrom__,__ddp__}[[,__...]__]
79 [[__--unix__|__-x__] [[__--inet__|__--ip__]
80 [[__--ax25__] [[__--ipx__] [[__--netrom__]
81 [[__--ddp__]
82 !!DESCRIPTION
83
84
85 __Netstat__ prints information about the Linux networking
86 subsystem. The type of information printed is controlled by
87 the first argument, as follows:
88
89
90 __(none)__
91
92
93 By default, __netstat__ displays a list of open sockets.
94 If you don't specify any address families, then the active
95 sockets of all configured address families will be
96 printed.
97
98
99 __--route , -r__
100
101
102 Display the kernel routing tables.
103
104
105 __--groups , -g__
106
107
108 Display multicast group membership information for IPv4 and
109 IPv6.
110
111
112 __--interface, -i__
113
114
115 Display a table of all network interfaces.
116
117
118 __--masquerade , -M__
119
120
121 Display a list of masqueraded connections.
122
123
124 __--statistics , -s__
125
126
127 Display summary statistics for each protocol.
128 !!OPTIONS
129
130
131 __--verbose , -v__
132
133
134 Tell the user what is going on by being verbose. Especially
135 print some useful information about unconfigured address
136 families.
137
138
139 __--numeric , -n__
140
141
142 Show numerical addresses instead of trying to determine
143 symbolic host, port or user names.
144
145
146 __--numeric-hosts__
147
148
149 shows numerical host addresses but does not affect the
150 resolution of port or user names.
151
152
153 __--numeric-ports__
154
155
156 shows numerical port numbers but does not affect the
157 resolution of host or user names.
158
159
160 __--numeric-users__
161
162
163 shows numerical user IDs but does not affect the resolution
164 of host or port names.
165
166
167 __--protocol=__''family'' , __-A__
168
169
170 Specifies the address families (perhaps better described as
171 low level protocols) for which connections are to be shown.
172 ''family'' is a comma (',') separated list of address
173 family keywords like __inet__, __unix__, __ipx__,
174 __ax25__, __netrom__, and __ddp__. This has the
175 same effect as using the __--inet__, __--unix__
176 (__-x__), __--ipx__, __--ax25__, __--netrom__,
177 and __--ddp__ options.
178
179
180 The address family __inet__ includes raw, udp and tcp
181 protocol sockets.
182
183
184 __-c, --continuous__
185
186
187 This will cause __netstat__ to print the selected
188 information every second continuously.
189
190
191 __-e, --extend__
192
193
194 Display additional information. Use this option twice for
195 maximum detail.
196
197
198 __-o, --timers__
199
200
201 Include information related to networking
202 timers.
203
204
205 __-p, --program__
206
207
208 Show the PID and name of the program to which each socket
209 belongs.
210
211
212 __-l, --listening__
213
214
215 Show only listening sockets. (These are omitted by
216 default.)
217
218
219 __-a, --all__
220
221
222 Show both listening and non-listening sockets. With the
223 __--interfaces__ option, show interfaces that are not
224 up
225
226
227 __-F__
228
229
230 Print routing information from the FIB. (This is the
231 default.)
232
233
234 __-C__
235
236
237 Print routing information from the route cache.
238 ''UP''.
239 !!OUTPUT
240
241
242 __Active Internet connections__ (TCP, UDP,
243 raw)
244
245
246 __Proto__
247
248
249 The protocol (tcp, udp, raw) used by the
250 socket.
251
252
253 __Recv-Q__
254
255
256 The count of bytes not copied by the user program connected
257 to this socket.
258
259
260 __Send-Q__
261
262
263 The count of bytes not acknowledged by the remote
264 host.
265
266
267 __Local Address__
268
269
270 Address and port number of the local end of the socket.
271 Unless the __--numeric__ (__-n__) option is specified,
272 the socket address is resolved to its canonical host name
273 (FQDN), and the port number is translated into the
274 corresponding service name.
275
276
277 __Foreign Address__
278
279
280 Address and port number of the remote end of the socket.
281 Analogous to
282
283
284 __State__
285
286
287 The state of the socket. Since there are no states in raw
288 mode and usually no states used in UDP, this column may be
289 left blank. Normally this can be one of several
290 values:
291
292
293 ''ESTABLISHED''
294
295
296 The socket has an established connection.
297
298
299 ''SYN_SENT''
300
301
302 The socket is actively attempting to establish a
303 connection.
304
305
306 ''SYN_RECV''
307
308
309 A connection request has been received from the
310 network.
311
312
313 ''FIN_WAIT1''
314
315
316 The socket is closed, and the connection is shutting
317 down.
318
319
320 ''FIN_WAIT2''
321
322
323 Connection is closed, and the socket is waiting for a
324 shutdown from the remote end.
325
326
327 ''TIME_WAIT''
328
329
330 The socket is waiting after close to handle packets still in
331 the network.
332
333
334 ''CLOSE''
335
336
337 The socket is not being used.
338
339
340 ''CLOSE_WAIT''
341
342
343 The remote end has shut down, waiting for the socket to
344 close.
345
346
347 ''LAST_ACK''
348
349
350 The remote end has shut down, and the socket is closed.
351 Waiting for acknowledgement.
352
353
354 ''LISTEN''
355
356
357 The socket is listening for incoming connections. Such
358 sockets are not included in the output unless you specify
359 the __--listening__ (__-l__) or __--all__
360 (__-a__) option.
361
362
363 ''CLOSING''
364
365
366 Both sockets are shut down but we still don't have all our
367 data sent.
368
369
370 ''UNKNOWN''
371
372
373 The state of the socket is unknown.
374
375
376 __User__
377
378
379 The username or the user id (UID) of the owner of the
380 socket.
381
382
383 __PID/Program name__
384
385
386 Slash-separated pair of the process id (PID) and process
387 name of the process that owns the socket. __--program__
388 causes this column to be included. You will also need
389 ''superuser'' privileges to see this information on
390 sockets you don't own. This identification information is
391 not yet available for IPX sockets.
392
393
394 __Timer__
395
396
397 (this needs to be written)
398
399
400 __Active UNIX domain Sockets__
401
402
403 __Proto__
404
405
406 The protocol (usually unix) used by the socket.
407
408
2 perry 409 __!RefCnt__
1 perry 410
411
412 The reference count (i.e. attached processes via this
413 socket).
414
415
416 __Flags__
417
418
419 The flags displayed is SO_ACCEPTON (displayed as
420 __ACC__), SO_WAITDATA (__W__) or SO_NOSPACE
421 (__N__). SO_ACCECPTON is used on unconnected sockets if
422 their corresponding processes are waiting for a connect
423 request. The other flags are not of normal
424 interest.
425
426
427 __Type__
428
429
430 There are several types of socket access:
431
432
433 ''SOCK_DGRAM''
434
435
436 The socket is used in Datagram (connectionless)
437 mode.
438
439
440 ''SOCK_STREAM''
441
442
443 This is a stream (connection) socket.
444
445
446 ''SOCK_RAW''
447
448
449 The socket is used as a raw socket.
450
451
452 ''SOCK_RDM''
453
454
455 This one serves reliably-delivered messages.
456
457
458 ''SOCK_SEQPACKET''
459
460
461 This is a sequential packet socket.
462
463
464 ''SOCK_PACKET''
465
466
467 Raw interface access socket.
468
469
470 ''UNKNOWN''
471
472
473 Who ever knows what the future will bring us - just fill in
474 here :-)
475
476
477 __State__
478
479
480 This field will contain one of the following
481 Keywords:
482
483
484 ''FREE''
485
486
487 The socket is not allocated
488
489
490 ''LISTENING''
491
492
493 The socket is listening for a connection request. Such
494 sockets are only included in the output if you specify the
495 __--listening__ (__-l__) or __--all__ (__-a__)
496 option.
497
498
499 ''CONNECTING''
500
501
502 The socket is about to establish a connection.
503
504
505 ''CONNECTED''
506
507
508 The socket is connected.
509
510
511 ''DISCONNECTING''
512
513
514 The socket is disconnecting.
515
516
517 ''(empty)''
518
519
520 The socket is not connected to another one.
521
522
523 ''UNKNOWN''
524
525
526 This state should never happen.
527
528
529 __PID/Program name__
530
531
532 Process ID (PID) and process name of the process that has
533 the socket open. More info available in __Active Internet
534 connections__ section written above.
535
536
537 __Path__
538
539
540 This is the path name as which the corresponding processes
541 attached to the socket.
542
543
544 __Active IPX sockets__
545
546
547 (this needs to be done by somebody who knows
548 it)
549
550
551 __Active NET/ROM sockets__
552
553
554 (this needs to be done by somebody who knows
555 it)
556
557
558 __Active AX.25 sockets__
559
560
561 (this needs to be done by somebody who knows
562 it)
563 !!NOTES
564
565
566 Starting with Linux release 2.2 __netstat -i__ does not
567 show interface statistics for alias interfaces. To get per
568 alias interface counters you need to setup explicit rules
569 using the __ipchains(8)__ command.
570 !!FILES
571
572
573 ''/etc/services'' -- The services translation
574 file
575
576
577 ''/proc'' -- Mount point for the proc filesystem, which
578 gives access to kernel status information via the following
579 files.
580
581
582 ''/proc/net/dev'' -- device information
583
584
585 ''/proc/net/raw'' -- raw socket information
586
587
588 ''/proc/net/tcp'' -- TCP socket information
589
590
591 ''/proc/net/udp'' -- UDP socket information
592
593
594 ''/proc/net/igmp'' -- IGMP multicast
595 information
596
597
598 ''/proc/net/unix'' -- Unix domain socket
599 information
600
601
602 ''/proc/net/ipx'' -- IPX socket information
603
604
605 ''/proc/net/ax25'' -- AX25 socket
606 information
607
608
609 ''/proc/net/appletalk'' -- DDP (appletalk) socket
610 information
611
612
613 ''/proc/net/nr'' -- NET/ROM socket
614 information
615
616
617 ''/proc/net/route'' -- IP routing
618 information
619
620
621 ''/proc/net/ax25_route'' -- AX25 routing
622 information
623
624
625 ''/proc/net/ipx_route'' -- IPX routing
626 information
627
628
629 ''/proc/net/nr_nodes'' -- NET/ROM nodelist
630
631
632 ''/proc/net/nr_neigh'' -- NET/ROM neighbours
633
634
635 ''/proc/net/ip_masquerade'' -- masqueraded
636 connections
637
638
639 ''/proc/net/snmp'' -- statistics
640 !!SEE ALSO
641
642
643 route(8), ifconfig(8), ipchains(8),
644 iptables(8), proc(5)
645 !!BUGS
646
647
648 Occasionally strange information may appear if a socket
649 changes as it is viewed. This is unlikely to
650 occur.
651 !!AUTHORS
652
653
654 The netstat user interface was written by Fred Baumgarten
655 The man page and the command included in the net-tools
656 package is totally rewritten by Bernd Eckenfels
657 ----
This page is a man page (or other imported legacy content). We are unable to automatically determine the license status of this page.