`netstat`

Show network status

Syntax:

netstat [-Aan]

netstat [-imnrs] 

netstat [-n] [-I [interface]] [-w wait]

netstat [-p protocol]

Options:

-A: With the default display, show the addresses of any protocol control blocks associated with sockets.
-a: In the default display, show the state of all sockets. Without -a, sockets used by server processes aren't shown.
-d: With either interface display (-i option or interval argument), show the number of dropped packets.
-I [interface]: Show information only about this interface. If interface isn't given, information for all interfaces will be displayed.
To see how this option is used with the interval argument, see under the Description below.
-i: Show the state of interfaces that have been auto-configured. Interfaces statically configured into a system but not located at boot time aren't shown.
-m: Show statistics recorded by the memory-management routines (the network manages a private pool of memory buffers).
-n: Show network addresses as numbers (normally netstat interprets addresses and attempts to display them symbolically).
-p protocol: Show statistics about protocol, which is either a well-known name for a protocol or an alias for it. Some protocol names and aliases are listed in the file /etc/protocols. A null response typically means that there are no interesting numbers to report. The utility will complain if protocol is unknown or if there's no statistics routine for it.
-r: Show the routing tables. When -s is also present, show routing statistics instead.
-s: Show per-protocol statistics.
-w wait: Specify the time interval for displaying interface statistics.

Description:

The netstat utility displays the contents of various network-related data structures. It displays in one of several output formats, depending on the options selected:

First form - displays a list of active sockets for each protocol.
Second form -displays the contents of one of the other network data structures, according to the option selected.
Third form - with the interval argument specified, this form continuously displays the information regarding packet traffic on the configured network interfaces.
Fourth form - displays statistics about the named protocol.

The default display, for active sockets, shows the local and remote addresses, the send and receive queue sizes (in bytes), the protocol, and the internal state of the protocol. If a socket's address specifies a network but no specific host address, address formats are of the form host.port or network.port

When known, the host and network addresses are displayed symbolically according to the databases /etc/hosts and /etc/networks, respectively. If a symbolic name for an address is unknown, or if -n is specified, the address is printed numerically, according to the address family. For more information regarding the Internet "dot format," see the inet_*() functions. Unspecified or wildcard addresses and ports appear as *.

Interface display

The interface display (-i option or interval argument) provides a table of cumulative statistics regarding errors, collisions, and packets transferred. The network addresses of the interface and the maximum transmission unit (MTU) are also displayed.

Routing table display

The routing table display (option -r) indicates the available routes and the status of each. Each route consists of a destination host or network and a gateway to use in forwarding packets. The display includes several fields:

flags

Shows the state of the route:

C: The route is cloned to create new routes. This is used by ARP to create the host-specific routes of the hosts on the Ethernet. See option L.
D: The route was created dynamically by a redirect.
G: The route uses a gateway.
H: The destination is a host.
L: The route contains a link-layer address. The host routes that ARP clones from the Ethernet network routes all have the link flag set.
M: The route has been modified by a redirect.
U: The route is up.

gateway

Direct routes are created for each interface attached to the local host. For such entries, this field shows the address of the outgoing interface.

interface

Indicates the network interface used for the route.

refcnt

Gives the current number of active uses of the route. Connection-oriented protocols normally hold on to a single route for the duration of a connection; connectionless protocols obtain a route while sending to the same destination.

use

Provides a count of the number of packets sent using the route.

Specifying an interface

When netstat is invoked with the interval argument, it displays a running count of statistics related to network interfaces. This display consists of a column for the primary interface (the first interface found during auto-configuration) and a column summarizing information for all interfaces. Using the -I option, you can replace the primary interface with another interface. The first line of each screen of information contains a summary since the system was last rebooted. Subsequent lines of output show values accumulated over the preceding interval.